Play interactive tour

Edit tour

Windows Analysis Report 1ZDvfs8V0D

Overview

General Information

Sample Name:	1ZDvfs8V0D (renamed file extension from none to dll)
Analysis ID:	483801
MD5:	291d328b80fa04b559d8bef5875125f1
SHA1:	86664f646c9b2d93102046b34b20ec495f3a58da
SHA256:	803674f9a33df4d1a18051592df46f57a5c735367773691ab2bfb17a21aa6eb6
Tags:	Dridexexe
Infos:
Most interesting Screenshot:

Detection

Dridex

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Dridex unpacked file

Multi AV Scanner detection for submitted file

Benign windows process drops PE files

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Changes memory attributes in foreign processes to executable or writable

Machine Learning detection for sample

Queues an APC in another process (thread injection)

Machine Learning detection for dropped file

Accesses ntoskrnl, likely to find offsets for exploits

Contains functionality to prevent local Windows debugging

Uses Atom Bombing / ProGate to inject into other processes

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Queries the installation date of Windows

Detected potential crypto function

Found potential string decryption / allocating functions

Contains functionality to call native functions

Contains functionality to read the clipboard data

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

PE file contains executable resources (Code or Archives)

Drops files with a non-matching file extension (content does not match file extension)

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

PE file contains strange resources

Drops PE files

Binary contains a suspicious time stamp

PE file contains more sections than normal

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality for read data from the clipboard

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 1400 cmdline: loaddll64.exe 'C:\Users\user\Desktop\1ZDvfs8V0D.dll' MD5: A84133CCB118CF35D49A423CD836D0EF)

cmd.exe (PID: 1232 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\1ZDvfs8V0D.dll',#1 MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

rundll32.exe (PID: 2752 cmdline: rundll32.exe 'C:\Users\user\Desktop\1ZDvfs8V0D.dll',#1 MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 1380 cmdline: rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoA MD5: 73C519F050C20580F8A62C849D49215A)

explorer.exe (PID: 3292 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

msinfo32.exe (PID: 6444 cmdline: C:\Windows\system32\msinfo32.exe MD5: C471C6B06F47EA1C66E5FAA8DFCEF108)

msinfo32.exe (PID: 6468 cmdline: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe MD5: C471C6B06F47EA1C66E5FAA8DFCEF108)

mfpmp.exe (PID: 6516 cmdline: C:\Windows\system32\mfpmp.exe MD5: 7C3D09D6DB5DB4A272FCF4C1BB3986BD)

mfpmp.exe (PID: 6524 cmdline: C:\Users\user\AppData\Local\BxU\mfpmp.exe MD5: 7C3D09D6DB5DB4A272FCF4C1BB3986BD)

SystemPropertiesProtection.exe (PID: 6740 cmdline: C:\Windows\system32\SystemPropertiesProtection.exe MD5: B6C7834B60F72194E32822CD7F39D7A9)

rundll32.exe (PID: 4576 cmdline: rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoByHandle MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 5340 cmdline: rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoExA MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 5240 cmdline: rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoExW MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 3268 cmdline: rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoSizeA MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 1748 cmdline: rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoSizeExA MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 1744 cmdline: rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoSizeExW MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 6164 cmdline: rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoSizeW MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 6260 cmdline: rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoW MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 6284 cmdline: rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerFindFileA MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 6300 cmdline: rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerFindFileW MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 6320 cmdline: rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerInstallFileA MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 6376 cmdline: rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerInstallFileW MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 6404 cmdline: rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerLanguageNameA MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 6500 cmdline: rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerLanguageNameW MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 6620 cmdline: rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerQueryValueA MD5: 73C519F050C20580F8A62C849D49215A)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author
0000001D.00000002.335328318.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000003.00000002.338211546.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000007.00000002.252542553.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000021.00000002.352321962.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000018.00000002.306373888.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
0000001A.00000002.320976906.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000020.00000002.347477608.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000008.00000002.260356621.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
0000000A.00000002.268405369.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000023.00000002.356448688.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000016.00000002.298943238.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
0000000D.00000002.283715415.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000011.00000002.292039618.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
0000000B.00000002.279441131.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000004.00000002.246135848.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000024.00000002.361689565.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
0000001E.00000002.395045781.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000019.00000002.314059179.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
0000001B.00000002.327625102.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
Click to see the 15 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: 1ZDvfs8V0D.dll	Virustotal: Detection: 66%	Perma Link
Source: 1ZDvfs8V0D.dll	Metadefender: Detection: 65%	Perma Link
Source: 1ZDvfs8V0D.dll	ReversingLabs: Detection: 73%

Antivirus / Scanner detection for submitted sample

Show sources

Source: 1ZDvfs8V0D.dll

Avira: detected

Antivirus detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\0ubYqNmr\VERSION.dll	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\ibC\SPP.dll	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\0ubYqNmr\VERSION.dll	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\BxU\MFPlat.DLL	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\HaXuPA\SYSDM.CPL	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\Ui6tQfJoZ\DUI70.dll	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\0ubYqNmr\VERSION.dll	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\XyDPIStsf\dwmapi.dll	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\0ubYqNmr\VERSION.dll	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\whddZ\WTSAPI32.dll	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\0ubYqNmr\VERSION.dll	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\5zVf35m1I\SLC.dll	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\EkXB809\dpx.dll	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\W6MyNTlP8\WMsgAPI.dll	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\HaXuPA\SYSDM.CPL	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\Ui6tQfJoZ\DUI70.dll	Avira: detection malicious, Label: HEUR/AGEN.1114452

Machine Learning detection for sample

Show sources

Source: 1ZDvfs8V0D.dll

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\0ubYqNmr\VERSION.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\ibC\SPP.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\0ubYqNmr\VERSION.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\BxU\MFPlat.DLL	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\HaXuPA\SYSDM.CPL	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Ui6tQfJoZ\DUI70.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\0ubYqNmr\VERSION.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\XyDPIStsf\dwmapi.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\0ubYqNmr\VERSION.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\whddZ\WTSAPI32.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\0ubYqNmr\VERSION.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\5zVf35m1I\SLC.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\EkXB809\dpx.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\W6MyNTlP8\WMsgAPI.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\HaXuPA\SYSDM.CPL	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Ui6tQfJoZ\DUI70.dll	Joe Sandbox ML: detected

Exploits:

Accesses ntoskrnl, likely to find offsets for exploits

Show sources

Source: C:\Windows\explorer.exe

File opened: C:\Windows\system32\ntkrnlmp.exe

Jump to behavior

Source: 1ZDvfs8V0D.dll

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source:	Binary string: wextract.pdb source: wextract.exe.5.dr
Source:	Binary string: wextract.pdbGCTL source: wextract.exe.5.dr
Source:	Binary string: MFPMP.pdb source: mfpmp.exe, 00000023.00000002.357950587.00007FF7B6DB7000.00000002.00020000.sdmp, mfpmp.exe.5.dr
Source:	Binary string: osk.pdbGCTL source: osk.exe.5.dr
Source:	Binary string: PresentationHost.pdbGCTL source: PresentationHost.exe.5.dr
Source:	Binary string: unregmp2.pdb source: unregmp2.exe.5.dr
Source:	Binary string: osk.pdb source: osk.exe.5.dr
Source:	Binary string: SysResetErr.pdb source: SysResetErr.exe.5.dr
Source:	Binary string: MFPMP.pdbUGP source: mfpmp.exe, 00000023.00000002.357950587.00007FF7B6DB7000.00000002.00020000.sdmp, mfpmp.exe.5.dr
Source:	Binary string: systemreset.pdb source: systemreset.exe.5.dr
Source:	Binary string: SystemPropertiesProtection.pdb source: SystemPropertiesProtection.exe.5.dr
Source:	Binary string: SystemPropertiesProtection.pdbGCTL source: SystemPropertiesProtection.exe.5.dr
Source:	Binary string: AgentService.pdbGCTL source: AgentService.exe.5.dr
Source:	Binary string: SystemSettingsRemoveDevice.pdbGCTL source: SystemSettingsRemoveDevice.exe.5.dr
Source:	Binary string: unregmp2.pdbGCTL source: unregmp2.exe.5.dr
Source:	Binary string: rstrui.pdbGCTL source: rstrui.exe.5.dr
Source:	Binary string: AgentService.pdb source: AgentService.exe.5.dr
Source:	Binary string: rstrui.pdb source: rstrui.exe.5.dr
Source:	Binary string: SystemSettingsRemoveDevice.pdb source: SystemSettingsRemoveDevice.exe.5.dr
Source:	Binary string: irftp.pdb source: irftp.exe.5.dr
Source:	Binary string: lpksetup.pdbGCTL source: lpksetup.exe.5.dr
Source:	Binary string: SndVol.pdbGCTL source: SndVol.exe.5.dr
Source:	Binary string: msinfo32.pdb source: msinfo32.exe, 00000020.00000000.345704873.00007FF72A9F1000.00000002.00020000.sdmp, msinfo32.exe.5.dr
Source:	Binary string: SystemPropertiesPerformance.pdb source: SystemPropertiesPerformance.exe.5.dr
Source:	Binary string: irftp.pdbGCTL source: irftp.exe.5.dr
Source:	Binary string: SystemPropertiesPerformance.pdbGCTL source: SystemPropertiesPerformance.exe.5.dr
Source:	Binary string: PresentationHost.pdb source: PresentationHost.exe.5.dr
Source:	Binary string: systemreset.pdbGCTL source: systemreset.exe.5.dr
Source:	Binary string: lpksetup.pdb source: lpksetup.exe.5.dr
Source:	Binary string: msinfo32.pdbGCTL source: msinfo32.exe, 00000020.00000000.345704873.00007FF72A9F1000.00000002.00020000.sdmp, msinfo32.exe.5.dr
Source:	Binary string: SndVol.pdb source: SndVol.exe.5.dr
Source:	Binary string: SysResetErr.pdbGCTL source: SysResetErr.exe.5.dr

Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014005D290 FindFirstFileExW,	1_2_000000014005D290
Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe	Code function: 32_2_00007FF72A9E6334 #620,#624,#6050,#1040,#1040,#4436,#1122,#1040,#624,#1259,#1040,#626,FindFirstFileW,#624,#1259,#1262,#1122,#1040,#1040,#1040,_wcsicmp,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,#624,#1259,#1040,FindFirstFileW,#622,#624,#624,#1259,#1259,#1040,#1040,#1040,#1040,#1040,FindNextFileW,FindClose,RemoveDirectoryW,#1040,#1040,#1040,#1040,	32_2_00007FF72A9E6334
Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe	Code function: 32_2_00007FF72A9E72AC #624,FindFirstFileW,FindClose,#6050,_wcsicmp,#1040,#1463,_wcsicmp,#624,CreateFileW,GetFileSize,ReadFile,CloseHandle,#1040,CreateFileW,#6886,CloseHandle,#6886,_wcsicmp,#626,#624,#1040,#624,#1122,SetupIterateCabinetW,#1040,#626,#626,RegOpenKeyExW,RegGetValueW,#1126,RegCloseKey,#1040,#1040,#1040,RegOpenKeyExW,#624,#2975,RegSetValueExW,#1122,RegCloseKey,#1040,RegCloseKey,#620,#620,#628,#1042,#1040,#1040,#622,#1259,#1122,#1040,#1040,#1284,#2783,#1040,#1040,#1040,#1042,#1040,#1040,#1040,#1040,#1040,#1040,GetLastError,#626,#626,#4473,#4473,#1287,#1287,MessageBoxW,#1040,#1040,#1040,	32_2_00007FF72A9E72AC
Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe	Code function: 32_2_00007FF72A9E5DE8 #626,#626,#1122,#624,#6050,#1040,#1040,#624,#1284,#1040,#1259,#1122,#1040,FindFirstFileW,#624,#1259,#1358,#1040,#1040,FindNextFileW,FindClose,#624,#1259,#1122,#1040,#1040,FindFirstFileW,#624,#1259,#1040,#1040,FindNextFileW,FindClose,#1040,#1040,	32_2_00007FF72A9E5DE8

Source: explorer.exe, 00000005.00000000.268789709.0000000006840000.00000004.00000001.sdmp

String found in binary or memory: http://www.autoitscript.com/autoit3/J

Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe

Code function: 32_2_00007FF72A9E7D98 LoadCursorW,SetCursor,SetCursor,IsDlgButtonChecked,IsDlgButtonChecked,CheckDlgButton,GetDlgItem,GetWindowTextW,#1126,SendMessageW,PostMessageW,SendMessageW,SendMessageW,LoadIconW,LoadStringW,ShellAboutW,DestroyIcon,GetFocus,IsWindowEnabled,IsWindowEnabled,GetFocus,IsWindowVisible,IsWindowEnabled,OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,#624,#2781,#5979,SendMessageW,GlobalUnlock,#1040,CloseClipboard,SendMessageW,

32_2_00007FF72A9E7D98

Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe

Code function: 32_2_00007FF72A9EA9C4 GetFocus,IsWindowVisible,IsWindowEnabled,SendMessageW,#626,#1126,SendMessageW,SendMessageW,#1287,#1284,#1287,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,#1040,

32_2_00007FF72A9EA9C4

E-Banking Fraud:

Yara detected Dridex unpacked file

Show sources

Source: Yara match	File source: 0000001D.00000002.335328318.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.338211546.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.252542553.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.352321962.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.306373888.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.320976906.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.347477608.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.260356621.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.268405369.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.356448688.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.298943238.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.283715415.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.292039618.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.279441131.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.246135848.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.361689565.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.395045781.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.314059179.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.327625102.0000000140001000.00000020.00020000.sdmp, type: MEMORY

Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140034870	1_2_0000000140034870
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140035270	1_2_0000000140035270
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140048AC0	1_2_0000000140048AC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014005C340	1_2_000000014005C340
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140065B80	1_2_0000000140065B80
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014006A4B0	1_2_000000014006A4B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_00000001400524B0	1_2_00000001400524B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140026CC0	1_2_0000000140026CC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014004BD40	1_2_000000014004BD40
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_00000001400495B0	1_2_00000001400495B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140036F30	1_2_0000000140036F30
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140069010	1_2_0000000140069010
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140001010	1_2_0000000140001010
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140066020	1_2_0000000140066020
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014002F840	1_2_000000014002F840
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014005D850	1_2_000000014005D850
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140064080	1_2_0000000140064080
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140010880	1_2_0000000140010880
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_00000001400688A0	1_2_00000001400688A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014002D0D0	1_2_000000014002D0D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_00000001400018D0	1_2_00000001400018D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140016100	1_2_0000000140016100
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014001D100	1_2_000000014001D100
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014002A110	1_2_000000014002A110
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014001D910	1_2_000000014001D910
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140015120	1_2_0000000140015120
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014000B120	1_2_000000014000B120
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014004F940	1_2_000000014004F940
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140039140	1_2_0000000140039140
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140023140	1_2_0000000140023140
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140057950	1_2_0000000140057950
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014001E170	1_2_000000014001E170
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140002980	1_2_0000000140002980
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_00000001400611A0	1_2_00000001400611A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_00000001400389A0	1_2_00000001400389A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_00000001400381A0	1_2_00000001400381A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014002E1B0	1_2_000000014002E1B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_00000001400139D0	1_2_00000001400139D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_00000001400319F0	1_2_00000001400319F0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014002EA00	1_2_000000014002EA00
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140022A00	1_2_0000000140022A00
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014003B220	1_2_000000014003B220
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140067A40	1_2_0000000140067A40
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140069A50	1_2_0000000140069A50
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140007A60	1_2_0000000140007A60
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014003AAC0	1_2_000000014003AAC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014003A2E0	1_2_000000014003A2E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140062B00	1_2_0000000140062B00
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140018300	1_2_0000000140018300
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014002FB20	1_2_000000014002FB20
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140031340	1_2_0000000140031340
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140022340	1_2_0000000140022340
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140017B40	1_2_0000000140017B40
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014000BB40	1_2_000000014000BB40
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014004EB60	1_2_000000014004EB60
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140005370	1_2_0000000140005370
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014002CB80	1_2_000000014002CB80
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014006B390	1_2_000000014006B390
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140054BA0	1_2_0000000140054BA0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140033BB0	1_2_0000000140033BB0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_00000001400263C0	1_2_00000001400263C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_00000001400123C0	1_2_00000001400123C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140063BD0	1_2_0000000140063BD0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_00000001400663F0	1_2_00000001400663F0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140023BF0	1_2_0000000140023BF0
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014006B41B	1_2_000000014006B41B
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014006B424	1_2_000000014006B424
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014006B42D	1_2_000000014006B42D
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014006B436	1_2_000000014006B436
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014006B43D	1_2_000000014006B43D
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140024440	1_2_0000000140024440
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140005C40	1_2_0000000140005C40
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014006B446	1_2_000000014006B446
Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe	Code function: 32_2_00007FF72A9D9370	32_2_00007FF72A9D9370
Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe	Code function: 32_2_00007FF72A9EBD00	32_2_00007FF72A9EBD00
Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe	Code function: 32_2_00007FF72A9E2210	32_2_00007FF72A9E2210
Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe	Code function: 32_2_00007FF72A9EB184	32_2_00007FF72A9EB184
Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe	Code function: 32_2_00007FF72A9E72AC	32_2_00007FF72A9E72AC
Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe	Code function: 32_2_00007FF72A9DC314	32_2_00007FF72A9DC314
Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe	Code function: 32_2_00007FF72A9E0F98	32_2_00007FF72A9E0F98
Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe	Code function: 32_2_00007FF72A9EB7AC	32_2_00007FF72A9EB7AC
Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe	Code function: 32_2_00007FF72A9DB0E0	32_2_00007FF72A9DB0E0
Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe	Code function: 32_2_00007FF72A9E08D8	32_2_00007FF72A9E08D8
Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe	Code function: 32_2_00007FF72A9E7D98	32_2_00007FF72A9E7D98
Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe	Code function: 32_2_00007FF72A9E8F04	32_2_00007FF72A9E8F04
Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe	Code function: 32_2_00007FF72A9E66F8	32_2_00007FF72A9E66F8
Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe	Code function: 32_2_00007FF72A9D9E90	32_2_00007FF72A9D9E90
Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe	Code function: 32_2_00007FF72A9EA670	32_2_00007FF72A9EA670

Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe

Code function: String function: 00007FF72A9D89B8 appears 46 times

Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_0000000140046C90 NtClose,	1_2_0000000140046C90
Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014006A4B0 NtQuerySystemInformation,	1_2_000000014006A4B0
Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe	Code function: 32_2_00007FF72A9E07E8 #626,#626,#4473,#4473,NtQuerySystemInformation,#4473,#1040,#1040,	32_2_00007FF72A9E07E8

Source: irftp.exe.5.dr

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: 1ZDvfs8V0D.dll

Binary or memory string: OriginalFilenamekbdyj% vs 1ZDvfs8V0D.dll

Source: msinfo32.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: msinfo32.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msinfo32.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msinfo32.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msinfo32.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msinfo32.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msinfo32.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SystemPropertiesProtection.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SystemPropertiesProtection.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SystemPropertiesProtection.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: lpksetup.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: lpksetup.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: lpksetup.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: rstrui.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: rstrui.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: rstrui.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: wextract.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: wextract.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: wextract.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: irftp.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: irftp.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: irftp.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: irftp.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: irftp.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: irftp.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: irftp.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: irftp.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: irftp.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: irftp.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PresentationHost.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PresentationHost.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PresentationHost.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PresentationHost.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PresentationHost.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PresentationHost.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PresentationHost.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PresentationHost.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PresentationHost.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PresentationHost.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SystemPropertiesPerformance.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SystemPropertiesPerformance.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SystemPropertiesPerformance.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SndVol.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SndVol.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SndVol.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SndVol.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SndVol.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SndVol.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SndVol.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SndVol.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SndVol.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: osk.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: osk.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: osk.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: 1ZDvfs8V0D.dll	Static PE information: Number of sections : 43 > 10
Source: DUI70.dll.5.dr	Static PE information: Number of sections : 44 > 10
Source: VERSION.dll1.5.dr	Static PE information: Number of sections : 44 > 10
Source: SYSDM.CPL.5.dr	Static PE information: Number of sections : 44 > 10
Source: SLC.dll.5.dr	Static PE information: Number of sections : 44 > 10
Source: VERSION.dll3.5.dr	Static PE information: Number of sections : 44 > 10
Source: VERSION.dll0.5.dr	Static PE information: Number of sections : 44 > 10
Source: dwmapi.dll.5.dr	Static PE information: Number of sections : 44 > 10
Source: dpx.dll.5.dr	Static PE information: Number of sections : 43 > 10
Source: DUI70.dll0.5.dr	Static PE information: Number of sections : 44 > 10
Source: VERSION.dll2.5.dr	Static PE information: Number of sections : 44 > 10
Source: SYSDM.CPL0.5.dr	Static PE information: Number of sections : 44 > 10
Source: WTSAPI32.dll.5.dr	Static PE information: Number of sections : 44 > 10
Source: MFPlat.DLL.5.dr	Static PE information: Number of sections : 44 > 10
Source: WMsgAPI.dll.5.dr	Static PE information: Number of sections : 44 > 10
Source: VERSION.dll.5.dr	Static PE information: Number of sections : 44 > 10
Source: SPP.dll.5.dr	Static PE information: Number of sections : 44 > 10

Source: 1ZDvfs8V0D.dll	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: SLC.dll.5.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: MFPlat.DLL.5.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: SYSDM.CPL.5.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: VERSION.dll.5.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: VERSION.dll0.5.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: dpx.dll.5.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: SPP.dll.5.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: VERSION.dll1.5.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: DUI70.dll.5.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: WTSAPI32.dll.5.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: VERSION.dll2.5.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: SYSDM.CPL0.5.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: dwmapi.dll.5.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: WMsgAPI.dll.5.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: DUI70.dll0.5.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: VERSION.dll3.5.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: 1ZDvfs8V0D.dll	Virustotal: Detection: 66%
Source: 1ZDvfs8V0D.dll	Metadefender: Detection: 65%
Source: 1ZDvfs8V0D.dll	ReversingLabs: Detection: 73%

Source: 1ZDvfs8V0D.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe 'C:\Users\user\Desktop\1ZDvfs8V0D.dll'
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\1ZDvfs8V0D.dll',#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoA
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\1ZDvfs8V0D.dll',#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoByHandle
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoExA
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoExW
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoSizeA
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoSizeExA
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoSizeExW
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoSizeW
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoW
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerFindFileA
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerFindFileW
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerInstallFileA
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerInstallFileW
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerLanguageNameA
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\msinfo32.exe C:\Windows\system32\msinfo32.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerLanguageNameW
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\mfpmp.exe C:\Windows\system32\mfpmp.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\BxU\mfpmp.exe C:\Users\user\AppData\Local\BxU\mfpmp.exe
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerQueryValueA
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\SystemPropertiesProtection.exe C:\Windows\system32\SystemPropertiesProtection.exe
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\1ZDvfs8V0D.dll',#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoA	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoByHandle	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoExA	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoExW	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoSizeA	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoSizeExA	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoSizeExW	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoSizeW	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoW	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerFindFileA	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerFindFileW	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerInstallFileA	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerInstallFileW	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerLanguageNameA	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerLanguageNameW	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerQueryValueA	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\1ZDvfs8V0D.dll',#1	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\msinfo32.exe C:\Windows\system32\msinfo32.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\mfpmp.exe C:\Windows\system32\mfpmp.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\BxU\mfpmp.exe C:\Users\user\AppData\Local\BxU\mfpmp.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\SystemPropertiesProtection.exe C:\Windows\system32\SystemPropertiesProtection.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\eb42b1a5c308fc11edf1ddbdd25c8486_d06ed635-68f6-4e9a-955c-4899f5f57b9a

Jump to behavior

Source: irftp.exe.5.dr

Binary string: \Device\IrDAIrDA:TinyTP:LsapSelOBEX:IrXferOBEXControl Panel\InfraredControl Panel\Infrared\GlobalControl Panel\Infrared\IrTranPAllowSendShowTrayIconPlaySoundRecvdFilesLocationDisableIrTranPv1DisableIrCOMMExploreOnCompletionSaveAsUPFireventsIrMon: ReadUserPreferences::Failed to init sockets

Source: classification engine

Classification label: mal100.troj.expl.evad.winDLL@75/33@0/0

Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe

Code function: 32_2_00007FF72A9D7C40 #1126,#1126,#4436,#1040,#6050,#1122,#1040,#2783,DnsHostnameToComputerNameW,#1126,free,#1122,#1126,#1126,CoCreateInstance,#626,#2846,#1606,SysFreeString,#1040,

32_2_00007FF72A9D7C40

Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe

Code function: 32_2_00007FF72A9EFC05 GetLastError,FormatMessageW,#626,#1463,#4473,MessageBoxW,LocalFree,#1040,

32_2_00007FF72A9EFC05

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoA

Source: C:\Windows\System32\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\{5709daf4-0c2d-3394-6fc5-945ed839e8f5}
Source: C:\Windows\System32\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\{2dd23468-466f-1085-93c4-c8365b5e01d7}

Source: 1ZDvfs8V0D.dll

Static PE information: Image base 0x140000000 > 0x60000000

Source: 1ZDvfs8V0D.dll

Static file information: File size 2109440 > 1048576

Source: 1ZDvfs8V0D.dll

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source:	Binary string: wextract.pdb source: wextract.exe.5.dr
Source:	Binary string: wextract.pdbGCTL source: wextract.exe.5.dr
Source:	Binary string: MFPMP.pdb source: mfpmp.exe, 00000023.00000002.357950587.00007FF7B6DB7000.00000002.00020000.sdmp, mfpmp.exe.5.dr
Source:	Binary string: osk.pdbGCTL source: osk.exe.5.dr
Source:	Binary string: PresentationHost.pdbGCTL source: PresentationHost.exe.5.dr
Source:	Binary string: unregmp2.pdb source: unregmp2.exe.5.dr
Source:	Binary string: osk.pdb source: osk.exe.5.dr
Source:	Binary string: SysResetErr.pdb source: SysResetErr.exe.5.dr
Source:	Binary string: MFPMP.pdbUGP source: mfpmp.exe, 00000023.00000002.357950587.00007FF7B6DB7000.00000002.00020000.sdmp, mfpmp.exe.5.dr
Source:	Binary string: systemreset.pdb source: systemreset.exe.5.dr
Source:	Binary string: SystemPropertiesProtection.pdb source: SystemPropertiesProtection.exe.5.dr
Source:	Binary string: SystemPropertiesProtection.pdbGCTL source: SystemPropertiesProtection.exe.5.dr
Source:	Binary string: AgentService.pdbGCTL source: AgentService.exe.5.dr
Source:	Binary string: SystemSettingsRemoveDevice.pdbGCTL source: SystemSettingsRemoveDevice.exe.5.dr
Source:	Binary string: unregmp2.pdbGCTL source: unregmp2.exe.5.dr
Source:	Binary string: rstrui.pdbGCTL source: rstrui.exe.5.dr
Source:	Binary string: AgentService.pdb source: AgentService.exe.5.dr
Source:	Binary string: rstrui.pdb source: rstrui.exe.5.dr
Source:	Binary string: SystemSettingsRemoveDevice.pdb source: SystemSettingsRemoveDevice.exe.5.dr
Source:	Binary string: irftp.pdb source: irftp.exe.5.dr
Source:	Binary string: lpksetup.pdbGCTL source: lpksetup.exe.5.dr
Source:	Binary string: SndVol.pdbGCTL source: SndVol.exe.5.dr
Source:	Binary string: msinfo32.pdb source: msinfo32.exe, 00000020.00000000.345704873.00007FF72A9F1000.00000002.00020000.sdmp, msinfo32.exe.5.dr
Source:	Binary string: SystemPropertiesPerformance.pdb source: SystemPropertiesPerformance.exe.5.dr
Source:	Binary string: irftp.pdbGCTL source: irftp.exe.5.dr
Source:	Binary string: SystemPropertiesPerformance.pdbGCTL source: SystemPropertiesPerformance.exe.5.dr
Source:	Binary string: PresentationHost.pdb source: PresentationHost.exe.5.dr
Source:	Binary string: systemreset.pdbGCTL source: systemreset.exe.5.dr
Source:	Binary string: lpksetup.pdb source: lpksetup.exe.5.dr
Source:	Binary string: msinfo32.pdbGCTL source: msinfo32.exe, 00000020.00000000.345704873.00007FF72A9F1000.00000002.00020000.sdmp, msinfo32.exe.5.dr
Source:	Binary string: SndVol.pdb source: SndVol.exe.5.dr
Source:	Binary string: SysResetErr.pdbGCTL source: SysResetErr.exe.5.dr

Source: C:\Windows\System32\loaddll64.exe

Code function: 1_2_0000000140056A4D push rdi; ret

1_2_0000000140056A4E

Source: 1ZDvfs8V0D.dll	Static PE information: section name: .qkm
Source: 1ZDvfs8V0D.dll	Static PE information: section name: .cvjb
Source: 1ZDvfs8V0D.dll	Static PE information: section name: .tlmkv
Source: 1ZDvfs8V0D.dll	Static PE information: section name: .wucsxe
Source: 1ZDvfs8V0D.dll	Static PE information: section name: .fltwtj
Source: 1ZDvfs8V0D.dll	Static PE information: section name: .sfplio
Source: 1ZDvfs8V0D.dll	Static PE information: section name: .rpg
Source: 1ZDvfs8V0D.dll	Static PE information: section name: .bewzc
Source: 1ZDvfs8V0D.dll	Static PE information: section name: .vksvaw
Source: 1ZDvfs8V0D.dll	Static PE information: section name: .wmhg
Source: 1ZDvfs8V0D.dll	Static PE information: section name: .kswemc
Source: 1ZDvfs8V0D.dll	Static PE information: section name: .kaxfk
Source: 1ZDvfs8V0D.dll	Static PE information: section name: .pjf
Source: 1ZDvfs8V0D.dll	Static PE information: section name: .favk
Source: 1ZDvfs8V0D.dll	Static PE information: section name: .vhtukj
Source: 1ZDvfs8V0D.dll	Static PE information: section name: .hmbyox
Source: 1ZDvfs8V0D.dll	Static PE information: section name: .txms
Source: 1ZDvfs8V0D.dll	Static PE information: section name: .vqqm
Source: 1ZDvfs8V0D.dll	Static PE information: section name: .cbwb
Source: 1ZDvfs8V0D.dll	Static PE information: section name: .sggk
Source: 1ZDvfs8V0D.dll	Static PE information: section name: .cbotn
Source: 1ZDvfs8V0D.dll	Static PE information: section name: .urf
Source: 1ZDvfs8V0D.dll	Static PE information: section name: .yera
Source: 1ZDvfs8V0D.dll	Static PE information: section name: .sjj
Source: 1ZDvfs8V0D.dll	Static PE information: section name: .wcro
Source: 1ZDvfs8V0D.dll	Static PE information: section name: .imkkq
Source: 1ZDvfs8V0D.dll	Static PE information: section name: .mrdc
Source: 1ZDvfs8V0D.dll	Static PE information: section name: .eaph
Source: 1ZDvfs8V0D.dll	Static PE information: section name: .wqzg
Source: 1ZDvfs8V0D.dll	Static PE information: section name: .uwxw
Source: 1ZDvfs8V0D.dll	Static PE information: section name: .acz
Source: 1ZDvfs8V0D.dll	Static PE information: section name: .ktb
Source: 1ZDvfs8V0D.dll	Static PE information: section name: .nqplrs
Source: 1ZDvfs8V0D.dll	Static PE information: section name: .btah
Source: 1ZDvfs8V0D.dll	Static PE information: section name: .majbu
Source: 1ZDvfs8V0D.dll	Static PE information: section name: .zefvk
Source: 1ZDvfs8V0D.dll	Static PE information: section name: .qlndvj
Source: mfpmp.exe.5.dr	Static PE information: section name: .didat
Source: systemreset.exe.5.dr	Static PE information: section name: .imrsiv
Source: SysResetErr.exe.5.dr	Static PE information: section name: .imrsiv
Source: SndVol.exe.5.dr	Static PE information: section name: .imrsiv
Source: SndVol.exe.5.dr	Static PE information: section name: .didat
Source: SystemSettingsRemoveDevice.exe.5.dr	Static PE information: section name: .imrsiv
Source: SLC.dll.5.dr	Static PE information: section name: .qkm
Source: SLC.dll.5.dr	Static PE information: section name: .cvjb
Source: SLC.dll.5.dr	Static PE information: section name: .tlmkv
Source: SLC.dll.5.dr	Static PE information: section name: .wucsxe
Source: SLC.dll.5.dr	Static PE information: section name: .fltwtj
Source: SLC.dll.5.dr	Static PE information: section name: .sfplio
Source: SLC.dll.5.dr	Static PE information: section name: .rpg
Source: SLC.dll.5.dr	Static PE information: section name: .bewzc
Source: SLC.dll.5.dr	Static PE information: section name: .vksvaw
Source: SLC.dll.5.dr	Static PE information: section name: .wmhg
Source: SLC.dll.5.dr	Static PE information: section name: .kswemc
Source: SLC.dll.5.dr	Static PE information: section name: .kaxfk
Source: SLC.dll.5.dr	Static PE information: section name: .pjf
Source: SLC.dll.5.dr	Static PE information: section name: .favk
Source: SLC.dll.5.dr	Static PE information: section name: .vhtukj
Source: SLC.dll.5.dr	Static PE information: section name: .hmbyox
Source: SLC.dll.5.dr	Static PE information: section name: .txms
Source: SLC.dll.5.dr	Static PE information: section name: .vqqm
Source: SLC.dll.5.dr	Static PE information: section name: .cbwb
Source: SLC.dll.5.dr	Static PE information: section name: .sggk
Source: SLC.dll.5.dr	Static PE information: section name: .cbotn
Source: SLC.dll.5.dr	Static PE information: section name: .urf
Source: SLC.dll.5.dr	Static PE information: section name: .yera
Source: SLC.dll.5.dr	Static PE information: section name: .sjj
Source: SLC.dll.5.dr	Static PE information: section name: .wcro
Source: SLC.dll.5.dr	Static PE information: section name: .imkkq
Source: SLC.dll.5.dr	Static PE information: section name: .mrdc
Source: SLC.dll.5.dr	Static PE information: section name: .eaph
Source: SLC.dll.5.dr	Static PE information: section name: .wqzg
Source: SLC.dll.5.dr	Static PE information: section name: .uwxw
Source: SLC.dll.5.dr	Static PE information: section name: .acz
Source: SLC.dll.5.dr	Static PE information: section name: .ktb
Source: SLC.dll.5.dr	Static PE information: section name: .nqplrs
Source: SLC.dll.5.dr	Static PE information: section name: .btah
Source: SLC.dll.5.dr	Static PE information: section name: .majbu
Source: SLC.dll.5.dr	Static PE information: section name: .zefvk
Source: SLC.dll.5.dr	Static PE information: section name: .qlndvj
Source: SLC.dll.5.dr	Static PE information: section name: .csqxkt
Source: MFPlat.DLL.5.dr	Static PE information: section name: .qkm
Source: MFPlat.DLL.5.dr	Static PE information: section name: .cvjb
Source: MFPlat.DLL.5.dr	Static PE information: section name: .tlmkv
Source: MFPlat.DLL.5.dr	Static PE information: section name: .wucsxe
Source: MFPlat.DLL.5.dr	Static PE information: section name: .fltwtj
Source: MFPlat.DLL.5.dr	Static PE information: section name: .sfplio
Source: MFPlat.DLL.5.dr	Static PE information: section name: .rpg
Source: MFPlat.DLL.5.dr	Static PE information: section name: .bewzc
Source: MFPlat.DLL.5.dr	Static PE information: section name: .vksvaw
Source: MFPlat.DLL.5.dr	Static PE information: section name: .wmhg
Source: MFPlat.DLL.5.dr	Static PE information: section name: .kswemc
Source: MFPlat.DLL.5.dr	Static PE information: section name: .kaxfk
Source: MFPlat.DLL.5.dr	Static PE information: section name: .pjf
Source: MFPlat.DLL.5.dr	Static PE information: section name: .favk
Source: MFPlat.DLL.5.dr	Static PE information: section name: .vhtukj
Source: MFPlat.DLL.5.dr	Static PE information: section name: .hmbyox
Source: MFPlat.DLL.5.dr	Static PE information: section name: .txms
Source: MFPlat.DLL.5.dr	Static PE information: section name: .vqqm
Source: MFPlat.DLL.5.dr	Static PE information: section name: .cbwb
Source: MFPlat.DLL.5.dr	Static PE information: section name: .sggk
Source: MFPlat.DLL.5.dr	Static PE information: section name: .cbotn
Source: MFPlat.DLL.5.dr	Static PE information: section name: .urf
Source: MFPlat.DLL.5.dr	Static PE information: section name: .yera
Source: MFPlat.DLL.5.dr	Static PE information: section name: .sjj
Source: MFPlat.DLL.5.dr	Static PE information: section name: .wcro
Source: MFPlat.DLL.5.dr	Static PE information: section name: .imkkq
Source: MFPlat.DLL.5.dr	Static PE information: section name: .mrdc
Source: MFPlat.DLL.5.dr	Static PE information: section name: .eaph
Source: MFPlat.DLL.5.dr	Static PE information: section name: .wqzg
Source: MFPlat.DLL.5.dr	Static PE information: section name: .uwxw
Source: MFPlat.DLL.5.dr	Static PE information: section name: .acz
Source: MFPlat.DLL.5.dr	Static PE information: section name: .ktb
Source: MFPlat.DLL.5.dr	Static PE information: section name: .nqplrs
Source: MFPlat.DLL.5.dr	Static PE information: section name: .btah
Source: MFPlat.DLL.5.dr	Static PE information: section name: .majbu
Source: MFPlat.DLL.5.dr	Static PE information: section name: .zefvk
Source: MFPlat.DLL.5.dr	Static PE information: section name: .qlndvj
Source: MFPlat.DLL.5.dr	Static PE information: section name: .tpynl
Source: SYSDM.CPL.5.dr	Static PE information: section name: .qkm
Source: SYSDM.CPL.5.dr	Static PE information: section name: .cvjb
Source: SYSDM.CPL.5.dr	Static PE information: section name: .tlmkv
Source: SYSDM.CPL.5.dr	Static PE information: section name: .wucsxe
Source: SYSDM.CPL.5.dr	Static PE information: section name: .fltwtj
Source: SYSDM.CPL.5.dr	Static PE information: section name: .sfplio
Source: SYSDM.CPL.5.dr	Static PE information: section name: .rpg
Source: SYSDM.CPL.5.dr	Static PE information: section name: .bewzc
Source: SYSDM.CPL.5.dr	Static PE information: section name: .vksvaw
Source: SYSDM.CPL.5.dr	Static PE information: section name: .wmhg
Source: SYSDM.CPL.5.dr	Static PE information: section name: .kswemc
Source: SYSDM.CPL.5.dr	Static PE information: section name: .kaxfk
Source: SYSDM.CPL.5.dr	Static PE information: section name: .pjf
Source: SYSDM.CPL.5.dr	Static PE information: section name: .favk
Source: SYSDM.CPL.5.dr	Static PE information: section name: .vhtukj
Source: SYSDM.CPL.5.dr	Static PE information: section name: .hmbyox
Source: SYSDM.CPL.5.dr	Static PE information: section name: .txms
Source: SYSDM.CPL.5.dr	Static PE information: section name: .vqqm
Source: SYSDM.CPL.5.dr	Static PE information: section name: .cbwb
Source: SYSDM.CPL.5.dr	Static PE information: section name: .sggk
Source: SYSDM.CPL.5.dr	Static PE information: section name: .cbotn
Source: SYSDM.CPL.5.dr	Static PE information: section name: .urf
Source: SYSDM.CPL.5.dr	Static PE information: section name: .yera
Source: SYSDM.CPL.5.dr	Static PE information: section name: .sjj
Source: SYSDM.CPL.5.dr	Static PE information: section name: .wcro
Source: SYSDM.CPL.5.dr	Static PE information: section name: .imkkq
Source: SYSDM.CPL.5.dr	Static PE information: section name: .mrdc
Source: SYSDM.CPL.5.dr	Static PE information: section name: .eaph
Source: SYSDM.CPL.5.dr	Static PE information: section name: .wqzg
Source: SYSDM.CPL.5.dr	Static PE information: section name: .uwxw
Source: SYSDM.CPL.5.dr	Static PE information: section name: .acz
Source: SYSDM.CPL.5.dr	Static PE information: section name: .ktb
Source: SYSDM.CPL.5.dr	Static PE information: section name: .nqplrs
Source: SYSDM.CPL.5.dr	Static PE information: section name: .btah
Source: SYSDM.CPL.5.dr	Static PE information: section name: .majbu
Source: SYSDM.CPL.5.dr	Static PE information: section name: .zefvk
Source: SYSDM.CPL.5.dr	Static PE information: section name: .qlndvj
Source: SYSDM.CPL.5.dr	Static PE information: section name: .lzeq
Source: VERSION.dll.5.dr	Static PE information: section name: .qkm
Source: VERSION.dll.5.dr	Static PE information: section name: .cvjb
Source: VERSION.dll.5.dr	Static PE information: section name: .tlmkv
Source: VERSION.dll.5.dr	Static PE information: section name: .wucsxe
Source: VERSION.dll.5.dr	Static PE information: section name: .fltwtj
Source: VERSION.dll.5.dr	Static PE information: section name: .sfplio
Source: VERSION.dll.5.dr	Static PE information: section name: .rpg
Source: VERSION.dll.5.dr	Static PE information: section name: .bewzc
Source: VERSION.dll.5.dr	Static PE information: section name: .vksvaw
Source: VERSION.dll.5.dr	Static PE information: section name: .wmhg
Source: VERSION.dll.5.dr	Static PE information: section name: .kswemc
Source: VERSION.dll.5.dr	Static PE information: section name: .kaxfk
Source: VERSION.dll.5.dr	Static PE information: section name: .pjf
Source: VERSION.dll.5.dr	Static PE information: section name: .favk
Source: VERSION.dll.5.dr	Static PE information: section name: .vhtukj
Source: VERSION.dll.5.dr	Static PE information: section name: .hmbyox
Source: VERSION.dll.5.dr	Static PE information: section name: .txms
Source: VERSION.dll.5.dr	Static PE information: section name: .vqqm
Source: VERSION.dll.5.dr	Static PE information: section name: .cbwb
Source: VERSION.dll.5.dr	Static PE information: section name: .sggk
Source: VERSION.dll.5.dr	Static PE information: section name: .cbotn
Source: VERSION.dll.5.dr	Static PE information: section name: .urf
Source: VERSION.dll.5.dr	Static PE information: section name: .yera
Source: VERSION.dll.5.dr	Static PE information: section name: .sjj
Source: VERSION.dll.5.dr	Static PE information: section name: .wcro
Source: VERSION.dll.5.dr	Static PE information: section name: .imkkq
Source: VERSION.dll.5.dr	Static PE information: section name: .mrdc
Source: VERSION.dll.5.dr	Static PE information: section name: .eaph
Source: VERSION.dll.5.dr	Static PE information: section name: .wqzg
Source: VERSION.dll.5.dr	Static PE information: section name: .uwxw
Source: VERSION.dll.5.dr	Static PE information: section name: .acz
Source: VERSION.dll.5.dr	Static PE information: section name: .ktb
Source: VERSION.dll.5.dr	Static PE information: section name: .nqplrs
Source: VERSION.dll.5.dr	Static PE information: section name: .btah
Source: VERSION.dll.5.dr	Static PE information: section name: .majbu
Source: VERSION.dll.5.dr	Static PE information: section name: .zefvk
Source: VERSION.dll.5.dr	Static PE information: section name: .qlndvj
Source: VERSION.dll.5.dr	Static PE information: section name: .mvfgc
Source: VERSION.dll0.5.dr	Static PE information: section name: .qkm
Source: VERSION.dll0.5.dr	Static PE information: section name: .cvjb
Source: VERSION.dll0.5.dr	Static PE information: section name: .tlmkv
Source: VERSION.dll0.5.dr	Static PE information: section name: .wucsxe
Source: VERSION.dll0.5.dr	Static PE information: section name: .fltwtj
Source: VERSION.dll0.5.dr	Static PE information: section name: .sfplio
Source: VERSION.dll0.5.dr	Static PE information: section name: .rpg
Source: VERSION.dll0.5.dr	Static PE information: section name: .bewzc
Source: VERSION.dll0.5.dr	Static PE information: section name: .vksvaw
Source: VERSION.dll0.5.dr	Static PE information: section name: .wmhg
Source: VERSION.dll0.5.dr	Static PE information: section name: .kswemc
Source: VERSION.dll0.5.dr	Static PE information: section name: .kaxfk
Source: VERSION.dll0.5.dr	Static PE information: section name: .pjf
Source: VERSION.dll0.5.dr	Static PE information: section name: .favk
Source: VERSION.dll0.5.dr	Static PE information: section name: .vhtukj
Source: VERSION.dll0.5.dr	Static PE information: section name: .hmbyox
Source: VERSION.dll0.5.dr	Static PE information: section name: .txms
Source: VERSION.dll0.5.dr	Static PE information: section name: .vqqm
Source: VERSION.dll0.5.dr	Static PE information: section name: .cbwb
Source: VERSION.dll0.5.dr	Static PE information: section name: .sggk
Source: VERSION.dll0.5.dr	Static PE information: section name: .cbotn
Source: VERSION.dll0.5.dr	Static PE information: section name: .urf
Source: VERSION.dll0.5.dr	Static PE information: section name: .yera
Source: VERSION.dll0.5.dr	Static PE information: section name: .sjj
Source: VERSION.dll0.5.dr	Static PE information: section name: .wcro
Source: VERSION.dll0.5.dr	Static PE information: section name: .imkkq
Source: VERSION.dll0.5.dr	Static PE information: section name: .mrdc
Source: VERSION.dll0.5.dr	Static PE information: section name: .eaph
Source: VERSION.dll0.5.dr	Static PE information: section name: .wqzg
Source: VERSION.dll0.5.dr	Static PE information: section name: .uwxw
Source: VERSION.dll0.5.dr	Static PE information: section name: .acz
Source: VERSION.dll0.5.dr	Static PE information: section name: .ktb
Source: VERSION.dll0.5.dr	Static PE information: section name: .nqplrs
Source: VERSION.dll0.5.dr	Static PE information: section name: .btah
Source: VERSION.dll0.5.dr	Static PE information: section name: .majbu
Source: VERSION.dll0.5.dr	Static PE information: section name: .zefvk
Source: VERSION.dll0.5.dr	Static PE information: section name: .qlndvj
Source: VERSION.dll0.5.dr	Static PE information: section name: .bgsn
Source: dpx.dll.5.dr	Static PE information: section name: .qkm
Source: dpx.dll.5.dr	Static PE information: section name: .cvjb
Source: dpx.dll.5.dr	Static PE information: section name: .tlmkv
Source: dpx.dll.5.dr	Static PE information: section name: .wucsxe
Source: dpx.dll.5.dr	Static PE information: section name: .fltwtj
Source: dpx.dll.5.dr	Static PE information: section name: .sfplio
Source: dpx.dll.5.dr	Static PE information: section name: .rpg
Source: dpx.dll.5.dr	Static PE information: section name: .bewzc
Source: dpx.dll.5.dr	Static PE information: section name: .vksvaw
Source: dpx.dll.5.dr	Static PE information: section name: .wmhg
Source: dpx.dll.5.dr	Static PE information: section name: .kswemc
Source: dpx.dll.5.dr	Static PE information: section name: .kaxfk
Source: dpx.dll.5.dr	Static PE information: section name: .pjf
Source: dpx.dll.5.dr	Static PE information: section name: .favk
Source: dpx.dll.5.dr	Static PE information: section name: .vhtukj
Source: dpx.dll.5.dr	Static PE information: section name: .hmbyox
Source: dpx.dll.5.dr	Static PE information: section name: .txms
Source: dpx.dll.5.dr	Static PE information: section name: .vqqm
Source: dpx.dll.5.dr	Static PE information: section name: .cbwb
Source: dpx.dll.5.dr	Static PE information: section name: .sggk
Source: dpx.dll.5.dr	Static PE information: section name: .cbotn
Source: dpx.dll.5.dr	Static PE information: section name: .urf
Source: dpx.dll.5.dr	Static PE information: section name: .yera
Source: dpx.dll.5.dr	Static PE information: section name: .sjj
Source: dpx.dll.5.dr	Static PE information: section name: .wcro
Source: dpx.dll.5.dr	Static PE information: section name: .imkkq
Source: dpx.dll.5.dr	Static PE information: section name: .mrdc
Source: dpx.dll.5.dr	Static PE information: section name: .eaph
Source: dpx.dll.5.dr	Static PE information: section name: .wqzg
Source: dpx.dll.5.dr	Static PE information: section name: .uwxw
Source: dpx.dll.5.dr	Static PE information: section name: .acz
Source: dpx.dll.5.dr	Static PE information: section name: .ktb
Source: dpx.dll.5.dr	Static PE information: section name: .nqplrs
Source: dpx.dll.5.dr	Static PE information: section name: .btah
Source: dpx.dll.5.dr	Static PE information: section name: .majbu
Source: dpx.dll.5.dr	Static PE information: section name: .zefvk
Source: dpx.dll.5.dr	Static PE information: section name: .qlndvj
Source: SPP.dll.5.dr	Static PE information: section name: .qkm
Source: SPP.dll.5.dr	Static PE information: section name: .cvjb
Source: SPP.dll.5.dr	Static PE information: section name: .tlmkv
Source: SPP.dll.5.dr	Static PE information: section name: .wucsxe
Source: SPP.dll.5.dr	Static PE information: section name: .fltwtj
Source: SPP.dll.5.dr	Static PE information: section name: .sfplio
Source: SPP.dll.5.dr	Static PE information: section name: .rpg
Source: SPP.dll.5.dr	Static PE information: section name: .bewzc
Source: SPP.dll.5.dr	Static PE information: section name: .vksvaw
Source: SPP.dll.5.dr	Static PE information: section name: .wmhg
Source: SPP.dll.5.dr	Static PE information: section name: .kswemc
Source: SPP.dll.5.dr	Static PE information: section name: .kaxfk
Source: SPP.dll.5.dr	Static PE information: section name: .pjf
Source: SPP.dll.5.dr	Static PE information: section name: .favk
Source: SPP.dll.5.dr	Static PE information: section name: .vhtukj
Source: SPP.dll.5.dr	Static PE information: section name: .hmbyox
Source: SPP.dll.5.dr	Static PE information: section name: .txms
Source: SPP.dll.5.dr	Static PE information: section name: .vqqm
Source: SPP.dll.5.dr	Static PE information: section name: .cbwb
Source: SPP.dll.5.dr	Static PE information: section name: .sggk
Source: SPP.dll.5.dr	Static PE information: section name: .cbotn
Source: SPP.dll.5.dr	Static PE information: section name: .urf
Source: SPP.dll.5.dr	Static PE information: section name: .yera
Source: SPP.dll.5.dr	Static PE information: section name: .sjj
Source: SPP.dll.5.dr	Static PE information: section name: .wcro
Source: SPP.dll.5.dr	Static PE information: section name: .imkkq
Source: SPP.dll.5.dr	Static PE information: section name: .mrdc
Source: SPP.dll.5.dr	Static PE information: section name: .eaph
Source: SPP.dll.5.dr	Static PE information: section name: .wqzg
Source: SPP.dll.5.dr	Static PE information: section name: .uwxw
Source: SPP.dll.5.dr	Static PE information: section name: .acz
Source: SPP.dll.5.dr	Static PE information: section name: .ktb
Source: SPP.dll.5.dr	Static PE information: section name: .nqplrs
Source: SPP.dll.5.dr	Static PE information: section name: .btah
Source: SPP.dll.5.dr	Static PE information: section name: .majbu
Source: SPP.dll.5.dr	Static PE information: section name: .zefvk
Source: SPP.dll.5.dr	Static PE information: section name: .qlndvj
Source: SPP.dll.5.dr	Static PE information: section name: .ovfse
Source: VERSION.dll1.5.dr	Static PE information: section name: .qkm
Source: VERSION.dll1.5.dr	Static PE information: section name: .cvjb
Source: VERSION.dll1.5.dr	Static PE information: section name: .tlmkv
Source: VERSION.dll1.5.dr	Static PE information: section name: .wucsxe
Source: VERSION.dll1.5.dr	Static PE information: section name: .fltwtj
Source: VERSION.dll1.5.dr	Static PE information: section name: .sfplio
Source: VERSION.dll1.5.dr	Static PE information: section name: .rpg
Source: VERSION.dll1.5.dr	Static PE information: section name: .bewzc
Source: VERSION.dll1.5.dr	Static PE information: section name: .vksvaw
Source: VERSION.dll1.5.dr	Static PE information: section name: .wmhg
Source: VERSION.dll1.5.dr	Static PE information: section name: .kswemc
Source: VERSION.dll1.5.dr	Static PE information: section name: .kaxfk
Source: VERSION.dll1.5.dr	Static PE information: section name: .pjf
Source: VERSION.dll1.5.dr	Static PE information: section name: .favk
Source: VERSION.dll1.5.dr	Static PE information: section name: .vhtukj
Source: VERSION.dll1.5.dr	Static PE information: section name: .hmbyox
Source: VERSION.dll1.5.dr	Static PE information: section name: .txms
Source: VERSION.dll1.5.dr	Static PE information: section name: .vqqm
Source: VERSION.dll1.5.dr	Static PE information: section name: .cbwb
Source: VERSION.dll1.5.dr	Static PE information: section name: .sggk
Source: VERSION.dll1.5.dr	Static PE information: section name: .cbotn
Source: VERSION.dll1.5.dr	Static PE information: section name: .urf
Source: VERSION.dll1.5.dr	Static PE information: section name: .yera
Source: VERSION.dll1.5.dr	Static PE information: section name: .sjj
Source: VERSION.dll1.5.dr	Static PE information: section name: .wcro
Source: VERSION.dll1.5.dr	Static PE information: section name: .imkkq
Source: VERSION.dll1.5.dr	Static PE information: section name: .mrdc
Source: VERSION.dll1.5.dr	Static PE information: section name: .eaph
Source: VERSION.dll1.5.dr	Static PE information: section name: .wqzg
Source: VERSION.dll1.5.dr	Static PE information: section name: .uwxw
Source: VERSION.dll1.5.dr	Static PE information: section name: .acz
Source: VERSION.dll1.5.dr	Static PE information: section name: .ktb
Source: VERSION.dll1.5.dr	Static PE information: section name: .nqplrs
Source: VERSION.dll1.5.dr	Static PE information: section name: .btah
Source: VERSION.dll1.5.dr	Static PE information: section name: .majbu
Source: VERSION.dll1.5.dr	Static PE information: section name: .zefvk
Source: VERSION.dll1.5.dr	Static PE information: section name: .qlndvj
Source: VERSION.dll1.5.dr	Static PE information: section name: .eqd
Source: DUI70.dll.5.dr	Static PE information: section name: .qkm
Source: DUI70.dll.5.dr	Static PE information: section name: .cvjb
Source: DUI70.dll.5.dr	Static PE information: section name: .tlmkv
Source: DUI70.dll.5.dr	Static PE information: section name: .wucsxe
Source: DUI70.dll.5.dr	Static PE information: section name: .fltwtj
Source: DUI70.dll.5.dr	Static PE information: section name: .sfplio
Source: DUI70.dll.5.dr	Static PE information: section name: .rpg
Source: DUI70.dll.5.dr	Static PE information: section name: .bewzc
Source: DUI70.dll.5.dr	Static PE information: section name: .vksvaw
Source: DUI70.dll.5.dr	Static PE information: section name: .wmhg
Source: DUI70.dll.5.dr	Static PE information: section name: .kswemc
Source: DUI70.dll.5.dr	Static PE information: section name: .kaxfk
Source: DUI70.dll.5.dr	Static PE information: section name: .pjf
Source: DUI70.dll.5.dr	Static PE information: section name: .favk
Source: DUI70.dll.5.dr	Static PE information: section name: .vhtukj
Source: DUI70.dll.5.dr	Static PE information: section name: .hmbyox
Source: DUI70.dll.5.dr	Static PE information: section name: .txms
Source: DUI70.dll.5.dr	Static PE information: section name: .vqqm
Source: DUI70.dll.5.dr	Static PE information: section name: .cbwb
Source: DUI70.dll.5.dr	Static PE information: section name: .sggk
Source: DUI70.dll.5.dr	Static PE information: section name: .cbotn
Source: DUI70.dll.5.dr	Static PE information: section name: .urf
Source: DUI70.dll.5.dr	Static PE information: section name: .yera
Source: DUI70.dll.5.dr	Static PE information: section name: .sjj
Source: DUI70.dll.5.dr	Static PE information: section name: .wcro
Source: DUI70.dll.5.dr	Static PE information: section name: .imkkq
Source: DUI70.dll.5.dr	Static PE information: section name: .mrdc
Source: DUI70.dll.5.dr	Static PE information: section name: .eaph
Source: DUI70.dll.5.dr	Static PE information: section name: .wqzg
Source: DUI70.dll.5.dr	Static PE information: section name: .uwxw
Source: DUI70.dll.5.dr	Static PE information: section name: .acz
Source: DUI70.dll.5.dr	Static PE information: section name: .ktb
Source: DUI70.dll.5.dr	Static PE information: section name: .nqplrs
Source: DUI70.dll.5.dr	Static PE information: section name: .btah
Source: DUI70.dll.5.dr	Static PE information: section name: .majbu
Source: DUI70.dll.5.dr	Static PE information: section name: .zefvk
Source: DUI70.dll.5.dr	Static PE information: section name: .qlndvj
Source: DUI70.dll.5.dr	Static PE information: section name: .iyirm
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .qkm
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .cvjb
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .tlmkv
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .wucsxe
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .fltwtj
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .sfplio
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .rpg
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .bewzc
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .vksvaw
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .wmhg
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .kswemc
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .kaxfk
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .pjf
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .favk
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .vhtukj
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .hmbyox
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .txms
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .vqqm
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .cbwb
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .sggk
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .cbotn
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .urf
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .yera
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .sjj
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .wcro
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .imkkq
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .mrdc
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .eaph
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .wqzg
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .uwxw
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .acz
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .ktb
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .nqplrs
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .btah
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .majbu
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .zefvk
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .qlndvj
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .zuuw
Source: VERSION.dll2.5.dr	Static PE information: section name: .qkm
Source: VERSION.dll2.5.dr	Static PE information: section name: .cvjb
Source: VERSION.dll2.5.dr	Static PE information: section name: .tlmkv
Source: VERSION.dll2.5.dr	Static PE information: section name: .wucsxe
Source: VERSION.dll2.5.dr	Static PE information: section name: .fltwtj
Source: VERSION.dll2.5.dr	Static PE information: section name: .sfplio
Source: VERSION.dll2.5.dr	Static PE information: section name: .rpg
Source: VERSION.dll2.5.dr	Static PE information: section name: .bewzc
Source: VERSION.dll2.5.dr	Static PE information: section name: .vksvaw
Source: VERSION.dll2.5.dr	Static PE information: section name: .wmhg
Source: VERSION.dll2.5.dr	Static PE information: section name: .kswemc
Source: VERSION.dll2.5.dr	Static PE information: section name: .kaxfk
Source: VERSION.dll2.5.dr	Static PE information: section name: .pjf
Source: VERSION.dll2.5.dr	Static PE information: section name: .favk
Source: VERSION.dll2.5.dr	Static PE information: section name: .vhtukj
Source: VERSION.dll2.5.dr	Static PE information: section name: .hmbyox
Source: VERSION.dll2.5.dr	Static PE information: section name: .txms
Source: VERSION.dll2.5.dr	Static PE information: section name: .vqqm
Source: VERSION.dll2.5.dr	Static PE information: section name: .cbwb
Source: VERSION.dll2.5.dr	Static PE information: section name: .sggk
Source: VERSION.dll2.5.dr	Static PE information: section name: .cbotn
Source: VERSION.dll2.5.dr	Static PE information: section name: .urf
Source: VERSION.dll2.5.dr	Static PE information: section name: .yera
Source: VERSION.dll2.5.dr	Static PE information: section name: .sjj
Source: VERSION.dll2.5.dr	Static PE information: section name: .wcro
Source: VERSION.dll2.5.dr	Static PE information: section name: .imkkq
Source: VERSION.dll2.5.dr	Static PE information: section name: .mrdc
Source: VERSION.dll2.5.dr	Static PE information: section name: .eaph
Source: VERSION.dll2.5.dr	Static PE information: section name: .wqzg
Source: VERSION.dll2.5.dr	Static PE information: section name: .uwxw
Source: VERSION.dll2.5.dr	Static PE information: section name: .acz
Source: VERSION.dll2.5.dr	Static PE information: section name: .ktb
Source: VERSION.dll2.5.dr	Static PE information: section name: .nqplrs
Source: VERSION.dll2.5.dr	Static PE information: section name: .btah
Source: VERSION.dll2.5.dr	Static PE information: section name: .majbu
Source: VERSION.dll2.5.dr	Static PE information: section name: .zefvk
Source: VERSION.dll2.5.dr	Static PE information: section name: .qlndvj
Source: VERSION.dll2.5.dr	Static PE information: section name: .kjsir
Source: SYSDM.CPL0.5.dr	Static PE information: section name: .qkm
Source: SYSDM.CPL0.5.dr	Static PE information: section name: .cvjb
Source: SYSDM.CPL0.5.dr	Static PE information: section name: .tlmkv
Source: SYSDM.CPL0.5.dr	Static PE information: section name: .wucsxe
Source: SYSDM.CPL0.5.dr	Static PE information: section name: .fltwtj
Source: SYSDM.CPL0.5.dr	Static PE information: section name: .sfplio
Source: SYSDM.CPL0.5.dr	Static PE information: section name: .rpg
Source: SYSDM.CPL0.5.dr	Static PE information: section name: .bewzc
Source: SYSDM.CPL0.5.dr	Static PE information: section name: .vksvaw
Source: SYSDM.CPL0.5.dr	Static PE information: section name: .wmhg
Source: SYSDM.CPL0.5.dr	Static PE information: section name: .kswemc
Source: SYSDM.CPL0.5.dr	Static PE information: section name: .kaxfk
Source: SYSDM.CPL0.5.dr	Static PE information: section name: .pjf
Source: SYSDM.CPL0.5.dr	Static PE information: section name: .favk
Source: SYSDM.CPL0.5.dr	Static PE information: section name: .vhtukj
Source: SYSDM.CPL0.5.dr	Static PE information: section name: .hmbyox
Source: SYSDM.CPL0.5.dr	Static PE information: section name: .txms
Source: SYSDM.CPL0.5.dr	Static PE information: section name: .vqqm
Source: SYSDM.CPL0.5.dr	Static PE information: section name: .cbwb
Source: SYSDM.CPL0.5.dr	Static PE information: section name: .sggk
Source: SYSDM.CPL0.5.dr	Static PE information: section name: .cbotn
Source: SYSDM.CPL0.5.dr	Static PE information: section name: .urf
Source: SYSDM.CPL0.5.dr	Static PE information: section name: .yera
Source: SYSDM.CPL0.5.dr	Static PE information: section name: .sjj
Source: SYSDM.CPL0.5.dr	Static PE information: section name: .wcro
Source: SYSDM.CPL0.5.dr	Static PE information: section name: .imkkq
Source: SYSDM.CPL0.5.dr	Static PE information: section name: .mrdc
Source: SYSDM.CPL0.5.dr	Static PE information: section name: .eaph
Source: SYSDM.CPL0.5.dr	Static PE information: section name: .wqzg
Source: SYSDM.CPL0.5.dr	Static PE information: section name: .uwxw
Source: SYSDM.CPL0.5.dr	Static PE information: section name: .acz
Source: SYSDM.CPL0.5.dr	Static PE information: section name: .ktb
Source: SYSDM.CPL0.5.dr	Static PE information: section name: .nqplrs
Source: SYSDM.CPL0.5.dr	Static PE information: section name: .btah
Source: SYSDM.CPL0.5.dr	Static PE information: section name: .majbu
Source: SYSDM.CPL0.5.dr	Static PE information: section name: .zefvk
Source: SYSDM.CPL0.5.dr	Static PE information: section name: .qlndvj
Source: SYSDM.CPL0.5.dr	Static PE information: section name: .aqbz
Source: dwmapi.dll.5.dr	Static PE information: section name: .qkm
Source: dwmapi.dll.5.dr	Static PE information: section name: .cvjb

Source: 1ZDvfs8V0D.dll	Static PE information: real checksum: 0x7d786c40 should be: 0x20ddeb
Source: DUI70.dll.5.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x24911c
Source: VERSION.dll1.5.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x21349b
Source: SYSDM.CPL.5.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x209ffe
Source: SLC.dll.5.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x20cfd8
Source: VERSION.dll3.5.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x213c73
Source: VERSION.dll0.5.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x20e755
Source: dwmapi.dll.5.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x20cfae
Source: dpx.dll.5.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x20f77b
Source: DUI70.dll0.5.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x255c6c
Source: VERSION.dll2.5.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x20ecd4
Source: SYSDM.CPL0.5.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x20d4cc
Source: WTSAPI32.dll.5.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x205efc
Source: MFPlat.DLL.5.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x206e9b
Source: WMsgAPI.dll.5.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x20d15b
Source: VERSION.dll.5.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x20e727
Source: SPP.dll.5.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x208d8e

Source: msinfo32.exe.5.dr

Static PE information: 0xF1906102 [Thu Jun 5 01:44:34 2098 UTC]

Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\rceY\SYSDM.CPL			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\HaXuPA\SYSDM.CPL			Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\rceY\SYSDM.CPL	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\whddZ\irftp.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\ueX148\SysResetErr.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\XyDPIStsf\SndVol.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\K5GwJI\VERSION.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\EkXB809\lpksetup.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\rRo\AgentService.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\vx8g6QJ\systemreset.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\vx8g6QJ\VERSION.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\9Uw6zQ\VERSION.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\HaXuPA\SYSDM.CPL	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\K5GwJI\wextract.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\EkXB809\dpx.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Ui6tQfJoZ\SystemSettingsRemoveDevice.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Ui6tQfJoZ\DUI70.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\XyDPIStsf\dwmapi.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\ibC\SPP.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\BxU\MFPlat.DLL	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\5zVf35m1I\SLC.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\BxU\mfpmp.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\W6MyNTlP8\WMsgAPI.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\0ubYqNmr\PresentationHost.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\0ubYqNmr\VERSION.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\whddZ\WTSAPI32.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\9Uw6zQ\unregmp2.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\rceY\SystemPropertiesProtection.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\ibC\rstrui.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\HaXuPA\SystemPropertiesPerformance.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\W6MyNTlP8\osk.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\rRo\VERSION.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\ueX148\DUI70.dll	Jump to dropped file

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\loaddll64.exe TID: 1708

Thread sleep time: -51000s >= -30000s

Jump to behavior

Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\rceY\SYSDM.CPL	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\whddZ\irftp.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\ueX148\SysResetErr.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\XyDPIStsf\SndVol.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\K5GwJI\VERSION.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\EkXB809\lpksetup.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\vx8g6QJ\systemreset.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\rRo\AgentService.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\9Uw6zQ\VERSION.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\vx8g6QJ\VERSION.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\HaXuPA\SYSDM.CPL	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\K5GwJI\wextract.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\EkXB809\dpx.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Ui6tQfJoZ\SystemSettingsRemoveDevice.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Ui6tQfJoZ\DUI70.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\XyDPIStsf\dwmapi.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\ibC\SPP.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\W6MyNTlP8\WMsgAPI.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\0ubYqNmr\PresentationHost.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\0ubYqNmr\VERSION.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\9Uw6zQ\unregmp2.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\whddZ\WTSAPI32.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\ibC\rstrui.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\W6MyNTlP8\osk.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\HaXuPA\SystemPropertiesPerformance.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\rRo\VERSION.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\ueX148\DUI70.dll	Jump to dropped file

Source: C:\Windows\System32\loaddll64.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Code function: 1_2_000000014005C340 GetSystemInfo,

1_2_000000014005C340

Source: C:\Windows\System32\loaddll64.exe	Code function: 1_2_000000014005D290 FindFirstFileExW,	1_2_000000014005D290
Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe	Code function: 32_2_00007FF72A9E6334 #620,#624,#6050,#1040,#1040,#4436,#1122,#1040,#624,#1259,#1040,#626,FindFirstFileW,#624,#1259,#1262,#1122,#1040,#1040,#1040,_wcsicmp,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,#624,#1259,#1040,FindFirstFileW,#622,#624,#624,#1259,#1259,#1040,#1040,#1040,#1040,#1040,FindNextFileW,FindClose,RemoveDirectoryW,#1040,#1040,#1040,#1040,	32_2_00007FF72A9E6334
Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe	Code function: 32_2_00007FF72A9E72AC #624,FindFirstFileW,FindClose,#6050,_wcsicmp,#1040,#1463,_wcsicmp,#624,CreateFileW,GetFileSize,ReadFile,CloseHandle,#1040,CreateFileW,#6886,CloseHandle,#6886,_wcsicmp,#626,#624,#1040,#624,#1122,SetupIterateCabinetW,#1040,#626,#626,RegOpenKeyExW,RegGetValueW,#1126,RegCloseKey,#1040,#1040,#1040,RegOpenKeyExW,#624,#2975,RegSetValueExW,#1122,RegCloseKey,#1040,RegCloseKey,#620,#620,#628,#1042,#1040,#1040,#622,#1259,#1122,#1040,#1040,#1284,#2783,#1040,#1040,#1040,#1042,#1040,#1040,#1040,#1040,#1040,#1040,GetLastError,#626,#626,#4473,#4473,#1287,#1287,MessageBoxW,#1040,#1040,#1040,	32_2_00007FF72A9E72AC
Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe	Code function: 32_2_00007FF72A9E5DE8 #626,#626,#1122,#624,#6050,#1040,#1040,#624,#1284,#1040,#1259,#1122,#1040,FindFirstFileW,#624,#1259,#1358,#1040,#1040,FindNextFileW,FindClose,#624,#1259,#1122,#1040,#1040,FindFirstFileW,#624,#1259,#1040,#1040,FindNextFileW,FindClose,#1040,#1040,	32_2_00007FF72A9E5DE8

Source: explorer.exe, 00000005.00000000.271865010.0000000008A32000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000005.00000000.271865010.0000000008A32000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000005.00000000.255561612.0000000008B88000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.255561612.0000000008B88000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}e
Source: explorer.exe, 00000005.00000000.249701732.00000000048E0000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.255561612.0000000008B88000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}C
Source: explorer.exe, 00000005.00000000.271970402.0000000008ACF000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000Datc
Source: explorer.exe, 00000005.00000000.271970402.0000000008ACF000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 00000005.00000000.252189154.00000000069DA000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD002
Source: explorer.exe, 00000005.00000000.273467079.0000000008CEA000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}osoft S

Source: C:\Users\user\AppData\Local\BxU\mfpmp.exe

Code function: 35_2_00007FF7B6DB54A0 EnterCriticalSection,IsDebuggerPresent,DebugBreak,LeaveCriticalSection,

35_2_00007FF7B6DB54A0

Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe

Code function: 32_2_00007FF72A9E15C4 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,RegGetValueW,GetProcessHeap,HeapFree,

32_2_00007FF72A9E15C4

Source: C:\Windows\System32\loaddll64.exe

Code function: 1_2_0000000140048AC0 LdrLoadDll,FindClose,

1_2_0000000140048AC0

Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe	Code function: 32_2_00007FF72A9ED120 SetUnhandledExceptionFilter,	32_2_00007FF72A9ED120
Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe	Code function: 32_2_00007FF72A9ECE08 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	32_2_00007FF72A9ECE08
Source: C:\Users\user\AppData\Local\BxU\mfpmp.exe	Code function: 35_2_00007FF7B6DB2D14 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	35_2_00007FF7B6DB2D14
Source: C:\Users\user\AppData\Local\BxU\mfpmp.exe	Code function: 35_2_00007FF7B6DB29F0 SetUnhandledExceptionFilter,	35_2_00007FF7B6DB29F0

HIPS / PFW / Operating System Protection Evasion:

Benign windows process drops PE files

Show sources

Source: C:\Windows\explorer.exe

File created: SLC.dll.5.dr

Jump to dropped file

Changes memory attributes in foreign processes to executable or writable

Show sources

Source: C:\Windows\System32\rundll32.exe	Memory protected: C:\Windows\explorer.exe base: 7FFFAE1CEFE0 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory protected: C:\Windows\explorer.exe base: 7FFFAE1CE000 protect: page execute read	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory protected: C:\Windows\explorer.exe base: 7FFFAC2B2A20 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory protected: unknown base: 7FFFAE1CEFE0 protect: page execute and read and write
Source: C:\Windows\System32\rundll32.exe	Memory protected: unknown base: 7FFFAE1CE000 protect: page execute read
Source: C:\Windows\System32\rundll32.exe	Memory protected: unknown base: 7FFFAC2B2A20 protect: page execute and read and write

Queues an APC in another process (thread injection)

Show sources

Source: C:\Windows\System32\rundll32.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Contains functionality to prevent local Windows debugging

Show sources

Source: C:\Users\user\AppData\Local\BxU\mfpmp.exe	Code function: 35_2_00007FF7B6DB54A0 EnterCriticalSection,IsDebuggerPresent,DebugBreak,LeaveCriticalSection,		35_2_00007FF7B6DB54A0
Source: C:\Users\user\AppData\Local\BxU\mfpmp.exe	Code function: 35_2_00007FF7B6DB5730 EnterCriticalSection,IsDebuggerPresent,DebugBreak,GetLastError,SetLastError,LeaveCriticalSection,		35_2_00007FF7B6DB5730

Uses Atom Bombing / ProGate to inject into other processes

Show sources

Source: C:\Windows\System32\rundll32.exe	Atom created: 405553565741544156488D6C24D14881EC98 0x00000000 inc eax 0x00000001 push ebp 0x00000002 push ebx 0x00000003 push esi 0x00000004 push edi 0x00000005 inc ecx 0x00000006 push esp 0x00000007 inc ecx 0x00000008 push esi 0x00000009 dec eax 0x0000000a lea ebp, dword ptr [esp-2Fh] 0x0000000e dec eax 0x0000000f sub esp, 00000098h			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Atom created: 405553565741544156488D6C24D14881EC98 0x00000000 inc eax 0x00000001 push ebp 0x00000002 push ebx 0x00000003 push esi 0x00000004 push edi 0x00000005 inc ecx 0x00000006 push esp 0x00000007 inc ecx 0x00000008 push esi 0x00000009 dec eax 0x0000000a lea ebp, dword ptr [esp-2Fh] 0x0000000e dec eax 0x0000000f sub esp, 00000098h

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\1ZDvfs8V0D.dll',#1

Jump to behavior

Source: explorer.exe, 00000005.00000000.286377719.0000000001400000.00000002.00020000.sdmp	Binary or memory string: uProgram Manager
Source: explorer.exe, 00000005.00000000.290461061.0000000005F40000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000005.00000000.286377719.0000000001400000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: SndVol.exe.5.dr	Binary or memory string: Software\Microsoft\Multimedia\Audio\SndVolSndVolPreferencesMaskSndVolSelectedDevicesShell_TrayWnd
Source: explorer.exe, 00000005.00000000.286377719.0000000001400000.00000002.00020000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000005.00000000.248361381.0000000000EB8000.00000004.00000020.sdmp	Binary or memory string: ProgmanX
Source: explorer.exe, 00000005.00000000.271970402.0000000008ACF000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWndAj

Source: C:\Windows\System32\loaddll64.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe	Queries volume information: unknown VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\BxU\mfpmp.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\BxU\mfpmp.exe	Queries volume information: unknown VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation

Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,memset,#626,#626,#2846,#2846,GetNumberFormatW,#624,#1040,#1040,		32_2_00007FF72A9D9CEC
Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe	Code function: #624,#1463,#6708,#626,#2846,#1122,#2846,#1095,#2629,GetDateFormatW,#1126,#2841,#1122,#4473,#4473,#1122,wcstoul,GetLocaleInfoW,#4473,#4473,#4473,#4473,#4473,#626,#1122,memset,StrFormatByteSizeEx,#1126,#2846,#1122,#1040,#1264,#1284,#1264,#1284,#1264,#1284,#1264,#1284,#1264,#1284,#1040,#1264,#1262,#1259,#1262,#1284,#1040,#1040,#1040,#1040,#1040,#1122,#4523,#4521,#6708,#1095,#2629,GetDateFormatW,#1126,GetTimeFormatW,#624,#624,#1259,#1284,#1040,#1040,#1040,#2841,#1122,#1040,#1122,#1040,#1122,#624,#2783,#6216,#2846,#1040,#1040,		32_2_00007FF72A9D9E90

Source: C:\Windows\System32\loaddll64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe

Code function: 32_2_00007FF72A9ED2B0 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,GetTickCount,QueryPerformanceCounter,

32_2_00007FF72A9ED2B0

Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe

Code function: 32_2_00007FF72A9D89B8 #626,#624,GetVersionExW,#624,#620,

32_2_00007FF72A9D89B8

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Exploitation for Client Execution1	Path Interception	Exploitation for Privilege Escalation1	Masquerading11	OS Credential Dumping	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Process Injection412	Virtualization/Sandbox Evasion1	LSASS Memory	Security Software Discovery21	Remote Desktop Protocol	Clipboard Data2	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Process Injection412	Security Account Manager	Virtualization/Sandbox Evasion1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Deobfuscate/Decode Files or Information1	NTDS	Process Discovery2	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Obfuscated Files or Information3	LSA Secrets	File and Directory Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Rundll321	Cached Domain Credentials	System Information Discovery35	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing2	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Timestomp1	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
1ZDvfs8V0D.dll	66%	Virustotal		Browse
1ZDvfs8V0D.dll	66%	Metadefender		Browse
1ZDvfs8V0D.dll	73%	ReversingLabs	Win64.Infostealer.Dridex
1ZDvfs8V0D.dll	100%	Avira	TR/Crypt.ZPACK.Gen
1ZDvfs8V0D.dll	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\0ubYqNmr\VERSION.dll	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\ibC\SPP.dll	100%	Avira	HEUR/AGEN.1114452
C:\Users\user\AppData\Local\0ubYqNmr\VERSION.dll	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\BxU\MFPlat.DLL	100%	Avira	HEUR/AGEN.1114452
C:\Users\user\AppData\Local\HaXuPA\SYSDM.CPL	100%	Avira	HEUR/AGEN.1114452
C:\Users\user\AppData\Local\Ui6tQfJoZ\DUI70.dll	100%	Avira	HEUR/AGEN.1114452
C:\Users\user\AppData\Local\0ubYqNmr\VERSION.dll	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\XyDPIStsf\dwmapi.dll	100%	Avira	HEUR/AGEN.1114452
C:\Users\user\AppData\Local\0ubYqNmr\VERSION.dll	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\whddZ\WTSAPI32.dll	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\0ubYqNmr\VERSION.dll	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\5zVf35m1I\SLC.dll	100%	Avira	HEUR/AGEN.1114452
C:\Users\user\AppData\Local\EkXB809\dpx.dll	100%	Avira	HEUR/AGEN.1114452
C:\Users\user\AppData\Local\W6MyNTlP8\WMsgAPI.dll	100%	Avira	HEUR/AGEN.1114452
C:\Users\user\AppData\Local\HaXuPA\SYSDM.CPL	100%	Avira	HEUR/AGEN.1114452
C:\Users\user\AppData\Local\Ui6tQfJoZ\DUI70.dll	100%	Avira	HEUR/AGEN.1114452
C:\Users\user\AppData\Local\0ubYqNmr\VERSION.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\ibC\SPP.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\0ubYqNmr\VERSION.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\BxU\MFPlat.DLL	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\HaXuPA\SYSDM.CPL	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Ui6tQfJoZ\DUI70.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\0ubYqNmr\VERSION.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\XyDPIStsf\dwmapi.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\0ubYqNmr\VERSION.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\whddZ\WTSAPI32.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\0ubYqNmr\VERSION.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\5zVf35m1I\SLC.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\EkXB809\dpx.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\W6MyNTlP8\WMsgAPI.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\HaXuPA\SYSDM.CPL	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Ui6tQfJoZ\DUI70.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\0ubYqNmr\PresentationHost.exe	0%	Metadefender		Browse
C:\Users\user\AppData\Local\0ubYqNmr\PresentationHost.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe	0%	Metadefender		Browse
C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\9Uw6zQ\unregmp2.exe	0%	Metadefender		Browse
C:\Users\user\AppData\Local\9Uw6zQ\unregmp2.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\BxU\mfpmp.exe	0%	Metadefender		Browse
C:\Users\user\AppData\Local\BxU\mfpmp.exe	0%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Download
30.2.rundll32.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
3.2.rundll32.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
33.2.rundll32.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
29.2.rundll32.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
7.2.rundll32.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
27.2.rundll32.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
32.2.msinfo32.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
4.2.rundll32.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
13.2.rundll32.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
10.2.rundll32.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
36.2.rundll32.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
35.2.mfpmp.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
17.2.rundll32.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
11.2.rundll32.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
26.2.rundll32.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
22.2.rundll32.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
24.2.rundll32.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
8.2.rundll32.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
25.2.rundll32.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.2.loaddll64.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.autoitscript.com/autoit3/J	explorer.exe, 00000005.00000000.268789709.0000000006840000.00000004.00000001.sdmp	false		high

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	483801
Start date:	15.09.2021
Start time:	14:02:33
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	1ZDvfs8V0D (renamed file extension from none to dll)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.expl.evad.winDLL@75/33@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 23.5% (good quality ratio 18.4%) Quality average: 68.8% Quality standard deviation: 41.4%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, svchost.exe, wuapihost.exe Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing disassembly code. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtEnumerateKey calls found.

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\0ubYqNmr\PresentationHost.exe	MKo5QOcjR0.dll	Get hash	malicious	Browse
	b7DzXNT0KG.dll	Get hash	malicious	Browse
	zuxDlBHEo1.dll	Get hash	malicious	Browse
	nANFx8nPyh.dll	Get hash	malicious	Browse
	z2kK1spYCp.dll	Get hash	malicious	Browse
	PeUkynHKvN.dll	Get hash	malicious	Browse
	TQV2VfcyT1.dll	Get hash	malicious	Browse
	4VxElkWYfO.dll	Get hash	malicious	Browse
	SKxlNMmOyq.dll	Get hash	malicious	Browse
	tMpgDpG6sM.dll	Get hash	malicious	Browse
	4LKdBPJIx7.dll	Get hash	malicious	Browse
	7kUzYvQJa3.dll	Get hash	malicious	Browse
	cW1MXlEPG1.dll	Get hash	malicious	Browse
	wN1StQLuU6.dll	Get hash	malicious	Browse
	xruDQfi3wV.dll	Get hash	malicious	Browse
	Y4cCiQvfKs.dll	Get hash	malicious	Browse
	EoumBwEb50.dll	Get hash	malicious	Browse
	n4B16M88dW.dll	Get hash	malicious	Browse
	1eDnhz4Afr.dll	Get hash	malicious	Browse
	WINMM.dll	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\0ubYqNmr\PresentationHost.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	259072
Entropy (8bit):	6.5074250085194665
Encrypted:	false
SSDEEP:	6144:8kfs4/kfxzJTbHfyH5KNXwy3Odjp19k5KNXf:fs4ixzJTbHmKVwy3OdLaKV
MD5:	E3053C73EA240F4C2F7971B3905A91CF
SHA1:	1848AD66BD55E5484616FB85E80BA58BE1D5BA4B
SHA-256:	0BACCDB2B5ACB7B3C2E9085655457532964CAFFF1AE250016CE1A80E839B820C
SHA-512:	167BCC3E2552286F7D985A65674DA2FF0D0AA6A7F0C4C3B43193943B606E0133C06EEB33656EFBB8B827AC9221FB1BA00A49ADCC2489BD4F38DF62A015806DE3
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: MKo5QOcjR0.dll, Detection: malicious, Browse Filename: b7DzXNT0KG.dll, Detection: malicious, Browse Filename: zuxDlBHEo1.dll, Detection: malicious, Browse Filename: nANFx8nPyh.dll, Detection: malicious, Browse Filename: z2kK1spYCp.dll, Detection: malicious, Browse Filename: PeUkynHKvN.dll, Detection: malicious, Browse Filename: TQV2VfcyT1.dll, Detection: malicious, Browse Filename: 4VxElkWYfO.dll, Detection: malicious, Browse Filename: SKxlNMmOyq.dll, Detection: malicious, Browse Filename: tMpgDpG6sM.dll, Detection: malicious, Browse Filename: 4LKdBPJIx7.dll, Detection: malicious, Browse Filename: 7kUzYvQJa3.dll, Detection: malicious, Browse Filename: cW1MXlEPG1.dll, Detection: malicious, Browse Filename: wN1StQLuU6.dll, Detection: malicious, Browse Filename: xruDQfi3wV.dll, Detection: malicious, Browse Filename: Y4cCiQvfKs.dll, Detection: malicious, Browse Filename: EoumBwEb50.dll, Detection: malicious, Browse Filename: n4B16M88dW.dll, Detection: malicious, Browse Filename: 1eDnhz4Afr.dll, Detection: malicious, Browse Filename: WINMM.dll, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........3/.]\|.]\|.]\|...\|.]\|...\|..]\|..^}.]\|..Y}.]\|.\\|..]\|..\}.]\|..T}..]\|..X}.]\|..\|.]\|.._}.]\|Rich.]\|........................PE..d..../............"..........&.................@.............................0............`.......... .......................................p..,........j......l............ ..,....d..T............................#...............$...............................text...o........................... ..`.rdata..............................@..@.data................r..............@....pdata..l............t..............@..@.rsrc....j.......l...~..............@..@.reloc..,.... ......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\0ubYqNmr\VERSION.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2113536
Entropy (8bit):	3.5713351337971417
Encrypted:	false
SSDEEP:	12288:EVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:hfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	99DC6214A301EC2785D2CF7C7F97299A
SHA1:	CE5582FEC9E8EFA376717CCB48B6EAEC021445A6
SHA-256:	1159519F2E457E649B58FB718443482D82A881A0BB573CE464B81470A84EE570
SHA-512:	C0A40B686B975552B2850D80404EAAD514AAD0479AE263BAF9EA9C06E66F38AC969A25292BDA4B70E46AD77047FC99975CFD824031BDCBD812D344A57943D184
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.,..DN^.........." ......... ......p..........@.............................@ .....@lx}..b..........................................0 .+....c..........h.......................$#................................................... ...............................text............................... ..`.rdata..,O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\5zVf35m1I\SLC.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2113536
Entropy (8bit):	3.574254178712457
Encrypted:	false
SSDEEP:	12288:vVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1F1:GfP7fWsK5z9A+WGAW+V5SB6Ct4bnbF1
MD5:	65C65AEB1008B6127B99502410591962
SHA1:	84DC8DFA5379D435958D9BCCCB659C75024D8ACD
SHA-256:	3CBBCA45DF4E7C729C98EDA87D9D5C22B189816C615D369426A9DE82252438CA
SHA-512:	7E81B68280101B42203E4FE730E64E83A4B0EEFCAC8AAA34046FC410387D593455DF9DC0CAD00625F4912C3A6630853F867430DA85CBBD44DDDDBF056BA65AFE
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.,..DN^.........." ......... ......p..........@.............................@ .....@lx}..b..........................................0 .3....c..........h.......................$#................................................... ...............................text............................... ..`.rdata..,O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	370176
Entropy (8bit):	6.448503897594857
Encrypted:	false
SSDEEP:	6144:Uca2EiZg+uTUbSFWjSJiIOKZXcmg3GexhxiZEOHHrpm1XUZLxEZEOHHrpm1XUZLx:UB2PsUbSFWWAkZXcmkVx+tLpm1EwtLpr
MD5:	C471C6B06F47EA1C66E5FAA8DFCEF108
SHA1:	F8672A2B3B32956CBC948A954CEF236581045B78
SHA-256:	E2255751C1CF58596C8FE70C3093E099F8D71ED89580CFD0156FFCF0FED32861
SHA-512:	F7A2A31910CD4694B58FFCED83A2CCF633B5594859F178AFB9F67C02E3E664DA72701E7E45AA5590C4F1E1C99C82B665F0C0B80401506F0DFA49B61A8EEBD6BA
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\|....y...y...y..yz...y..y}...y..y\|...y..yx...y...x...y..yp...y..y....y..y{...y.Rich..y.................PE..d....a............"............................@.............................0............`.......... ......................................$...h.......xJ......(............ .. ...P...T...........................P...............P... ............................text............................... ..`.rdata..H*.......,..................@..@.data....k...@.......(..............@....pdata..(............D..............@..@.rsrc...xJ.......L...V..............@..@.reloc.. .... ......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\9Uw6zQ\VERSION.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2113536
Entropy (8bit):	3.571327907784248
Encrypted:	false
SSDEEP:	12288:0VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:xfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	313795BA80A00E0FE381B1B67D69E7EB
SHA1:	16A0F08CE8C1037577F53F0B30C0AA6C3E0B93AE
SHA-256:	241A3B55EC2D4071D725E4CC055E0CDD4806D81235380926035938B9D78B2BAD
SHA-512:	D77FC2D25910BAE50B42B5B9934C7BB1E403E0DAA17950B089C9BDF9F96A4D6D0713EF60F184D46788A2DD5AE9672BB863573C6971436891159E0A52ABC56C4E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.,..DN^.........." ......... ......p..........@.............................@ .....@lx}..b..........................................0 .+....c..........h.......................$#................................................... ...............................text............................... ..`.rdata..,O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\9Uw6zQ\unregmp2.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	254976
Entropy (8bit):	5.093220071075157
Encrypted:	false
SSDEEP:	3072:1t+/6BNqqNRhdutq4jCoNhdxtYEbvyIwYKO8/+9vAwk4OdamabJ9:3Bhhd+7QKb
MD5:	9B517303C58CA8A450B97B0D71594CBB
SHA1:	BE75E3F10E17400DA7C0FAF70BF16EE7D0AA93A8
SHA-256:	2A38BFC3813D7E845F455B31DF099C8A6E657EF4556BFF681315F86A883A3314
SHA-512:	6A47EC7800E1F1FCDBB44A018147CE4A87FF0F5B94597B182AAE4E8545D9B18FAAAA07379BA1086D8F7785F0F66C36E4B6C68FCF49130333B8A9DC3A9E9E08E8
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\|.R.............y.......y.......y.......y..........w....y.......yf......y......Rich....................PE..d....Q&..........."..........^................@.............................0.......A....`.......... ..........................................................0.......................T....................V..(....U...............V...............................text...w........................... ..`.rdata..4...........................@..@.data....8.......&..................@....pdata..0...........................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\BxU\MFPlat.DLL Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2117632
Entropy (8bit):	3.5930830435644503
Encrypted:	false
SSDEEP:	12288:kVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:BfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	D3EA24EC3BDDCD42696E4921DA40EE85
SHA1:	66E52EABFD5D7864B146370BF671BAD45EEA0F40
SHA-256:	422CFB6508CABCCE469D03758CA7F31AB84BCA5023D1E90A1AAA9509606AB4B0
SHA-512:	9470DA7680C59A6CFAE051B7A7E6F37DBBA86FE9354AEE87F36E1C51C861FE3740D293D8DA89B3415754D6BD01CD823D484FD10B59F1A0309CCD02CDF2A9C5F8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.,..DN^.........." .........0......p..........@.............................P .....@lx}..b..........................................0 ......c..........h.......................$#................................................... ...............................text............................... ..`.rdata..,O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\BxU\mfpmp.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49688
Entropy (8bit):	6.083384253651048
Encrypted:	false
SSDEEP:	768:vcqpeHOwVxW4zmjjJF686T/5Lel2fBetjEWI9Whu3H1PcSP:vcEoVxJodg/tfiEAhu3VPcSP
MD5:	7C3D09D6DB5DB4A272FCF4C1BB3986BD
SHA1:	F0C392891B6D73EADB20F669A29064910507E55E
SHA-256:	E459FF6CBA8C93589B206C07BDCCD2E6C57766BE6BB4754F2FB1DEF9EF2E3BDE
SHA-512:	6CFE325CD0A78D6ACC9473BA51069E234CB0F9A47F285A6204EE787902C77005491B41C301DD38602CC387329F214E700F9203E4ECE5077E58D30276821640E4
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........0._.Q`..Q`..Q`..)...Q`..5c..Q`..5d..Q`..Qa..Q`..5a..Q`..5e..Q`..5n..Q`..5...Q`..5b..Q`.Rich.Q`.................PE..d...^.A..........."......R...V......P).........@....................................s.....`.......... ......................................h...........`................$..........`z..T...........................Pq..............`r......H...`....................text....Q.......R.................. ..`.rdata..T-...p.......V..............@..@.data...............................@....pdata..............................@..@.didat..0...........................@....rsrc...`...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\EkXB809\dpx.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2109440
Entropy (8bit):	3.5755825512234485
Encrypted:	false
SSDEEP:	12288:RVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:gfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	8E85149714E4AA4F433A4CE1C19D5117
SHA1:	21AE2AEFEA6183E34401283F8CA8C1DEF8745315
SHA-256:	8FD182C1E88A8B760F1AAF9426AC013952ED7B6B16CC42C41DFB6BF5426CFC3A
SHA-512:	D4FF8559DEFD5D1D0872E080499049B821CDD1DFBD36B98F66517B8ED182E174ADD80DFC0106C0CEBFAB13BAE644677377B4B861755948034C4E0C8953FA7089
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.+..DN^.........." ................p..........@.............................0 .....@lx}..b.........................................,o.......c..........h.......................$#................................................... ...............................text............................... ..`.rdata...O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\EkXB809\lpksetup.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	732160
Entropy (8bit):	6.573630291630044
Encrypted:	false
SSDEEP:	12288:U4O7JpqBbsczjBmavlNRO5Gy1ay0OBegtkGyLY9d/Dz/sJ+lGDyYgWPL/kc7yfnQ:U40JpqtZzjBRvI5Gdy0OjtwLY9BDz/PW
MD5:	8E2C63E761A22724382338F349C55014
SHA1:	30C7F92A6E88C368B091E39665545EAFA8A6561F
SHA-256:	4CA6E16BEB57278E60E3EDCBCECDA1442AA344C424421E4B078F1213E6B99376
SHA-512:	92F289DDBD9D1E5103C36308DA84779708A292DC54F49A0A1B79D65C563378BBF08C98F3732F25365CCF8175589D8E6187CEE2A694AE5FB73CA9E85AECFF4CF1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W..6...e...e...e..%e3..e\|.d...e\|.d...e\|.d...e\|.d...e...ec..e\|.d6..e\|.Ie...e\|.d...eRich...e................PE..d.....e.........."......,...P.................@..........................................`.......... .........................................................H?...................g..T....................y..(....x...............y..P............................text....+.......,.................. ..`.rdata..\....@.......0..............@..@.data...`[...0......................@....pdata..H?.......@..................@..@.rsrc...............^..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\HaXuPA\SYSDM.CPL Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2113536
Entropy (8bit):	3.5708430190408773
Encrypted:	false
SSDEEP:	12288:NVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:UfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	DF4DF807E4E527783F510931E7185ED1
SHA1:	AC97907241593E2CFEF95679710AE841D73968CF
SHA-256:	8A23D5924772C1D006A47A6E9D91264F70F8EE4FDF1FBAF59EA6BE4F0A30E578
SHA-512:	22359AEAB95E9DAE6B5BFE9E1A73AA8AE1B12D8DDC6AE3608D6DF9A9DBC2040CFE19B03F7E3EF143630CD6D37E4AC314B48D69BE0018BF6382397DDC3F70587A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.,..DN^.........." ......... ......p..........@.............................@ .....@lx}..b..........................................0 ......c..........h.......................$#................................................... ...............................text............................... ..`.rdata..,O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\HaXuPA\SystemPropertiesPerformance.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83968
Entropy (8bit):	7.071848641739436
Encrypted:	false
SSDEEP:	1536:5MVEZnXtREC/rMcgEPJV+G57ThjEC0kzJP+V5J9:3XzECTMpuDhjRVJGf
MD5:	F325976CDC0F7E9C680B51B35D24D23A
SHA1:	8BA00280B451378802DD2A06BB139B8BEA78C90C
SHA-256:	E24A61B15FD191DDC8A2CA82E22A759609E6099A832ADE0B5C0C6E0F1ABB05FE
SHA-512:	9D65A154758B5C38C09AACA1BB51E53FE6E8DEA374EAD88AEA33AB41525B3BB180211D6F6C93CA112197F7455842228960699DF471F47EE83DBC6CA59A5166EC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E.v..c...c...c.......c..n....c..n....c..n....c..n....c...c.."c..n....c..n...c..n....c..Rich.c..................PE..d...0............."..........>.................@.....................................s....`.......... ......................................<&.......P..P'...@.................. ....#..T............................ ...............!..H............................text............................... ..`.rdata....... ......................@..@.data........0......................@....pdata.......@......................@..@.rsrc...P'...P...(..................@..@.reloc.. ............F..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\K5GwJI\VERSION.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2113536
Entropy (8bit):	3.5713215141236527
Encrypted:	false
SSDEEP:	12288:JVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:ofP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	6E1517DBFD59D8546E0328AAADEAD760
SHA1:	C9559CBC446173A55F6A10E81C933EA3B84A0F00
SHA-256:	8998DA7CD34E9A15F109AF997A5B353D7E64E5232AA2490A7A77B771743DABE8
SHA-512:	BC1C0B48A1C08196AC17EFD496C9F91C4F04371DC4734E81D5D0A2B4F58DDF6CF56B137020A473D265A7293D6781DF96D8F8FD25B1551F727D0B608AB175CE88
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.,..DN^.........." ......... ......p..........@.............................@ .....@lx}..b..........................................0 .+....c..........h.......................$#................................................... ...............................text............................... ..`.rdata..,O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\K5GwJI\wextract.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	143872
Entropy (8bit):	6.942627183104786
Encrypted:	false
SSDEEP:	3072:0BuGag041hcWp1icKAArDZz4N9GhbkUNEk95l:5hudp0yN90vE
MD5:	ED93B350C8EEFC442758A00BC3EEDE2D
SHA1:	ADD14417939801C555BBBFFAF7388BD13DE2DE42
SHA-256:	ABD6D466E30626636D380A3C9FCC0D0B909C450F8EA74D8963881D7C46335CED
SHA-512:	7BA8D1411D9AEE3447494E248005A43F522CA684839FCD4C4592946B12DC4E73B1FF86D8E843B25A73E3F2463955815470304E4F219B36DBC94870BEBF700581
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........e...............`.......`.......`.......`..........,....`.......`0......`......Rich............................PE..d...._.{.........."......r...........w.........@.....................................R....`.......... .......................................................................... .......T............................................... ............................text....q.......r.................. ..`.rdata...".......$...v..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc.. ............0..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Ui6tQfJoZ\DUI70.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2396160
Entropy (8bit):	4.105742634696069
Encrypted:	false
SSDEEP:	12288:EVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1SZ:hfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	BE21B6427B06B62C5A09107CCBD8B302
SHA1:	A4B4E769C6F12B48BE095F3DE48F63B8A0E67255
SHA-256:	B606D16A2141A1DDFE5E92612FBE5096D52B23FDB727A032AB53A42103088957
SHA-512:	F44D536D00EC8C153CAC72CABC2F37E611A1AA3EF71708D3A76B4750614B6C92D102987F55335256094236EA18082580A8F995470798B9A0C44C1CA51F095963
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.,..DN^.........." .........p .....p..........@..............................$.....@lx}..b..........................................0 .dQ...c..........h.......................$#................................................... ...............................text............................... ..`.rdata..,O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\Ui6tQfJoZ\SystemSettingsRemoveDevice.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39304
Entropy (8bit):	6.292969415106569
Encrypted:	false
SSDEEP:	768:miVyKshA4p2nOCD6DjOxMtjIQfU7r5YdGiEh07tvNZRAER1PnX:QhlkOO74XU7i8iEG7HZR/PX
MD5:	87AF711D6518C0CF91560D7C98301BBB
SHA1:	81B7B8261A33D4D983DFDC47A716686118F582F9
SHA-256:	1B6381E83463416D9BE6656A81978B2EBA21587BBDE18E8CFEFA1C0F45378AAC
SHA-512:	E4534E5A205D44579AB60FAA5B19A2034C688D191ABB8670CD77696ABB000A949F5ABC996E0989FD74B4DFBE43C863FF66FDA9C623B045A771283B1955D28C39
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........R\|.PR\|.PR\|.P[..P~\|.P=..QQ\|.P=..Q@\|.P=..QW\|.P=..QC\|.PR\|.P.\|.P=..QZ\|.P=.dPS\|.P=..QS\|.PRichR\|.P........PE..d....G.j.........."......<...>.......B.........@....................................SC............... .......................................p.......................v...#......h....j..T............................`...............a..`............................text...n:.......<.................. ..`.imrsiv......P...........................rdata..8....`... ...@..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..h............t..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\W6MyNTlP8\WMsgAPI.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2113536
Entropy (8bit):	3.570136432932023
Encrypted:	false
SSDEEP:	12288:PVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:mfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	598089F8BBC211F63426A11C4D1669C5
SHA1:	F49A03775CA30E973ED8A409C3DD1D8DA1FAD8B7
SHA-256:	6B7F8402BA89CFF5FAEBB6462A2F95A51ACF98ED5F4FE3E5736C41BE8079A96F
SHA-512:	C311616C4DC190EE57024925E91D7EC1F315047EE771ECEA552BA62F9CECCD45F22915528AB13E011597666C21B4C86A31F6082D6F2120132B21394C35345039
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.,..DN^.........." ......... ......p..........@.............................@ .....@lx}..b..........................................0 ......c..........h.......................$#................................................... ...............................text............................... ..`.rdata..,O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\W6MyNTlP8\osk.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	622592
Entropy (8bit):	5.333446181330722
Encrypted:	false
SSDEEP:	6144:ejoj2QDVJc1OcvH3AdKy9HGeofJgDEvr6slnCUGw/xIRLtxIRLuovZ:koj2UjmNwzaoo
MD5:	88B09DE7D0DF1D2E9BCA9BAE1346CB23
SHA1:	83EEE4D2BF315730666763D7FA36A584224CA7EC
SHA-256:	7AC4B734A31AC4C29CCC53B7433773911CA46E1063A8B0F033AB9027D3427342
SHA-512:	38DD3F5A9C60D242AD9BECE1407CBB007ED8A50A1844B9A4378ADB17AAAF0FEDB6A9D1E04642D49560717958A12E668A9A3CDD4484BD049509A89AC2EEB9E478
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=L..y-..y-..y-...I..z-...I..`-...I...-...I..\-..y-...,...I..[-...Id.x-...I..x-..Richy-..................PE..d.....%Z.........."......n...........i.........@....................................E.....`.......... ..........................................h....P...U...@..................`.......T...............................................x............................text....m.......n.................. ..`.rdata..............r..............@..@.data........ ......................@....pdata.......@......................@..@.rsrc....U...P...V...(..............@..@.reloc..`............~..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\XyDPIStsf\SndVol.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	259904
Entropy (8bit):	5.955701055747905
Encrypted:	false
SSDEEP:	3072:UfYIZJbRydnidilSnGvLqeD358rwW39nuyHjVozZcxSHfcBL1ljbEyB7HbIa+:Uf9JonidFnqLV358rNnJqcRcy10/
MD5:	CDD7C7DF2D0859AC3F4088423D11BD08
SHA1:	128789A2EA904F684B5DF2384BA6EEF4EB60FB8E
SHA-256:	D98DB8339EB1B93A7345EECAC2B7290FA7156E3E12B7632D876BD0FD1F31EC66
SHA-512:	A093BF3C40C880A80164F2CAA87DF76DCD854375C5216D761E60F3770DFA04F4B02EC0CA6313C32413AC99A3EBDC081CF915A7B468EE3CED80F9B1ECF4B49804
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........<.BL]..L]..L]..E%...]..#9..O]..#9..U]..#9..F]..#9..W]..L]...\..#9..o]..#9k.M]..#9..M]..RichL]..........................PE..d...wJSn.........."............................@.............................@....................... .........................................p.... ..@...............@+...0.......U..T...................p&..(...p%...............&......P........................text............................... ..`.imrsiv..................................rdata....... ......................@..@.data...............................@....pdata..............................@..@.didat..............................@....rsrc...@.... ......................@..@.reloc.......0......................@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\XyDPIStsf\dwmapi.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2113536
Entropy (8bit):	3.5759812053784814
Encrypted:	false
SSDEEP:	12288:7VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:afP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	AF795ECED1B9E05426D00B127B0A6D32
SHA1:	DC425E54D63E551BFDC320246287AC1F682BFA3C
SHA-256:	733F5F30574CAD5B08F71F86D9456E3F8F1BD5C88A72FAA9D29E37EB686B6A71
SHA-512:	AE871C28F8DC9D5DFDE7D11FAD7E8833498F1A4F48C5A479B8630B65D2834B58ADA42EBFB068E873E682FEBB2F465C6E32F93A185CDEB3CEE5069BEABB114ED1
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.,..DN^.........." ......... ......p..........@.............................@ .....@lx}..b..........................................0 .&....c..........h.......................$#................................................... ...............................text............................... ..`.rdata..,O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\ibC\SPP.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2113536
Entropy (8bit):	3.571082307725634
Encrypted:	false
SSDEEP:	12288:UVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:RfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	13448A4FB3CA5C06C954D5B93BBBBCE0
SHA1:	D1AF98ED144F61358D72285028C896F52260FC0D
SHA-256:	68BFFD93E893637E289490E3E3A52EB937C9D7712F50A550B444A9CF57E79983
SHA-512:	F6AEFE9A9F5C6D4B1F7AD36A04AA26FB60E685E54DAEF47985AB3EC28AA84BF02B8B288C20381C98744F9F719E2AC17849B700CFA3E0EE38E2C9134F9F3E1FD3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.,..DN^.........." ......... ......p..........@.............................@ .....@lx}..b..........................................0 ......c..........h.......................$#................................................... ...............................text............................... ..`.rdata..,O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\ibC\rstrui.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	266752
Entropy (8bit):	6.897387942763048
Encrypted:	false
SSDEEP:	6144:D3hz8ahr1HO41TxQZMPALXksYuangs2+UvQ/KpmOq:D3hQAFbTxQUmksYuKSvQ/Kp
MD5:	3E8AFFA54035412F86663C8B44CAA2E5
SHA1:	FEC456E10294F45D6F8F472A6228D3D90CA6A29C
SHA-256:	277341B416424AEA462F74FF03DD1A46DECA687A6751AE9A2D5D5902C03BDE6B
SHA-512:	D4070B64AD9A44A841C138E742AA3FD25A79F6DF99C216B5A11C315D8088BCE790F5CAD047B33D35A9DA1D428AA50D6CFB000F73A521D760F22F864D1D41027E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........zn......................................................................Rich....................PE..d................".......... .................@.............................`............`.......... .......................................U..............................P..\....@..T...........................0...............0................................text............................... ..`.rdata...a.......b..................@..@.data...8............\..............@....pdata...............^..............@..@.rsrc...............n..............@..@.reloc..\....P......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\rRo\AgentService.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1189376
Entropy (8bit):	6.169931271903684
Encrypted:	false
SSDEEP:	24576:+pL4Q4y94x7ZWe6b1B5I2M62kM0s1vt2txc/viVO1IORNfLc:uL4Q3S9b6b1UA9MPwOR5c
MD5:	F7E36C20DB953DFF4FDDB817904C0E48
SHA1:	8C6117B5DD68D397FD7C32F4746FB9B353D5DAE5
SHA-256:	2C5EDE0807D8A5EC4B6E0FE0C308B37DBBDE12714FD9ADC4CE3EF4E0A5692207
SHA-512:	32333A33DECD1AF0915FFDC48DA99831DA345010A91630C5245F2548939E33157F6151F596C09D0BEEAC3F15F08F79D4EEF4FAA4158BA023DEDFC4F6F6F56DF8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:K..[%M.[%M.[%M.?&L.[%M.? L.[%M.?!L.[%M.?$L.[%M.[$M.Z%M.?,L.[%M.?.M.[%M.?'L.[%MRich.[%M........................PE..d...m.>l.........."..........B.................@.....................................=....`.......... ...............................................P.. ........x...........`..`...p-..T...................pI..(...pH...............I...............................text...L........................... ..`.rdata..\| ......."..................@..@.data...@....@...r..."..............@....pdata...x.......z..................@..@.rsrc... ....P......................@..@.reloc..`....`......................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\rRo\VERSION.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2113536
Entropy (8bit):	3.571324793039718
Encrypted:	false
SSDEEP:	12288:wVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:1fP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	27CCEC84BA6CA777B27110197696FBEF
SHA1:	DBB78FB380579999D89F4BDD500646FD6D3B8095
SHA-256:	203F5FCF722964E9156B799555DE9E8B8E5DA43BE27EC4CEA2A145A537B112B4
SHA-512:	1760D7393379D23F632820CDAEA112CACB95DA6E6887E8154EE6F0C23A981C26D61624807AA33AF5E53F1D346DCD40847FA4AF36F8872DDC3439267807C90865
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.,..DN^.........." ......... ......p..........@.............................@ .....@lx}..b..........................................0 .+....c..........h.......................$#................................................... ...............................text............................... ..`.rdata..,O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\rceY\SYSDM.CPL Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2113536
Entropy (8bit):	3.5708385833605014
Encrypted:	false
SSDEEP:	12288:bVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:6fP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	E4A228EF2BE7A7BB18B82E158B0BF492
SHA1:	E97954CEAFEAB7FC60EB68BF8D944C07DD8C9279
SHA-256:	2EB2FB1CB783379733187C724170B7FAFF3E672B6126EF774FB898EB9954A59F
SHA-512:	33532604A87278CA1E668148A35A4CE2C78C2D6DAFEB1588FCF03561EE822233AC5582370CBEF7BD54BA59962697416E086D4BD6493B04ED6A4FA481248D3706
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.,..DN^.........." ......... ......p..........@.............................@ .....@lx}..b..........................................0 ......c..........h.......................$#................................................... ...............................text............................... ..`.rdata..,O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\rceY\SystemPropertiesProtection.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83968
Entropy (8bit):	7.065737112404973
Encrypted:	false
SSDEEP:	1536:YKuZAtREC/rMcgEPJV+G57ThjEC0kzJP+V5J8:+AzECTMpuDhjRVJGq
MD5:	B6C7834B60F72194E32822CD7F39D7A9
SHA1:	26AC4990B1203DD53A299857477EB2DE5CDC0DB1
SHA-256:	02F96A1E1233655997498DF6B11A48270DF05BDA561F004EDC83A165216A04C9
SHA-512:	96E8E380902866247A2873348C88DB244E87E1F925FF78AF06CE5541C5A1AA535BDA6DEB8941D646A1E7E91801BE934D715C990C96B5764511438BBE597D5F8A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a..[a..[a..[h..[o..[..Z`..[..Zc..[..Zp..[a..[C..[..Zd..[..Z`..[..q[`..[..Z`..[Richa..[........................PE..d...k............."..........>.................@....................................{4....`.......... .......................................&.......P..@'...@.................. ...."..T............................ ...............!..8............................text............................... ..`.rdata..N.... ......................@..@.data........0......................@....pdata.......@......................@..@.rsrc...@'...P...(..................@..@.reloc.. ............F..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\ueX148\DUI70.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2396160
Entropy (8bit):	4.105944663139605
Encrypted:	false
SSDEEP:	12288:zVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1/6Z:ifP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	8EDDD923C44EA882400A14F7E08961E6
SHA1:	7A3FC8D8000BBF4B889AEE4008B8A8479629D3FC
SHA-256:	92DC9761B348B60FDF62F2A8148E8BE5DAF8614163AF3EDA408C6235D78B5680
SHA-512:	75C8787B6FF5D0B9434403CE741C013C2A59C6F10A5947990869C64C97B7F06F07ABC9AFE91AB70D570EA44BC24F9F145B718E503BE5D699F389D880DABD3BC4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.,..DN^.........." .........p .....p..........@..............................$.....@lx}..b..........................................0 .dQ...c..........h.......................$#................................................... ...............................text............................... ..`.rdata..,O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\ueX148\SysResetErr.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	42392
Entropy (8bit):	5.943178981884173
Encrypted:	false
SSDEEP:	768:zYVfzVTBuXwMHhrdXbsxoXF8Q0no8pV1Pxo:CfuXXrdrXXD0no8xPxo
MD5:	6A3F2F3C36FE45A87E3BFA80B6D92E07
SHA1:	8C211767AD8393F9F184FC926FE3B8913F414289
SHA-256:	069608FF0FF5918681A80CF7603275DC6CD7D416A73D033D19962B0F0F1E1EAC
SHA-512:	A75669E0481901FC7CFCA55FBC7BD7FC0E8636767537017A41B1C720F34B5AD45AC75555D0AD246AC0DF670FDC31CBA1BEFD21D63E112AD427472DE3EA59CAA6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%7..aV..aV..aV..h.S.cV...2..cV...2..vV...2..kV...2..tV..aV...V...2..oV...2?.`V...2..`V..RichaV..................PE..d...v.+J.........."......6...X.......9.........@.....................................l............... ...................................................................!......,...0t..T...................`d..(...`c...............d..`............................text...{4.......6.................. ..`.imrsiv......P...........................rdata.......`...0...:..............@..@.data...h............j..............@....pdata...............n..............@..@.rsrc................t..............@..@.reloc..,...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\vx8g6QJ\VERSION.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2113536
Entropy (8bit):	3.57132661640891
Encrypted:	false
SSDEEP:	12288:VVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:MfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	5A782F93AABE4F2ED2ACBEC2833C93D6
SHA1:	995BA0E8D5508D7B53A58CF5C82FF49AB773A191
SHA-256:	8ACFC387ADF47F1D17569F1051E5D816139F8A7F645E9AA54DCB9B521BEBCAE8
SHA-512:	0332E470C563975D54E7DBCDAC814348C12652389882D1235FCE426A40250B0E671F49950E322695D7498DA39AB2FAC5957ACCA3E644AD973ACA2F4B2B5C8C63
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.,..DN^.........." ......... ......p..........@.............................@ .....@lx}..b..........................................0 .+....c..........h.......................$#................................................... ...............................text............................... ..`.rdata..,O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\vx8g6QJ\systemreset.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	506184
Entropy (8bit):	6.340311139921773
Encrypted:	false
SSDEEP:	6144:5el0JVJ8W9WUYEBaH2+8yafsjs3hXx6EfjZTheegL57KUgQGEEEsND0ZCYWh9Aig:UCVRAlEBgKyiv3V2e+X
MD5:	872AE9FE08ED1AA78208678967BE2FEF
SHA1:	846E6D44FBD2A5B9AC53427300B71D82355C712E
SHA-256:	457EA0477CB26432088F4EB910CFFBCBFA597EF65D63E9DB9109ED8529C902D4
SHA-512:	5235DEC4BA556975B07B22729D1ECB0FB513D15D58DB94737B0B8B25AB4C629255B4EA2D8B6854DB53F0E79C3EE7B742850C5C604A0BE04B1C251216A395A427
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........\|..n/..n/..n/.../..n/..m...n/..j...n/..k...n/..o...n/..o/\|.n/..g.Q.n/../..n/..l...n/Rich..n/........PE..d....3.b..........".................@..........@....................................F................ .......................................h..\|...............\|.......H3..............T....................6..(....5...............7..P............................text............................... ..`.imrsiv..................................rdata...\|.......~..................@..@.data....)...........p..............@....pdata..\|...........................@..@.rsrc...............................@..@.reloc...............\|..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\whddZ\WTSAPI32.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2113536
Entropy (8bit):	3.57775166170893
Encrypted:	false
SSDEEP:	12288:WVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:LfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	54D6B919887A5134B1B7FBA52D9DB9DC
SHA1:	85808B5A47438F7C1F5F10E86CAE90E3BF6D2225
SHA-256:	A1A68697499261F40AEA56C406DACD945298612BE8CA952264133AFBA68592D8
SHA-512:	B3E9C3659D85815EC8740450CD0AD859AC827A5E0365FC1B45C744D9E64F33A05831ECB25450FE623F22989F683B75FDFF18419AC886E4B3CDCEA1A828E0F079
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.,..DN^.........." ......... ......p..........@.............................@ .....@lx}..b..........................................0 ......c..........h.......................$#................................................... ...............................text............................... ..`.rdata..,O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\whddZ\irftp.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	184832
Entropy (8bit):	5.862106385432374
Encrypted:	false
SSDEEP:	3072:gzPq/xfWlkWmvIGaYLZ4yjchpChlyelcU4uuh0SEslWsXxgCzX0Fhf8LL8FT7:Eq5fWlkjuYLLtHyeFSEiXxZzb8FT
MD5:	F1C2D10CA8161DB689CD4FDE756E2DBB
SHA1:	C41E86E9755824D3775E2AD6CAC9A46C7AA1C417
SHA-256:	8854450FEAD134B24FABF4B805434FCFDDF25D2179048410728F8901E0FE0906
SHA-512:	5EBB1AD4261C689E22FE34CFB0C18D71451DD4F3694D8F521D181EB42FF90582D8EF8C8AB43BFC59D224452944D9602DB1030B633856E139442EEF0C2F4428F5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PU...4}..4}..4}.{P~..4}.{Py..4}.{Px..4}.{P\|..4}..4\|.c5}.{Pt.74}.{P...4}.{P...4}.Rich.4}.........................PE..d....v.4.........."......6...........4.........@..........................................`.......... ......................................T...,....p..0....`..t............p..........T...........................@i..............@j...............................text....4.......6.................. ..`.rdata.......P.......:..............@..@.data....\|..........................@....pdata..t....`......................@..@.rsrc...0....p......................@..@.reloc.......p......................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\eb42b1a5c308fc11edf1ddbdd25c8486_d06ed635-68f6-4e9a-955c-4899f5f57b9a Download File
Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	4462
Entropy (8bit):	5.481159077284676
Encrypted:	false
SSDEEP:	48:efUhXzCwetqO+hQTEPdQhIU2gwp9HhFTZyfUhy9UL5g8JTisy1m9icqrVWhgPPbH:efKD3ca09oDl8fKyHGnqrGgPP7
MD5:	E7D9B66B57847225C62F450426207762
SHA1:	C8A0768D0248D8EE769F1ADD84404097E8A4961D
SHA-256:	60C2B10062CD62D9B757DAC141989564F46A3653D48A2220300DE94E47BEEF54
SHA-512:	237BCA55E1EE6C9C1CB857A8460BEC74ED017991CD0A722FE6D564C5E67C5C12FC7844FAF6C970AC167689D6E35D85CD44AD0E15062B7BDFC0C540772FCED818
Malicious:	false
Preview:	........................................user.........................................user.....................RSA1..................~...kT..,...`.b......../.....on..L..6-a..........u."N..7..~.O.".I:..x...p^.2.W.->..cv...b..o.o..r.Y#:.jh.{&<..Z...Lvs.....................z..O......m......G..}....,....,...C.r.y.p.t.o.A.P.I. .P.r.i.v.a.t.e. .K.e.y....f...... ......^]....Z...Z..b.a"..B...WcE............. ....$.e>...z.....f9'.<\|.9....x.......V..E.\.92....wc.+(.>.B.U....{.\...\|?.....w...W+.J.&../O..3`.k.Si.....t.o..,p.g.c]d;.N......L+..n..w..h...Oq.^.....Z4....6.?(8.e...S!t.....s...78-.dl._.F\..4e>M..j.7\|.k.FqE..+l}7j..3p.e..+..x..H.o%.H.h...?..e...0.+B.....d.Pg`k3..N...h.uL..K,S"?{......w..2q...N2..+...7.r#v..B....9..i.UU.C.gS..wA&.k..C..?....E.'.h.e......];..qA......]......F.....Q..[DW0.....B^......w.T-.Tc..?......6.w$.......p.#......)3...<...kdI.b.R.h.w.5..?.%.+I.:...4......&..w....I.zW.Rn\|..j.:O...p.M..2\.J.E....g.O.p...ot...C...T..o.

Static File Info

General
File type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Entropy (8bit):	3.5770452220314155
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	1ZDvfs8V0D.dll
File size:	2109440
MD5:	291d328b80fa04b559d8bef5875125f1
SHA1:	86664f646c9b2d93102046b34b20ec495f3a58da
SHA256:	803674f9a33df4d1a18051592df46f57a5c735367773691ab2bfb17a21aa6eb6
SHA512:	c8e125d84d36b76416bb4f085426ca12ae53bb6f354ef96c6198fa325f1fe5ff02dc04e11a7be9182cbcfcf891f6b4d3ea80d8b238e7cd99b9d30b9883816278
SSDEEP:	12288:bVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:6fP7fWsK5z9A+WGAW+V5SB6Ct4bnb
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|.

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General
Entrypoint:	0x140041070
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Time Stamp:	0x5E4E44CC [Thu Feb 20 08:35:24 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	6668be91e2c948b183827f040944057f

Entrypoint Preview

Instruction
dec eax
xor eax, eax
dec eax
add eax, 5Ah
dec eax
mov dword ptr [00073D82h], ecx
dec eax
lea ecx, dword ptr [FFFFECABh]
dec eax
mov dword ptr [00073D7Ch], edx
dec eax
add eax, ecx
dec esp
mov dword ptr [00073D92h], ecx
dec esp
mov dword ptr [00073DA3h], ebp
dec esp
mov dword ptr [00073D7Ch], eax
dec esp
mov dword ptr [00073D85h], edi
dec esp
mov dword ptr [00073D86h], esi
dec esp
mov dword ptr [00073D8Fh], esp
dec eax
mov ecx, eax
dec eax
sub ecx, 5Ah
dec eax
mov dword ptr [00073D89h], esi
dec eax
test eax, eax
je 00007FF4C0A6D33Fh
dec eax
mov dword ptr [00073D45h], esp
dec eax
mov dword ptr [00073D36h], ebp
dec eax
mov dword ptr [00073D7Fh], ebx
dec eax
mov dword ptr [00073D70h], edi
dec eax
test eax, eax
je 00007FF4C0A6D31Eh
jmp ecx
dec eax
add edi, ecx
dec eax
mov dword ptr [FFFFEC37h], ecx
dec eax
xor ecx, eax
jmp ecx
retn 0008h
ud2
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ebx
dec eax
sub esp, 00000080h
mov eax, F957B016h
mov byte ptr [esp+7Fh], 00000037h
mov edx, dword ptr [esp+78h]
inc ecx
mov eax, edx
inc ecx
or eax, 5D262B0Ch
inc esp
mov dword ptr [esp+78h], eax
dec eax
mov dword ptr [eax+eax+00h], 00000000h

Rich Headers

Programming Language:

[LNK] VS2012 UPD4 build 61030
[ASM] VS2013 UPD2 build 30501
[ C ] VS2012 UPD2 build 60315
[C++] VS2013 UPD4 build 31101
[RES] VS2012 UPD3 build 60610
[LNK] VS2017 v15.5.4 build 25834
[ C ] VS2017 v15.5.4 build 25834
[ASM] VS2010 build 30319
[EXP] VS2015 UPD1 build 23506
[IMP] VS2008 SP1 build 30729
[RES] VS2012 UPD4 build 61030
[LNK] VS2012 UPD2 build 60315
[C++] VS2015 UPD1 build 23506
[ C ] VS2013 UPD4 build 31101

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x202010	0x22b	.qlndvj
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa6390	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc0000	0x468	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc1000	0x2324	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x42000	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x40796	0x41000	False	0.776085486779	data	7.73364605679	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x42000	0x64f2c	0x65000	False	0.702390160891	data	7.86574512659	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa7000	0x178b8	0x18000	False	0.0694580078125	data	3.31515306295	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.pdata	0xbf000	0x12c	0x1000	False	0.06005859375	PEX Binary Archive	0.581723022719	IMAGE_SCN_TYPE_DSECT, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xc0000	0x880	0x1000	False	0.139892578125	data	1.23838501563	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc1000	0x2324	0x3000	False	0.0498046875	data	4.65321444248	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.qkm	0xc4000	0x74a	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.cvjb	0xc5000	0x1e66	0x2000	False	0.0037841796875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tlmkv	0xc7000	0xbde	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.wucsxe	0xc8000	0x45174	0x46000	False	0.0010498046875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.fltwtj	0x10e000	0x1267	0x2000	False	0.0037841796875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.sfplio	0x110000	0x736	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rpg	0x111000	0x45174	0x46000	False	0.0010498046875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bewzc	0x157000	0x1124	0x2000	False	0.0037841796875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.vksvaw	0x159000	0x736	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.wmhg	0x15a000	0x1278	0x2000	False	0.0037841796875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.kswemc	0x15c000	0x36d	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.kaxfk	0x15d000	0x197d	0x2000	False	0.0037841796875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.pjf	0x15f000	0xbde	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.favk	0x160000	0x1f7	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.vhtukj	0x161000	0x45174	0x46000	False	0.0010498046875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.hmbyox	0x1a7000	0x8fe	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.txms	0x1a8000	0x3fe	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.vqqm	0x1a9000	0x1af	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.cbwb	0x1aa000	0x23b	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.sggk	0x1ab000	0x74a	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.cbotn	0x1ac000	0x23b	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.urf	0x1ad000	0xebe	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.yera	0x1ae000	0x1f7	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.sjj	0x1af000	0x23b	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.wcro	0x1b0000	0x103	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.imkkq	0x1b1000	0x1278	0x2000	False	0.0037841796875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.mrdc	0x1b3000	0x45174	0x46000	False	0.0010498046875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.eaph	0x1f9000	0x3ba	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.wqzg	0x1fa000	0x8fe	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.uwxw	0x1fb000	0x8fe	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.acz	0x1fc000	0xbde	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.ktb	0x1fd000	0x896	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.nqplrs	0x1fe000	0x23b	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.btah	0x1ff000	0x23b	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.majbu	0x200000	0xbde	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.zefvk	0x201000	0x13e	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.qlndvj	0x202000	0x23b	0x1000	False	0.080078125	data	1.11857321905	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0xc00a0	0x370	data	English	United States
RT_MANIFEST	0xc0410	0x56	ASCII text, with CRLF line terminators	English	United States

Imports

DLL	Import
USER32.dll	LookupIconIdFromDirectoryEx, WaitForInputIdle, GetParent, GetFocus
SETUPAPI.dll	CM_Get_Resource_Conflict_DetailsW
KERNEL32.dll	DeleteCriticalSection, DeleteTimerQueue, TerminateJobObject, GetFileInformationByHandle, GetThreadLocale, GetNamedPipeServerProcessId, GetConsoleFontSize
GDI32.dll	CreateBitmapIndirect, GetPolyFillMode
CRYPT32.dll	CertGetCTLContextProperty
ADVAPI32.dll	AddAccessDeniedObjectAce
SHLWAPI.dll	ChrCmpIW

Exports

Name	Ordinal	Address
GetFileVersionInfoA	1	0x140037cd0
GetFileVersionInfoByHandle	2	0x140012394
GetFileVersionInfoExA	3	0x14003e42c
GetFileVersionInfoExW	4	0x140038c04
GetFileVersionInfoSizeA	5	0x140035ab4
GetFileVersionInfoSizeExA	6	0x140030664
GetFileVersionInfoSizeExW	7	0x14001e37c
GetFileVersionInfoSizeW	8	0x14001fde8
GetFileVersionInfoW	9	0x1400394d8
VerFindFileA	10	0x14000bc90
VerFindFileW	11	0x14000d0d4
VerInstallFileA	12	0x140019a78
VerInstallFileW	13	0x140027dfc
VerLanguageNameA	14	0x140032fdc
VerLanguageNameW	15	0x1400350c0
VerQueryValueA	16	0x14001636c
VerQueryValueW	17	0x14000424c

Version Infos

Description	Data
LegalCopyright	Microsoft Corporation. All rights reserv
InternalName	bitsp
FileVersion	7.5.7600.16385 (win7_rtm.090713-
CompanyName	Microsoft Corporati
ProductName	Microsoft Windows Operating S
ProductVersion	6.1.7600
FileDescription	Background Intellig
OriginalFilename	kbdy
Translation	0x0409 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll64.exe PID: 1400 Parent PID: 5424

General

Start time:	14:03:29
Start date:	15/09/2021
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe 'C:\Users\user\Desktop\1ZDvfs8V0D.dll'
Imagebase:	0x7ff675f90000
File size:	140288 bytes
MD5 hash:	A84133CCB118CF35D49A423CD836D0EF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 1232 Parent PID: 1400

General

Start time:	14:03:30
Start date:	15/09/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\1ZDvfs8V0D.dll',#1
Imagebase:	0x7ff7bf140000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 1380 Parent PID: 1400

General

Start time:	14:03:30
Start date:	15/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoA
Imagebase:	0x7ff64a610000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000003.00000002.338211546.0000000140001000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 2752 Parent PID: 1232

General

Start time:	14:03:30
Start date:	15/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe 'C:\Users\user\Desktop\1ZDvfs8V0D.dll',#1
Imagebase:	0x7ff64a610000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000004.00000002.246135848.0000000140001000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: explorer.exe PID: 3292 Parent PID: 1380

General

Start time:	14:03:32
Start date:	15/09/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff662bf0000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 4576 Parent PID: 1400

General

Start time:	14:03:33
Start date:	15/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoByHandle
Imagebase:	0x7ff64a610000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000007.00000002.252542553.0000000140001000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 5340 Parent PID: 1400

General

Start time:	14:03:37
Start date:	15/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoExA
Imagebase:	0x7ff64a610000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000008.00000002.260356621.0000000140001000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 5240 Parent PID: 1400

General

Start time:	14:03:40
Start date:	15/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoExW
Imagebase:	0x7ff64a610000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 0000000A.00000002.268405369.0000000140001000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 3268 Parent PID: 1400

General

Start time:	14:03:44
Start date:	15/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoSizeA
Imagebase:	0x7ff64a610000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 0000000B.00000002.279441131.0000000140001000.00000020.00020000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: rundll32.exe PID: 1748 Parent PID: 1400

General

Start time:	14:03:48
Start date:	15/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoSizeExA
Imagebase:	0x7ff64a610000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 0000000D.00000002.283715415.0000000140001000.00000020.00020000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: rundll32.exe PID: 1744 Parent PID: 1400

General

Start time:	14:03:51
Start date:	15/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoSizeExW
Imagebase:	0x7ff64a610000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000011.00000002.292039618.0000000140001000.00000020.00020000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: rundll32.exe PID: 6164 Parent PID: 1400

General

Start time:	14:03:55
Start date:	15/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoSizeW
Imagebase:	0x7ff64a610000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000016.00000002.298943238.0000000140001000.00000020.00020000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: rundll32.exe PID: 6260 Parent PID: 1400

General

Start time:	14:03:58
Start date:	15/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoW
Imagebase:	0x7ff64a610000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000018.00000002.306373888.0000000140001000.00000020.00020000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: rundll32.exe PID: 6284 Parent PID: 1400

General

Start time:	14:04:02
Start date:	15/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerFindFileA
Imagebase:	0x7ff64a610000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000019.00000002.314059179.0000000140001000.00000020.00020000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: rundll32.exe PID: 6300 Parent PID: 1400

General

Start time:	14:04:05
Start date:	15/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerFindFileW
Imagebase:	0x7ff64a610000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 0000001A.00000002.320976906.0000000140001000.00000020.00020000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: rundll32.exe PID: 6320 Parent PID: 1400

General

Start time:	14:04:08
Start date:	15/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerInstallFileA
Imagebase:	0x7ff64a610000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 0000001B.00000002.327625102.0000000140001000.00000020.00020000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: rundll32.exe PID: 6376 Parent PID: 1400

General

Start time:	14:04:12
Start date:	15/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerInstallFileW
Imagebase:	0x7ff64a610000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 0000001D.00000002.335328318.0000000140001000.00000020.00020000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: rundll32.exe PID: 6404 Parent PID: 1400

General

Start time:	14:04:15
Start date:	15/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerLanguageNameA
Imagebase:	0x7ff64a610000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 0000001E.00000002.395045781.0000000140001000.00000020.00020000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: msinfo32.exe PID: 6444 Parent PID: 3292

General

Start time:	14:04:16
Start date:	15/09/2021
Path:	C:\Windows\System32\msinfo32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msinfo32.exe
Imagebase:	0x7ff6222a0000
File size:	370176 bytes
MD5 hash:	C471C6B06F47EA1C66E5FAA8DFCEF108
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: msinfo32.exe PID: 6468 Parent PID: 3292

General

Start time:	14:04:17
Start date:	15/09/2021
Path:	C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe
Imagebase:	0x7ff72a9d0000
File size:	370176 bytes
MD5 hash:	C471C6B06F47EA1C66E5FAA8DFCEF108
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000020.00000002.347477608.0000000140001000.00000020.00020000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, Metadefender, Browse Detection: 0%, ReversingLabs

Chronological Activities

Analysis Process: rundll32.exe PID: 6500 Parent PID: 1400

General

Start time:	14:04:19
Start date:	15/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerLanguageNameW
Imagebase:	0x7ff64a610000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000021.00000002.352321962.0000000140001000.00000020.00020000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: mfpmp.exe PID: 6516 Parent PID: 3292

General

Start time:	14:04:20
Start date:	15/09/2021
Path:	C:\Windows\System32\mfpmp.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\mfpmp.exe
Imagebase:	0x7ff705b40000
File size:	49688 bytes
MD5 hash:	7C3D09D6DB5DB4A272FCF4C1BB3986BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: mfpmp.exe PID: 6524 Parent PID: 3292

General

Start time:	14:04:21
Start date:	15/09/2021
Path:	C:\Users\user\AppData\Local\BxU\mfpmp.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\BxU\mfpmp.exe
Imagebase:	0x7ff7b6db0000
File size:	49688 bytes
MD5 hash:	7C3D09D6DB5DB4A272FCF4C1BB3986BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000023.00000002.356448688.0000000140001000.00000020.00020000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, Metadefender, Browse Detection: 0%, ReversingLabs

Chronological Activities

Analysis Process: rundll32.exe PID: 6620 Parent PID: 1400

General

Start time:	14:04:23
Start date:	15/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerQueryValueA
Imagebase:	0x7ff64a610000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000024.00000002.361689565.0000000140001000.00000020.00020000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: SystemPropertiesProtection.exe PID: 6740 Parent PID: 3292

General

Start time:	14:04:24
Start date:	15/09/2021
Path:	C:\Windows\System32\SystemPropertiesProtection.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SystemPropertiesProtection.exe
Imagebase:	0x7ff7dbdb0000
File size:	83968 bytes
MD5 hash:	B6C7834B60F72194E32822CD7F39D7A9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: loaddll64.exe PID: 1400 Parent PID: 5424 loaddll64.exeCOMMON

Executed Functions

Function 00000001400495B0, Relevance: 8.7, APIs: 2, Strings: 2, Instructions: 1727COMMON

Download Yara Rule

Strings

}*, xrefs: 0000000140049620
}*, xrefs: 0000000140049BDD

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: }*$}*
API String ID: 0-2047341001
Opcode ID: b2d8981d994e193b974dd97b3248349f041180fa9e1ee75c24f96b4e32672199
Instruction ID: dfe71950bb4b00d773a2c1e4d7d9ca62016f185058a51a46645e99606ce0912a
Opcode Fuzzy Hash: b2d8981d994e193b974dd97b3248349f041180fa9e1ee75c24f96b4e32672199
Instruction Fuzzy Hash: CDF2E476601B8481EB269F17D5503EE77A1F78EBC8F9A4025EB0A077B5DB38C945C348

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140036F30, Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 222COMMON

Download Yara Rule

APIs

FreeConsole.KERNELBASE ref: 000000014003704B
EntryPoint.1ZDVFS8V0D ref: 00000001400370EE

Strings

d, xrefs: 0000000140037032
)8GV, xrefs: 0000000140037008

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ConsoleEntryFreePoint
String ID: )8GV$d
API String ID: 3550414006-3589632123
Opcode ID: d05d8187567b24d43b5378db4c26f8457bb6311b4b9be5c519ef70a53fb6d972
Instruction ID: d510f836e5bc92855b025e221ee4853bd72dbb3d22a76ed0b2795177c136f2ac
Opcode Fuzzy Hash: d05d8187567b24d43b5378db4c26f8457bb6311b4b9be5c519ef70a53fb6d972
Instruction Fuzzy Hash: 2C91983230064096EB26EB66D0513EE23A5AB9C7D4F914526BB1E47BFBEE34CA05C350

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005C340, Relevance: 6.1, APIs: 1, Strings: 2, Instructions: 886COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE ref: 000000014005D101

Strings

sy;, xrefs: 000000014005C9ED
sy;, xrefs: 000000014005C420

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: InfoSystem
String ID: sy;$sy;
API String ID: 31276548-3660992706
Opcode ID: 4ba7a1a776c1b2a8194e3aee1005776fcb25fed3b21deabde970c8a1fedf5655
Instruction ID: 6e6b9d6b41ba510f9365bd6ae70f9dc3139515c8db1fe8c3f4a6c85962f57752
Opcode Fuzzy Hash: 4ba7a1a776c1b2a8194e3aee1005776fcb25fed3b21deabde970c8a1fedf5655
Instruction Fuzzy Hash: 2A82DB72215B848AEB26CF27D4507E977E1F789BC4F498426EB4A077B6DB39C941C380

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004BD40, Relevance: 6.0, APIs: 1, Strings: 2, Instructions: 789COMMON

Download Yara Rule

Strings

}*, xrefs: 000000014004C37C
}*, xrefs: 000000014004BDB0

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: }*$}*
API String ID: 0-2047341001
Opcode ID: 7295418c03dacbe62c915b6dd4b980e4d41f822c5e8600d002afc3f8743a909a
Instruction ID: 589d9863290c94d963c78ae1aba4b537ce1e649f887b860e334c2c2edf70769e
Opcode Fuzzy Hash: 7295418c03dacbe62c915b6dd4b980e4d41f822c5e8600d002afc3f8743a909a
Instruction Fuzzy Hash: B872E172211B8081EBA68F23D4547ED77A1F78DBC4F8A5125EB4A477B6EB38C944C348

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005D290, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 000000014005D2ED

Strings

., xrefs: 000000014005D36A

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileFindFirst
String ID: .
API String ID: 1974802433-248832578
Opcode ID: 676bd74008c321f1f054d2561c231ee4757c1d63a5241c01311e4a1111e2dca9
Instruction ID: 4bac0f1caae8588fed560e2f4dd75fe3b4005a9d196e6938d52e54566134f4c2
Opcode Fuzzy Hash: 676bd74008c321f1f054d2561c231ee4757c1d63a5241c01311e4a1111e2dca9
Instruction Fuzzy Hash: C841A43260564085FB76DB26E1003AD73A1A748BF8F184713EF69177E9DB7AC982C742

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140026CC0, Relevance: 2.9, Strings: 2, Instructions: 362COMMON

Download Yara Rule

Strings

)8GV, xrefs: 0000000140027120
)8GV, xrefs: 000000014002703B

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: )8GV$)8GV
API String ID: 0-993736920
Opcode ID: 5886ea82fe4a1d5b647365e044932bffc6999eebc1d65fac80672f325e465605
Instruction ID: e7db99c2ed76c24e9271fdfca30502f9120cd4f12b6678b2f47d4e41cadbe873
Opcode Fuzzy Hash: 5886ea82fe4a1d5b647365e044932bffc6999eebc1d65fac80672f325e465605
Instruction Fuzzy Hash: 3BF18F7272064095EB52EB72D8913EE6365FB993C8F900426BB0E47AFADF34CA45C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006A4B0, Relevance: 1.7, APIs: 1, Instructions: 237nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 000000014006A550

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: c571d8b9788f13bc1a6c9d6d9ec75b3e860dc3d379630f9026fe8c942d3d5bbc
Instruction ID: ba306794fc56961ae9be9e8108b60f4a03202e28571258f9feaa1cffdeadac3d
Opcode Fuzzy Hash: c571d8b9788f13bc1a6c9d6d9ec75b3e860dc3d379630f9026fe8c942d3d5bbc
Instruction Fuzzy Hash: 25B16E36601B409AE712EF26D9403EE33A6F7497C8F645825EB4E47BA6DF38D524CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140048AC0, Relevance: 1.7, APIs: 1, Instructions: 185libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL ref: 0000000140048CDE

Part of subcall function 000000014005D1F0: FindNextFileW.KERNELBASE(?,?,CD3BEB56,0000000140048BFE), ref: 000000014005D21B

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileFindLoadNext
String ID:
API String ID: 50669962-0
Opcode ID: aa0438968589772fc8f2a9ec3ebe64abc64651e75ec2b3921e4afd98a3b5e278
Instruction ID: 5bbbb247b64301f03cc62f5655f26b2922a91791dd430743fbd3ba68f8766a4f
Opcode Fuzzy Hash: aa0438968589772fc8f2a9ec3ebe64abc64651e75ec2b3921e4afd98a3b5e278
Instruction Fuzzy Hash: 07819D3261568092FB22EB26E4513EE6365FBD83D4F814521FB4A57AEBEF38C605C704

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140035270, Relevance: 1.7, APIs: 1, Instructions: 181COMMON

Download Yara Rule

APIs

Part of subcall function 0000000140046C90: NtClose.NTDLL ref: 0000000140046CBE

ExitProcess.KERNEL32 ref: 00000001400354E1

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseExitProcess
String ID:
API String ID: 3487036407-0
Opcode ID: 5c30d9f3bf3ad5247cfe131953472b6de56d2531a4e84ebcbfa6a909151eb5a4
Instruction ID: 3d479053040576d7404e3dfab4813d6254088c9544e20b556efee73ce8d776a8
Opcode Fuzzy Hash: 5c30d9f3bf3ad5247cfe131953472b6de56d2531a4e84ebcbfa6a909151eb5a4
Instruction Fuzzy Hash: 5771BF32710A5096FB16EB72D4513EE2365AB883D9F844522BF5E53AFADF35C906C340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140046C90, Relevance: 1.5, APIs: 1, Instructions: 19nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL ref: 0000000140046CBE

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: daec19cacdd098f1244212ea8e14a5d3e1bd9439d57025bc9e494c2d8b520846
Instruction ID: acc9ee73913d888b71121e4cedfe861758cf19cabea33dd7822bbf7d3cf7603a
Opcode Fuzzy Hash: daec19cacdd098f1244212ea8e14a5d3e1bd9439d57025bc9e494c2d8b520846
Instruction Fuzzy Hash: 42E08CA1741A0041EF265276D0803A812809B4D7B4E194B209A7D0B3E0EA3888898716

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400524B0, Relevance: .8, Instructions: 815COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1fe821b06c1a4823bb9271ec043e796f757224c870123343ecb03a76390b80a
Instruction ID: bccbce3911ab829ef3288d496869760cb1404da12fac801df191153d1e38d36e
Opcode Fuzzy Hash: b1fe821b06c1a4823bb9271ec043e796f757224c870123343ecb03a76390b80a
Instruction Fuzzy Hash: 9172CD72601B9485FB26CF17D4503E967A1FB8EFC4F998426EB0A077A5EB39C945C380

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140065B80, Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef59d8dad7016460516c65c54e0757d465c5ab080b3c9532efa0d5a42b826e15
Instruction ID: 84a8ec628d281786b49b5e6f6f6dec0d0376b1c45e732984354cafa0c8984479
Opcode Fuzzy Hash: ef59d8dad7016460516c65c54e0757d465c5ab080b3c9532efa0d5a42b826e15
Instruction Fuzzy Hash: D761947121164102FE76B72399047EE5292AFAD3E4F650B21BF6E47BF9EE38C9018740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140034870, Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9551ae3eb8102b5ebebf946a3998feeee295eeedab946ed72fd7e67ef554d99f
Instruction ID: 713527809b35fed6260ebd230ad48717dd4fa7a304d79e310e96a8de0daf9cee
Opcode Fuzzy Hash: 9551ae3eb8102b5ebebf946a3998feeee295eeedab946ed72fd7e67ef554d99f
Instruction Fuzzy Hash: 5A717D32B04B4095FB12EBB2E4913DF67A5FBC8388F954025BB4957AAADF38D445CB04

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140061360, Relevance: 6.3, APIs: 4, Instructions: 290registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000002), ref: 0000000140061459
RegEnumKeyW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000002), ref: 00000001400614B4
RegOpenKeyExW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000002), ref: 0000000140061539
RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000002,?), ref: 0000000140061664

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Close$EnumOpen
String ID:
API String ID: 138425441-0
Opcode ID: 672031fc434e6626b90ea1da62f3c38a687c8b9296ffac50e7f6928d6a85a361
Instruction ID: 4377045c35190c944746a6ea10b9b47c13ce871b5e3b3a15cce40fdff127085f
Opcode Fuzzy Hash: 672031fc434e6626b90ea1da62f3c38a687c8b9296ffac50e7f6928d6a85a361
Instruction Fuzzy Hash: 5BC1A43120568082FE629B16E8503EEA791E7C97E0F6C4A21FB6E47BE5DE78C941C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005F9F0, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 000000014005FA4B

Strings

4aX, xrefs: 000000014005FA09

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: DescriptorSecurity$ConvertString
String ID: 4aX
API String ID: 3907675253-4042356595
Opcode ID: a1249fc2010d9d5d05952f0359ba200457e66aefbced3d07103a2c3463c61beb
Instruction ID: 5c7b4eddd96f597e19123db416744eb931adcf52cf9da5c093af566d74744993
Opcode Fuzzy Hash: a1249fc2010d9d5d05952f0359ba200457e66aefbced3d07103a2c3463c61beb
Instruction Fuzzy Hash: EC216D72214B4582EA12EF66E1403DEB3A0FB8C7C4F844525EB8D07B6AEF39D625C745

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005DAE0, Relevance: 3.1, APIs: 2, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44297aa2126b14dcd4d9c9accf23e52108ed4399094c5e3af94dd8103b7f7b57
Instruction ID: c5574eec75406f68cf122a08b4571db932f63f1e1c7d3e43579234279b4bb767
Opcode Fuzzy Hash: 44297aa2126b14dcd4d9c9accf23e52108ed4399094c5e3af94dd8103b7f7b57
Instruction Fuzzy Hash: A151D03130464182FA72EA63A4507EA77A2BB8CBD4F154527BF5A077E2EF7AC801C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005DD30, Relevance: 3.1, APIs: 2, Instructions: 122fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE ref: 000000014005DDD8
ReadFile.KERNELBASE ref: 000000014005DE49

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: 00f6d0f3771a8cfa98223a140d65de6735ec101d3a44d5ddd75e2d9def7749f0
Instruction ID: 869152f87e2051f324d9e8f0f01270def7d2743b76a8e6c9a5e95a296a3a7e26
Opcode Fuzzy Hash: 00f6d0f3771a8cfa98223a140d65de6735ec101d3a44d5ddd75e2d9def7749f0
Instruction Fuzzy Hash: A541583161464087EA62DB3AA4447AAB3A1FBD87E0F144712BB6D4B7F5DF39C802DB40

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005DBB9, Relevance: 3.1, APIs: 2, Instructions: 79filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DC5C
SetFileTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DCE2

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$CreateTime
String ID:
API String ID: 1043708186-0
Opcode ID: 8a0a731fb1e22280383dc4c244850d697ffee92b9dbadae0b2290ba2595e9be9
Instruction ID: 944ab0cbe82d54181631abf043b2a82f72de4fdca767e43f24bb2c72b9c0c91f
Opcode Fuzzy Hash: 8a0a731fb1e22280383dc4c244850d697ffee92b9dbadae0b2290ba2595e9be9
Instruction Fuzzy Hash: 8D21B431214A4581EA72DB66A0407EA3795F78CBE4F184617EFAE077E5DF7AC806C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005DBD2, Relevance: 3.1, APIs: 2, Instructions: 77filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DC5C
SetFileTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DCE2

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$CreateTime
String ID:
API String ID: 1043708186-0
Opcode ID: d6d835041d1b41abb3b5fe648f8f275da576c4891ed88a603463ed8b7f508fb5
Instruction ID: bee1728ae0ee1a0caa625709e376bb4aadd3217f15d1bcce0d190476addee932
Opcode Fuzzy Hash: d6d835041d1b41abb3b5fe648f8f275da576c4891ed88a603463ed8b7f508fb5
Instruction Fuzzy Hash: BE21D332311A4581EA72DA66A0407EA3795B78CBE4F184527AF9D077E5DE7AC806C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005DBE8, Relevance: 3.1, APIs: 2, Instructions: 76filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DC5C
SetFileTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DCE2

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$CreateTime
String ID:
API String ID: 1043708186-0
Opcode ID: 6bbc7cb38f56b555cae5d46dc9eb85d7f0e424b0d62445df59964c24eed4e9f3
Instruction ID: a00dbcca095f64b26cda9c271166364bdf2e86a9b80154192fb139b54d898421
Opcode Fuzzy Hash: 6bbc7cb38f56b555cae5d46dc9eb85d7f0e424b0d62445df59964c24eed4e9f3
Instruction Fuzzy Hash: 5521E532315A4581EA72DB62A0407EE3791F78CBE4F184517AFAD077E5DE7AC806C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140060D10, Relevance: 3.1, APIs: 2, Instructions: 76registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,000000014004890D), ref: 0000000140060D85
RegQueryValueExA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,000000014004890D), ref: 0000000140060DE8

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 0af55b123fcd85ad11f65efe4d0ac2719b06ecdcd8a99680970ae4064010c44f
Instruction ID: 09cc4365fb23fa9fe14c599ab373ea3e5ec1bde103bfdbf39ccb6e9a9538c2db
Opcode Fuzzy Hash: 0af55b123fcd85ad11f65efe4d0ac2719b06ecdcd8a99680970ae4064010c44f
Instruction Fuzzy Hash: F521A37671569046EF52CB56E8003AFA391EB897F4F184621BF9C07BE8EA38D582C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005DBF8, Relevance: 3.1, APIs: 2, Instructions: 73filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DC5C
SetFileTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DCE2

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$CreateTime
String ID:
API String ID: 1043708186-0
Opcode ID: eb6f16229e65501cd5258548e2b4ff06530ad065b40e2a3bf9e2a9b945b11f61
Instruction ID: 68fcab11a3bde380270331896f94efb0ab36e54eb9d04e7f46ecdc112822b6b1
Opcode Fuzzy Hash: eb6f16229e65501cd5258548e2b4ff06530ad065b40e2a3bf9e2a9b945b11f61
Instruction Fuzzy Hash: 6821C132315A4541EA72DB62A0407EA3795F78CBE4F184627EFAD077E5DE7AC806C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140046F60, Relevance: 1.7, APIs: 1, Instructions: 216COMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32 ref: 0000000140046FDE

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 505a76da9390751f76a813a8bc9fce4b727984ade222f3073bfceff6bf9580dc
Instruction ID: 560481d37deeb2f3cc02cd101c0a384bc9ca8e36dca6fa428839860d024f360c
Opcode Fuzzy Hash: 505a76da9390751f76a813a8bc9fce4b727984ade222f3073bfceff6bf9580dc
Instruction Fuzzy Hash: EDA15D3271064099EB12EFB6C4913EE2365A7987C8F915126BF0D67AFAEF34C609C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005FDA0, Relevance: 1.6, APIs: 1, Instructions: 144synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNELBASE ref: 000000014005FEFE

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 6be956e981540fc735b56164f72d0aea79e48331418f8fd9eaab398243b5d8cf
Instruction ID: 2cd33cf12082532a652157af79f02d7873b375395221c82c38bac87e111ef697
Opcode Fuzzy Hash: 6be956e981540fc735b56164f72d0aea79e48331418f8fd9eaab398243b5d8cf
Instruction Fuzzy Hash: 6E51B2326117408AEB66EB22A0013EE6291EB9DBC4F580535FF4E477E6DF39C802D790

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005D1F0, Relevance: 1.6, APIs: 1, Instructions: 51fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,?,CD3BEB56,0000000140048BFE), ref: 000000014005D21B

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: ff4ac6c2ef48f38791092f6d6c449714fc18167456ec2ef2bc1084d7df7feef3
Instruction ID: fe48dd106ee2d63de4642147a978de6f9e341aec22c75ad1205c2678dbe1ece1
Opcode Fuzzy Hash: ff4ac6c2ef48f38791092f6d6c449714fc18167456ec2ef2bc1084d7df7feef3
Instruction Fuzzy Hash: 80115B7561034082FF76DA6691047E933E1EB697C8F051013EF59472E9EB36C8D2C751

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140060BA0, Relevance: 1.5, APIs: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegEnumValueA.ADVAPI32 ref: 0000000140060C16

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: EnumValue
String ID:
API String ID: 2814608202-0
Opcode ID: a3c12b60ccc1d223e9782810bc36042d204e1f874336debb41352ff4bff3a234
Instruction ID: 650aff04d41c3b1619de3e88208a4500c6b85af191ab70c767efd2679610bbe3
Opcode Fuzzy Hash: a3c12b60ccc1d223e9782810bc36042d204e1f874336debb41352ff4bff3a234
Instruction Fuzzy Hash: 1C112E72204B8486D7219F12E84039EB7A5F788B90FA89529EB8D43B58DF39D991CB44

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140046690, Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

RtlCreateHeap.NTDLL ref: 00000001400466DD

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 21b05e3ef22cad88cebd019d8e45e363c17e6ba0707ecabdd33f955b9f4b15ed
Instruction ID: 54976bf3431427af6da968cf6b263ec8d4a99ac7c2bea2f2fd5649cd882baac1
Opcode Fuzzy Hash: 21b05e3ef22cad88cebd019d8e45e363c17e6ba0707ecabdd33f955b9f4b15ed
Instruction Fuzzy Hash: B901D635706A8082EB528712FA4039A73A0F78C3C4F198524EF884B7A5EF38C8518B44

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140046730, Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

RtlDeleteBoundaryDescriptor.NTDLL ref: 000000014004678C

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: BoundaryDeleteDescriptor
String ID:
API String ID: 3203483114-0
Opcode ID: 7b0e43f28c4f526d6edd5220e1ccf75e5ddb2081b4342278c18d43c75b4d1ee9
Instruction ID: 7e2fcedd46cf55f04110c2a11ced308778be976df41b62f125aabd7639a18320
Opcode Fuzzy Hash: 7b0e43f28c4f526d6edd5220e1ccf75e5ddb2081b4342278c18d43c75b4d1ee9
Instruction Fuzzy Hash: 70F0F878A4730141FE6A63B354543A511821FCC7C4F0E8834AF095B7A6EE38CD518699

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0000000140057950, Relevance: 4.5, Strings: 2, Instructions: 1977COMMON

Download Yara Rule

Strings

}*, xrefs: 0000000140057F89
}*, xrefs: 00000001400579C0

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: }*$}*
API String ID: 0-2047341001
Opcode ID: a0a69438047e54f28e9ccb842af0afe3b69bef60083965763f3b059d71ba89a0
Instruction ID: 7c281f25cbc51a2c663274e483e0a5d4adc9f9b548fde4e06667abda5a9e2262
Opcode Fuzzy Hash: a0a69438047e54f28e9ccb842af0afe3b69bef60083965763f3b059d71ba89a0
Instruction Fuzzy Hash: 6E03CB72201B8482EB26CF23D4543ED67A1F78DBC4F994416EF4A177A6EB3AC945C380

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400263C0, Relevance: 4.3, Strings: 3, Instructions: 519COMMON

Download Yara Rule

Strings

)8GV, xrefs: 0000000140026A4D
)8GV, xrefs: 00000001400267B0
@, xrefs: 0000000140026B3F

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: )8GV$)8GV$@
API String ID: 0-2802744955
Opcode ID: a3e8ee5ab549556569e9006b525bd9d1ac3761a68850dd604f4cfbeaa6d7384c
Instruction ID: d4403fa2ef2757ed15b0d897a8d3d48ae9d82dee7601a7ae60b507309942f45e
Opcode Fuzzy Hash: a3e8ee5ab549556569e9006b525bd9d1ac3761a68850dd604f4cfbeaa6d7384c
Instruction Fuzzy Hash: 8F326E72610A8095FB22EB72D8513EE6365FB997C8F940026BB4E476FADF34CA05C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002FB20, Relevance: 2.7, Strings: 2, Instructions: 200COMMON

Download Yara Rule

Strings

cLpS, xrefs: 000000014002FB46
cLpS, xrefs: 000000014002FB76

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: cLpS$cLpS
API String ID: 0-581437482
Opcode ID: 34fd53aa0ebdbc9f7987fe69826bd589cd4ce70c6830deca293095981677af5c
Instruction ID: d6b56411a1e340b191dd7f08d0c8a8920ca136b0ade9766ce73097337fe28e3c
Opcode Fuzzy Hash: 34fd53aa0ebdbc9f7987fe69826bd589cd4ce70c6830deca293095981677af5c
Instruction Fuzzy Hash: F5916E32700A41A6FB12EB72D5513ED2366AB983D8F900126BF1D97AFADF34D919D340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140039140, Relevance: 2.1, Strings: 1, Instructions: 866COMMON

Download Yara Rule

Strings

D, xrefs: 0000000140039B2B

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: D
API String ID: 0-2746444292
Opcode ID: 0452af0be93170f0712028ec6d1a4f1ed763d309de66f3c97f53239ecee0938c
Instruction ID: a2166a60d7ca2b4a0d1872d5e3506bb785f107662951e93f9f6f62b20c08bf0e
Opcode Fuzzy Hash: 0452af0be93170f0712028ec6d1a4f1ed763d309de66f3c97f53239ecee0938c
Instruction Fuzzy Hash: 32827E3222468186EB13EB26D4907EF6365FBD8794F904612FB5A47AFADF38C605C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140015120, Relevance: 2.1, APIs: 1, Instructions: 555COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32 ref: 000000014001530B

Part of subcall function 0000000140046C90: NtClose.NTDLL ref: 0000000140046CBE

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseEnvironmentExpandStrings
String ID:
API String ID: 1839112984-0
Opcode ID: 0c8cab0b1b935b3a37cb31b96907ffd9b34d960d626d1d55b93d79ad55693549
Instruction ID: c0dbe0ee55e83fb6c0f3bef3624a57e5635b4c6ed11a4d6c977be8f15ec7e338
Opcode Fuzzy Hash: 0c8cab0b1b935b3a37cb31b96907ffd9b34d960d626d1d55b93d79ad55693549
Instruction Fuzzy Hash: CB427E32710A4096FB12EB72D4913EE6765EB983D8F814422BB4D4BAFAEF34C645C750

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400139D0, Relevance: 1.8, Strings: 1, Instructions: 571COMMON

Download Yara Rule

Strings

m, xrefs: 000000014001422E

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateMutex
String ID: m
API String ID: 1964310414-3775001192
Opcode ID: 079af9642e33be8b1418e23995d0953d3028e11a16e9caecd14c6a2ac72b7534
Instruction ID: 0a9d90af75a6ede7406656d6adb6787827cf479cbe6b14872f7c626c13ea0b6d
Opcode Fuzzy Hash: 079af9642e33be8b1418e23995d0953d3028e11a16e9caecd14c6a2ac72b7534
Instruction Fuzzy Hash: 6A529B32710A80A6F74EEB32C5913EE7369F788384F904026AB2947AE6DF34D576C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014001D100, Relevance: 1.7, Strings: 1, Instructions: 497COMMON

Download Yara Rule

Strings

s( j, xrefs: 000000014001D128

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: s( j
API String ID: 0-1450404818
Opcode ID: 19985d2dc72a707ec5f83c91129fc97538500d80b5f4466283615156a38f1139
Instruction ID: 6f5b3d0b06e06ce3defbe5b62ba999e8dce43b7996f1ec96da6707378b1ebcba
Opcode Fuzzy Hash: 19985d2dc72a707ec5f83c91129fc97538500d80b5f4466283615156a38f1139
Instruction Fuzzy Hash: 14325632715B9085EB16EF66D8513ED73A5FB88B88F454026EB4E5BBAADF38C505C300

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140033BB0, Relevance: 1.7, Strings: 1, Instructions: 454COMMON

Download Yara Rule

Strings

U, xrefs: 000000014003408F

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: U
API String ID: 0-3372436214
Opcode ID: 1612c2b18446cb3e650eba47dd8b229cab4fb8fae804e2c9001081e94953d27d
Instruction ID: 04dcf981b535b3d5a04f4e0f983876b723d65533687fb2a3abc72c4897885b35
Opcode Fuzzy Hash: 1612c2b18446cb3e650eba47dd8b229cab4fb8fae804e2c9001081e94953d27d
Instruction Fuzzy Hash: 7A22A032714A8095FB22EB76D4913EE2761EB993D4F900122BB4E5BAFADF38C545C710

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400389A0, Relevance: 1.6, Strings: 1, Instructions: 322COMMON

Download Yara Rule

Strings

0, xrefs: 0000000140038A46

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Close
String ID: 0
API String ID: 3535843008-4108050209
Opcode ID: 7016f170174e11ab425f8740a2873dc54fd790cf1ab3d78218ff6c8b86cc580b
Instruction ID: 021d52728ad99ff4b45c00a2ee63d530dbb35c35c3e7b67721d4418a9cae59c0
Opcode Fuzzy Hash: 7016f170174e11ab425f8740a2873dc54fd790cf1ab3d78218ff6c8b86cc580b
Instruction Fuzzy Hash: A4D1483271064185EB22EB66D8503EF6365FB987C8F944421FF4E57AAAEF34CA05C340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140023140, Relevance: 1.4, Strings: 1, Instructions: 195COMMON

Download Yara Rule

Strings

tI*k, xrefs: 0000000140023300

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: tI*k
API String ID: 0-257501792
Opcode ID: b15996fbae463eef0efc9f4e5c4cbf386dde064011b2806a6f0ecd12f6b98297
Instruction ID: 2b3e36108f388e75195695150bf3b7502d87346db4925aa772ee75e92517338c
Opcode Fuzzy Hash: b15996fbae463eef0efc9f4e5c4cbf386dde064011b2806a6f0ecd12f6b98297
Instruction Fuzzy Hash: C891B332710A41C6FB12EB73D4913ED2365AB987C8F815026BF0E67AABDE34C605C391

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004F940, Relevance: .9, Instructions: 873COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb12e34294cccc152743157d68ecf537d73dadfb1b78744b1cf0542ab0e03321
Instruction ID: fc2f62d5942ef41123ea32f2955be4f6aadf7052ab01c2248917173129c7cd0f
Opcode Fuzzy Hash: cb12e34294cccc152743157d68ecf537d73dadfb1b78744b1cf0542ab0e03321
Instruction Fuzzy Hash: 8A82BD72301B8486EB269F23D4503EE67A5F78DFC4F964022EB4A577A6DB38C945C384

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140054BA0, Relevance: .8, Instructions: 797COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b6290f3f4936625c1500c9bb5ab49f73b0f0e92f6783c0cfd327242af27f29f
Instruction ID: 8249503d4e55669e8e7119aec1729776b7b2f3ca46fae70a891a003f6664f3d4
Opcode Fuzzy Hash: 0b6290f3f4936625c1500c9bb5ab49f73b0f0e92f6783c0cfd327242af27f29f
Instruction Fuzzy Hash: 3472DF32201B9486EB26DB17E4603ED77A5FB9DBC5F894012EB4A477B6DB3AC941C340

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004EB60, Relevance: .7, Instructions: 687COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbf02e0b346a645ce41284f4b25ae6de0e0561089bc0c4212f6de5587c4ccb21
Instruction ID: d53d10191d1a85c044aba7f3ec212ac92ce5176a248edb2932ce54add84afe44
Opcode Fuzzy Hash: bbf02e0b346a645ce41284f4b25ae6de0e0561089bc0c4212f6de5587c4ccb21
Instruction Fuzzy Hash: 9D52BE72601B8081EB269F23D4543EE77A1F78CBC4F8A5426EB4A577B6DB38D845C348

Uniqueness

Uniqueness Score: -1.00%

Function 000000014003B220, Relevance: .6, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c541702096c1ae675d9f8552b841f1df762d73269a6d039e8a3e529e919bb3f5
Instruction ID: acd1ff4a64a9c803ec812a22a8ce79600e1464d52fdb42fb628072365476121f
Opcode Fuzzy Hash: c541702096c1ae675d9f8552b841f1df762d73269a6d039e8a3e529e919bb3f5
Instruction Fuzzy Hash: 64429E31301A8141FA23EB6698513EF6391EB8C7E8F544616BF5A5BBEAEE38C505C340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140024440, Relevance: .6, Instructions: 566COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc2a6e3d2e1231b3fe707f0d0f35a30ce2f56e53bfff03d4db06bbddff5caabd
Instruction ID: 78f3400fd7e206f6a511ea736ed45412fb3e7259efd4ed926287f6c9bd4c6aa7
Opcode Fuzzy Hash: fc2a6e3d2e1231b3fe707f0d0f35a30ce2f56e53bfff03d4db06bbddff5caabd
Instruction Fuzzy Hash: E6427C32204A8096EB66EB32D0513EE67A4E79D3C8F914026F79A876F7DF38C945C741

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140023BF0, Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 060d71c651ab3aed04444553114f4ea5a7531cc3ca58c37faf4133b09f387ec2
Instruction ID: 183f2e46b23aa86a2c091461a645f9a581571388db0d92becfc597eb429af356
Opcode Fuzzy Hash: 060d71c651ab3aed04444553114f4ea5a7531cc3ca58c37faf4133b09f387ec2
Instruction Fuzzy Hash: 0732AB3271064089EB16EB36D4513EE27A5EB8CBD8F555126FF0E877BADE38C4868340

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400123C0, Relevance: .5, Instructions: 544COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baf04223ec18bb60842fe7fa632ea836e81c8b6d6b17b3371276cc931bd38ff2
Instruction ID: 71edd40f2b1ab928f6f3b4ddf8d26af45cb7d1258c95c78617a62a1a74f3288a
Opcode Fuzzy Hash: baf04223ec18bb60842fe7fa632ea836e81c8b6d6b17b3371276cc931bd38ff2
Instruction Fuzzy Hash: BF32AC3261068195EB12EB26D4913EE2765FB983C8F814122FB4E57AFBEF38C645C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000B120, Relevance: .5, Instructions: 531COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8328b10af82aab1ef65ff433d7820bced4cba86e0066b221c3c838f9fd1e431
Instruction ID: 3ba19fba285517c5acd5c21b3c9b7592edaf423ca2de06bba8230fcf7af2400b
Opcode Fuzzy Hash: e8328b10af82aab1ef65ff433d7820bced4cba86e0066b221c3c838f9fd1e431
Instruction Fuzzy Hash: 3C429B72624A8095FB12EB62D4957EE2365FB983C8F814022FB0D57ABBDF34C649C750

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400381A0, Relevance: .5, Instructions: 525COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ee38f4c6dee734349d5b0dcc202e437ae908f573234f4aff5f510a5883c84b0
Instruction ID: eb795f204498a8d956ef0de19ff8bd43d97085c04d8ed5933d3115b51340510f
Opcode Fuzzy Hash: 7ee38f4c6dee734349d5b0dcc202e437ae908f573234f4aff5f510a5883c84b0
Instruction Fuzzy Hash: 7022793270064186EA23EB2AD4957EF63A5EB88BD4F554626FF0A477F6EE34C506C340

Uniqueness

Uniqueness Score: -1.00%

Function 000000014003A2E0, Relevance: .5, Instructions: 521COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e8d1907d2a62ce1ae108db488a351868ceb64fffc9dd42578434a0f34ae656a
Instruction ID: 697e8bd1027fccc09012cb901671f32632dfdae7722e2c733c5167ca59ce0a7a
Opcode Fuzzy Hash: 1e8d1907d2a62ce1ae108db488a351868ceb64fffc9dd42578434a0f34ae656a
Instruction Fuzzy Hash: AE227C3271064186EA23EB26D4513EF63A1FB89BD4F544625EB4A577F6EF38C50AC340

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006B390, Relevance: .5, Instructions: 458COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71b3dc1032e7b852d429d3288fc6d56ff3ef19d98c02d1d103b4f123b92fc1f1
Instruction ID: 5c003effdee5129b35cf12aebe167f862a01b0c8d0d2f43ab9f1123e32a30f31
Opcode Fuzzy Hash: 71b3dc1032e7b852d429d3288fc6d56ff3ef19d98c02d1d103b4f123b92fc1f1
Instruction Fuzzy Hash: 8C0203B21082A489F7768B26C9413FA7BE2E759788F254906FB8A435F5D738C9C1D720

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140005C40, Relevance: .4, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f513173c25ae17789a403cea68c9e18d94625c6d02a52581dcb230289bad16b3
Instruction ID: 217fabc6e38e1d640ccd999207fddb20e056db183073941d35cbdb4b11e649c3
Opcode Fuzzy Hash: f513173c25ae17789a403cea68c9e18d94625c6d02a52581dcb230289bad16b3
Instruction Fuzzy Hash: 10229B72620A8091EB12EB62E4957EE2365F79D7C4F814022FB4E576BBDF38C609C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140067A40, Relevance: .4, Instructions: 440COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ed167cb2d41bf65051b1e1e6ca4fc372791feb4efe79826a7b7afb1d034e643
Instruction ID: 3448a1cfdf5732c1482eebf940cb1862e5db89764351cf67f11e8459266109f6
Opcode Fuzzy Hash: 6ed167cb2d41bf65051b1e1e6ca4fc372791feb4efe79826a7b7afb1d034e643
Instruction Fuzzy Hash: CD026C727006418AEB12DF26D4907EE73A6F788BC4F614525EB0E977AADF34D90AC740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000BB40, Relevance: .4, Instructions: 438COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8296aae514971c10519780c04e533f569930ad849b100b0340065f0f39cb86db
Instruction ID: a963730c34943060851cd64ea719675db259de8104656558a9074d2de6a51302
Opcode Fuzzy Hash: 8296aae514971c10519780c04e533f569930ad849b100b0340065f0f39cb86db
Instruction Fuzzy Hash: 41128F7222468096FB52EB22D4917EE6765FBD93C8F811022FB4E57AABDF38C505C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140069010, Relevance: .4, Instructions: 431COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$ClosePointerRead
String ID:
API String ID: 2610616218-0
Opcode ID: 95963d20b21cf3e2b12cfe18c6fe82eaabeff9446a80277d54ce9a7fffb05132
Instruction ID: 5afa6d75f76fbbc9d7f53df6043056336d1db5d7591574d5123318d553f9c856
Opcode Fuzzy Hash: 95963d20b21cf3e2b12cfe18c6fe82eaabeff9446a80277d54ce9a7fffb05132
Instruction Fuzzy Hash: 19124E3272469096EB12EF72D8913DE6765FB987C8F815022BB0D57AABDF34C605C710

Uniqueness

Uniqueness Score: -1.00%

Function 000000014001E170, Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: 9b801c6cfe21829965e01690717934929f301b57ebd9e24914ab7e4ccc7a8bd8
Instruction ID: ac8bef764291a5126b18a53dad73757551fec454a5992e6944e07fe4b855ac86
Opcode Fuzzy Hash: 9b801c6cfe21829965e01690717934929f301b57ebd9e24914ab7e4ccc7a8bd8
Instruction Fuzzy Hash: 2A023B32724A80A2FB52EB72D4913EE6764FB983C4F815022BB4D57AEADF35C545C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140002980, Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: 8eff327b3244b5e4bcb204ecf2616417784072c62e8997917ef3bb952dc9c563
Instruction ID: 5d574d698b33f004de0812fa71b34c36bbdae31478704d480fb686f148b39898
Opcode Fuzzy Hash: 8eff327b3244b5e4bcb204ecf2616417784072c62e8997917ef3bb952dc9c563
Instruction Fuzzy Hash: EB024C72324A8096FB12EB62D4913EE6765EB983D4FC15022BB4E57AEBDF34C605C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140010880, Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d8f91d721c478637f80766b80e37fef242b82150883bd374cc6845ff3be0a72
Instruction ID: f0fb79f68922493fed5bc905321703954c20a875d362dace52344ff7232635a8
Opcode Fuzzy Hash: 8d8f91d721c478637f80766b80e37fef242b82150883bd374cc6845ff3be0a72
Instruction Fuzzy Hash: D7029272320AA19AEB42DF36C8917EE2724F748789F805016FF4B57AAAEF35C545C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014001D910, Relevance: .4, Instructions: 369COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$ClosePointerRead
String ID:
API String ID: 2610616218-0
Opcode ID: 05ee41dc75372f3184bd1bd526553eb93c41a596f4ef0b14bf7d6c74ff3eb6f4
Instruction ID: 9c3e8f75c9e591130820bb2956cb3806339feb13e112d9af22726fcddd3bd126
Opcode Fuzzy Hash: 05ee41dc75372f3184bd1bd526553eb93c41a596f4ef0b14bf7d6c74ff3eb6f4
Instruction Fuzzy Hash: 12026C32314A8095FB52EB72D4917EE2765EB983C4F805022BB4E97AEBDF35C649C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140017B40, Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adb9de39e3049ab5455ed32541b517d82ebf0524dcb0a324d3a012e30b74715a
Instruction ID: fccd9241a873054b7c24d42fb58abb6f012b2f7f19fe3a4c061a127f88627f2a
Opcode Fuzzy Hash: adb9de39e3049ab5455ed32541b517d82ebf0524dcb0a324d3a012e30b74715a
Instruction Fuzzy Hash: 41E18E3271068095FB12EB76D8917EE6765EB983C8F804021BB0D5BAEBEF35C645C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002CB80, Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b6f1b094effc9f245018c12fb0bd54aed54c11f9143a05f6df0da17f49fd19b
Instruction ID: 02ee9b89192d395c78975687d30e6fb06be8b995001c736011e159ca0d17724c
Opcode Fuzzy Hash: 9b6f1b094effc9f245018c12fb0bd54aed54c11f9143a05f6df0da17f49fd19b
Instruction Fuzzy Hash: E2E13D32714A4095EB02EB66D4913EE6765FB983D8F900012FB4D97AFAEF34CA49C750

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400018D0, Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b36c55cc0c64182b75bd054714d27820267f0f2f65f1b0bf4452dbf409dd159
Instruction ID: 95da75048f27146dafc5de9d612871b80806eb61125b8034b1f63b71f4cba504
Opcode Fuzzy Hash: 4b36c55cc0c64182b75bd054714d27820267f0f2f65f1b0bf4452dbf409dd159
Instruction Fuzzy Hash: 47F12C3262498096EB12EB62D8513ED6365FBD8388F814522BB4E479FBEF74CA05C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014003AAC0, Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e7780c785dee08e0bb9155763342d8440fe36315939b45b58d1687e3de4f63a
Instruction ID: cf5fdc312f2229dc6ff813412d90ddbabd12b8e4de7574aebc9877f7d05b411a
Opcode Fuzzy Hash: 9e7780c785dee08e0bb9155763342d8440fe36315939b45b58d1687e3de4f63a
Instruction Fuzzy Hash: 28D19032711A4195EB12EB76D4903EE23A1EB993C4F844425BF4E57BEAEF38C605C350

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140064080, Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16253b5d55ff71ace7e49d720cc951c571e11621ee8e21fa8c6a30ce5dfdcbdc
Instruction ID: bf23390ce128f79092fde7b2b9043ef6653a4f1b38eae35900255c6e9c132ad5
Opcode Fuzzy Hash: 16253b5d55ff71ace7e49d720cc951c571e11621ee8e21fa8c6a30ce5dfdcbdc
Instruction Fuzzy Hash: ABC1D4231282D04BD7569B3764503FAAE91E79A3C8F280655FFC997AEBD63CC2149B10

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002D0D0, Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f12721fbfba6283dc7958c84227ce6bb15a7590cb07e0c84499cdb4845d6b172
Instruction ID: d0d512be425b72175eef7d799d9923e381f6a995b1e0446f0295c878f1c0c086
Opcode Fuzzy Hash: f12721fbfba6283dc7958c84227ce6bb15a7590cb07e0c84499cdb4845d6b172
Instruction Fuzzy Hash: CED13972724A4091EB02EB76D4913EE6765F7983C8F904016BB4D97ABAEF38C605C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002A110, Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 8317b6107b79d8746eb836802ab66d92c4c2213a6f1849c4bee5ec7b69d23b54
Instruction ID: 08807915bc927436db1a901aa043915a979950c5e23cf508b5f0d65b77d78aa9
Opcode Fuzzy Hash: 8317b6107b79d8746eb836802ab66d92c4c2213a6f1849c4bee5ec7b69d23b54
Instruction Fuzzy Hash: 0CD17032614A8096EB02EB26D4513EE6364FBD97C4F815122FB4D57AEBDF38CA05C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140062B00, Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcfd4a30f1a27aef1054c36b1d99c0610af0cc08103e55e4b01f0e7caa7c836f
Instruction ID: f23c3879964f3f83b961310f1bad7f7be1ef7afa2b68ec7d59790f469601a501
Opcode Fuzzy Hash: bcfd4a30f1a27aef1054c36b1d99c0610af0cc08103e55e4b01f0e7caa7c836f
Instruction Fuzzy Hash: A9A10231211E8145EBA79A2798543EF27A6AB8C3D4F645825FF0E5B6E9EF34C901C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006B41B, Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16274a22d167cb7459d5025cfc47ed7afc639167fa2c9c1057ca1fd72c03709f
Instruction ID: c0d98bc7e162404dc537a7c1af49e5fbe25e03b535df8b2493956c53732576b9
Opcode Fuzzy Hash: 16274a22d167cb7459d5025cfc47ed7afc639167fa2c9c1057ca1fd72c03709f
Instruction Fuzzy Hash: B2A114F31182A486FB778A2685413FA7FE2E719789F254402FB8A435F6C63CC985D720

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140066020, Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39a77b3ded0776d671925a3aad9e7cc492f01908de9f9e7db45f2ad695b1e2ca
Instruction ID: d17e179c4ad3c1814a715198efb3da372d22ab0628f3c9d9f6a3a053a6971865
Opcode Fuzzy Hash: 39a77b3ded0776d671925a3aad9e7cc492f01908de9f9e7db45f2ad695b1e2ca
Instruction Fuzzy Hash: 79A1903271164045EB22EB7298507EE67E6AB9C3C8F550925BF4D47BEAEF34CA068310

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140007A60, Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bb3ae0ca8b09634f6b3eb7f35d10a75bd1e51e3d218a5b4533eb8f41dc86bd2
Instruction ID: 7cb660c1bafc6db3c15f0a4866a94b05aa7759728bb06ab0739d07cd917ce7e2
Opcode Fuzzy Hash: 8bb3ae0ca8b09634f6b3eb7f35d10a75bd1e51e3d218a5b4533eb8f41dc86bd2
Instruction Fuzzy Hash: 33B18C7262464191EB12EB62E4913EE6365FB9C7C4F801022FB4E47ABBDF38C649C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006B43D, Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc8327572ae460ec67bee7642bc1df1dfc8e00bf19c98c3d2f0bb37742338d2b
Instruction ID: ff1b56ecf022c2229069a5389c0477a62f006b84fd5f9f69eebb894724ab9066
Opcode Fuzzy Hash: dc8327572ae460ec67bee7642bc1df1dfc8e00bf19c98c3d2f0bb37742338d2b
Instruction Fuzzy Hash: 44A125F21182A489FB778A2685413FA7FE2E719789F254402FB8A435F6C23CC985D720

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006B424, Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92fc6e297697f72d3d55b197ac04fe50775a4f95a26f4c9e919e5e137ab98750
Instruction ID: f965aa676d2cc64f6a485257af634002c7fef1377d4791c8bed9b1b7e56d6411
Opcode Fuzzy Hash: 92fc6e297697f72d3d55b197ac04fe50775a4f95a26f4c9e919e5e137ab98750
Instruction Fuzzy Hash: 79A115F31182A489FB778A2685413FA7FE2E719789F254402FB8A435F6C23CC985D720

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006B42D, Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e075c1df208aa39fb877a834bfc4403f559291216783e55fb63477ae2eadfdc
Instruction ID: 86c182e730ead1fa639f737d8458d4edb1cdee6041daaa12aedc2aef895c7c0c
Opcode Fuzzy Hash: 1e075c1df208aa39fb877a834bfc4403f559291216783e55fb63477ae2eadfdc
Instruction Fuzzy Hash: 83A115F31182A489FB778A2685413FA7FE2E719789F254402FB8A435F6C23CC985D720

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006B436, Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b68406ce4345875cbc0110dbe212228596ffa7fd34d07f9d141f7f6a9cf54bfa
Instruction ID: 7a8579acbe1e06e5dcc528155c10978c06d1d02f61772b3afab02cdca005db6d
Opcode Fuzzy Hash: b68406ce4345875cbc0110dbe212228596ffa7fd34d07f9d141f7f6a9cf54bfa
Instruction Fuzzy Hash: 3EA115F31182A489FB778A2685413FA7FE2E719789F254402FB8A435F6C23CC985D720

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006B446, Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20a2fa5d4e375044cfc16d96b5b502da69406d12098659286745a9d4aecf6a6c
Instruction ID: 9b5f4d2890da7bc9148b0c777fb781a5a0913674a9f0c1f21bc34f13756e8484
Opcode Fuzzy Hash: 20a2fa5d4e375044cfc16d96b5b502da69406d12098659286745a9d4aecf6a6c
Instruction Fuzzy Hash: 37A114F31182A489FB778A2685413FA7FE2E719789F254402FB8A475F6C23CC985D720

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140069A50, Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 847c53cd22c21084d67cb822d3c8f80ec4024bd4884789ed31c06eb0f484aec6
Instruction ID: 9e8436de532ad8a8b9d83a7ce7f67d33a1e65f1b543d517c902b78be038a8119
Opcode Fuzzy Hash: 847c53cd22c21084d67cb822d3c8f80ec4024bd4884789ed31c06eb0f484aec6
Instruction Fuzzy Hash: 6FA19F3271464095EB22EB72D4913EE63A5A78C7C8F914426FF0D57AFAEE38C609C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001010, Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b042d90c0f8c1feaf42d72467fc8ea1d5898c5b9afd74594c11dc23e78b13021
Instruction ID: 891caef274385c1d9a1a05b5f8e139ad0eea2bdcde326525a3acf11d5ee056db
Opcode Fuzzy Hash: b042d90c0f8c1feaf42d72467fc8ea1d5898c5b9afd74594c11dc23e78b13021
Instruction Fuzzy Hash: 79918D7270164095EB16EF66E4507EE23A5ABDC7C4F448425BF4E97BA6EE34C906C340

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002EA00, Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbe13e77ec2a6c39a7eeb857abf77be5bd43dd3bfff72b646a5cfb36ea006c22
Instruction ID: 09ec91f3f7d35e473cfa3e72b303784d96220d522314983c3d838af10b8059fe
Opcode Fuzzy Hash: dbe13e77ec2a6c39a7eeb857abf77be5bd43dd3bfff72b646a5cfb36ea006c22
Instruction Fuzzy Hash: C4A16E32314A8095FB22EB72D8513EE2365EB987D4F940426BB4D57AFADF34CA05C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140018300, Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce67bfafa3a41e60d72f08d4a165a2184096e63d57257d43e1b540ba17e5e704
Instruction ID: 9282ef7f3f2e177ec3162a27807bc3d77d508fe5c2bed51c5ff564ba7b898efa
Opcode Fuzzy Hash: ce67bfafa3a41e60d72f08d4a165a2184096e63d57257d43e1b540ba17e5e704
Instruction Fuzzy Hash: 99912232B15A4099FB12EBB2D4913ED23659B9C7C8F814525BF0DA76EBEE34C609C350

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002E1B0, Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: e13badc4eecd54d72134e33fa3c908df50463b4c7afbc823f6efb99f8860a50f
Instruction ID: a01e236db0e61280ae7bc249da652572acbbc64743681568c883ee8cb5c556df
Opcode Fuzzy Hash: e13badc4eecd54d72134e33fa3c908df50463b4c7afbc823f6efb99f8860a50f
Instruction Fuzzy Hash: D7916C3272468092FB12EB62D4957DE6365FB9C7C4F811022BB4D43AABDF78C544CB10

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140016100, Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e54b42b1a183fcc3e26b712d0c98e0febe665e521d345cd27406ffce54824ba
Instruction ID: 4362bffb4ce140633d60009826b42a117c21897de7dbf4a94b418fc321f1d931
Opcode Fuzzy Hash: 0e54b42b1a183fcc3e26b712d0c98e0febe665e521d345cd27406ffce54824ba
Instruction Fuzzy Hash: 35812032714A809AFB12EB72D4513ED2365EB9C388F814425BB4E67AEBEF35C605C354

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400663F0, Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53d7b3c9e63ec17fbb3decf34851c1318d937a82485f1e960baa699eab580419
Instruction ID: 4c1290556f20f3e20b66d81894b0d385f6ea8bc2319cc982c81cb2944955426d
Opcode Fuzzy Hash: 53d7b3c9e63ec17fbb3decf34851c1318d937a82485f1e960baa699eab580419
Instruction Fuzzy Hash: 6E61B031301A4041EA66E737A9517EF97929F9D7D0FA44621BF5E877FAEE38C9028700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005D850, Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17ec1b3edf0780c5c25e1336ba948ef3e7aec6e0b63b2610df3acb1851feab05
Instruction ID: 50d9e92313d7fbe24902196c924c1612cff9653e99501bbf2772a847790ebefc
Opcode Fuzzy Hash: 17ec1b3edf0780c5c25e1336ba948ef3e7aec6e0b63b2610df3acb1851feab05
Instruction Fuzzy Hash: 7D618D3271464496FB22EB72C0913EE23A5ABDC7C8F854422BF4D57AEAEE35C501C791

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400319F0, Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: ac7f08871eadb0e88aebf12c8c96c3d08f64978839d47a5fff32e650f5283656
Instruction ID: f33abad4c1c8ba015261be05896130ca5dc3e7c07ce7e813c180037223ea8262
Opcode Fuzzy Hash: ac7f08871eadb0e88aebf12c8c96c3d08f64978839d47a5fff32e650f5283656
Instruction Fuzzy Hash: 08718E32714A809AEB12EF76D4913EE7761F798388F844026FB4D47AAADF74C548CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400688A0, Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$ClosePointerRead
String ID:
API String ID: 2610616218-0
Opcode ID: c6b0428fc7416c9690bb78137e55356240e86da8257680fa94455239788aca03
Instruction ID: 125c4d10a522e701d1fb6d0f1aef761f583aa31ccbb75f1db25899523a723602
Opcode Fuzzy Hash: c6b0428fc7416c9690bb78137e55356240e86da8257680fa94455239788aca03
Instruction Fuzzy Hash: 0151633271468052FB22EBB6E4513EE6761EBD83C4F951122BB4D47AEADE38C544CB01

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140031340, Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f431bbfb257fb34b4f249f0b6c1a5781a1840d33aa954166e75b638a15f3be8f
Instruction ID: 50cb9f747c07e87171e39f534f7bbd71060f83f950b2ada1a46c15cbddfc577a
Opcode Fuzzy Hash: f431bbfb257fb34b4f249f0b6c1a5781a1840d33aa954166e75b638a15f3be8f
Instruction Fuzzy Hash: A0511B32700A4096FB12EB76D4917EE2365AB9C7C8F954421BF0DA7AEADF34C605C350

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002F840, Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1a38846fc5b12dd28166e38272f044d4b391af603d2f1471411a8db1635f5ab
Instruction ID: 9602d307e9de31d357e639a9611a18ab9b6f2b9e1d5f0c6a8a00986c6f50d329
Opcode Fuzzy Hash: e1a38846fc5b12dd28166e38272f044d4b391af603d2f1471411a8db1635f5ab
Instruction Fuzzy Hash: 7F51AD32200A40A2EA22EB22D9957FE63A5F7DC7D0F854626FB0D836B6DF34C556D710

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400611A0, Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8619ee3f9ccd1f320a5fbfbf5c9367aa5b7df2049cee1b1ea35a7e4b7e812f95
Instruction ID: fec891e6c53086f7b9094a78f95b73510c7007b912bc3ef8a41aa8e11e9acb14
Opcode Fuzzy Hash: 8619ee3f9ccd1f320a5fbfbf5c9367aa5b7df2049cee1b1ea35a7e4b7e812f95
Instruction Fuzzy Hash: 01413D31B2066095FB12EB7798513EE13A6ABDC7C4F994421BF0E97AEADE38C5058314

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140022A00, Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a10d479a193238a188e8adb5c0a2baa624421bbad2986b298b06f84ca2b66ec
Instruction ID: 4d6ce7f696a26fe9a74b6bb9734e6d6bbac3d85ccec2ef1c97bdec5ab73240ea
Opcode Fuzzy Hash: 9a10d479a193238a188e8adb5c0a2baa624421bbad2986b298b06f84ca2b66ec
Instruction Fuzzy Hash: FC51D732610B9085E785DF36E4813DD33A9F748F88F58413AAB8D4B7AADF348152C764

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140022340, Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d0bc628afaa724f2a407568f7776cab89400c990b0d91b82c0bf42df1747497
Instruction ID: 1e1e8128ca37617077ad8d3bddb138d765a5f71e348f586f351b06e9a9582713
Opcode Fuzzy Hash: 8d0bc628afaa724f2a407568f7776cab89400c990b0d91b82c0bf42df1747497
Instruction Fuzzy Hash: 5C51C773611B9085E745DF36E8813DD37A8F748F88F58413AEB894B6AADF308156C760

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140063BD0, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a990b53e0665ad0886faa979631976ec8b00dc7985899795eb44eacb3e5b3434
Instruction ID: 5f416d68214368cc8d497caad67b5ad9eebcd67f96a0df70edf52f54e079c757
Opcode Fuzzy Hash: a990b53e0665ad0886faa979631976ec8b00dc7985899795eb44eacb3e5b3434
Instruction Fuzzy Hash: DE31F53221099842FBA6471B9C613F93292E79C3E4F649625FB8E537F4D67DC8038B80

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140005370, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000001.00000002.372311662.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373145826.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.373212566.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.373226686.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bce42950a1e8a62078921d64ca997753bf7c09f413ca20ce6f360246a445e94
Instruction ID: 604a730c127844f2816d2636316060c5dd02da03d6f4240a24423d76594c64fe
Opcode Fuzzy Hash: 5bce42950a1e8a62078921d64ca997753bf7c09f413ca20ce6f360246a445e94
Instruction Fuzzy Hash: 55313F32610B9091E749DB36D9813DD73A9F78CB84FA58526A39847AA6DF35C177C300

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 1380 Parent PID: 1400 rundll32.exeCOMMON

Executed Functions

Function 000001D6712B2252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 000001D6712B23B0
VirtualProtect.KERNELBASE ref: 000001D6712B2471
RtlAvlRemoveNode.NTDLL ref: 000001D6712B25B4
VirtualProtect.KERNELBASE ref: 000001D6712B2677

Memory Dump Source

Source File: 00000003.00000002.338608177.000001D6712B0000.00000040.00000001.sdmp, Offset: 000001D6712B0000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: 48c285d824df1bdac5d3e29350226225017b16e7a4ac62e50ec52d0f2c84b976
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: FBB14376619BC886D770CB1AF440BDAB7A1F7C9B84F108126EE8957B58DB7DC8818F40

Uniqueness

Uniqueness Score: -1.00%

Function 000001D6712B2057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,000001D6712B29A8), ref: 000001D6712B20A7

Memory Dump Source

Source File: 00000003.00000002.338608177.000001D6712B0000.00000040.00000001.sdmp, Offset: 000001D6712B0000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: b6aa5678e34de45aeb6c1bb7c8c595c4cf7a0ed16a9b70644bd480cd78c36d27
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: 83312772715B84C6D790DB1AE45479A7BA1F389BC4F205126EF8D87B18DB3AC4828B00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 2752 Parent PID: 1232 rundll32.exeCOMMON

Executed Functions

Function 000001D967812252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 000001D9678123B0
VirtualProtect.KERNELBASE ref: 000001D967812471
RtlAvlRemoveNode.NTDLL ref: 000001D9678125B4
VirtualProtect.KERNELBASE ref: 000001D967812677

Memory Dump Source

Source File: 00000004.00000002.246318423.000001D967810000.00000040.00000001.sdmp, Offset: 000001D967810000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: 6e89342557d246e08e75b14b0d04dda0e8f2d3421404115b62aacd7e03debd45
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: 1CB13476618BC586DB70CB1AE4807DEB7A1F7C9B80F108126EE8997B58DB7DC8518F40

Uniqueness

Uniqueness Score: -1.00%

Function 000001D967812057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,000001D9678129A8), ref: 000001D9678120A7

Memory Dump Source

Source File: 00000004.00000002.246318423.000001D967810000.00000040.00000001.sdmp, Offset: 000001D967810000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: 7741fa739fa826a876c9a3c2144eb296a2fa7f20985803d3428de861fa822835
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: 56312B72615B9086DB90DF1AE49479A7BA1F389BD4F205026EF8D87B18DF3AC446CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 4576 Parent PID: 1400 rundll32.exeCOMMON

Executed Functions

Function 000002C955862252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 000002C9558623B0
VirtualProtect.KERNELBASE ref: 000002C955862471
RtlAvlRemoveNode.NTDLL ref: 000002C9558625B4
VirtualProtect.KERNELBASE ref: 000002C955862677

Memory Dump Source

Source File: 00000007.00000002.253144537.000002C955860000.00000040.00000001.sdmp, Offset: 000002C955860000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: 38723c358d95f104b79680ecb8da9c138cd94ba32ef60b5553c10b3e6abf5fce
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: 85B15576618BC486E770CB1AF444B9EB7A1F7D9B80F508026EF8953B59DB79C8818F40

Uniqueness

Uniqueness Score: -1.00%

Function 000002C955862057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,000002C9558629A8), ref: 000002C9558620A7

Memory Dump Source

Source File: 00000007.00000002.253144537.000002C955860000.00000040.00000001.sdmp, Offset: 000002C955860000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: 98010e4d3bc0d787b9c90bbbd4714dfcf96a699efb34b2c633ba1d20fd4c94ce
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: CA314B72615B8086DB80DF1AF45475A7BA0F389BC4F604026EF8D87B19DF3AC482CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 5340 Parent PID: 1400 rundll32.exeCOMMON

Executed Functions

Function 0000029742052252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00000297420523B0
VirtualProtect.KERNELBASE ref: 0000029742052471
RtlAvlRemoveNode.NTDLL ref: 00000297420525B4
VirtualProtect.KERNELBASE ref: 0000029742052677

Memory Dump Source

Source File: 00000008.00000002.260980939.0000029742050000.00000040.00000001.sdmp, Offset: 0000029742050000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: 6e8cbc743478ce9da3442e5994649cfa510f77043f208043c9c4f55719719b0b
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: D6B15476618BC48AD730CB1AE44079EB7A1F7D9B80F118026EEC957B69DB79C891CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0000029742052057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,00000297420529A8), ref: 00000297420520A7

Memory Dump Source

Source File: 00000008.00000002.260980939.0000029742050000.00000040.00000001.sdmp, Offset: 0000029742050000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: 0278503af45747379f9363e07319492d05ad4c802761f7ac7674216ddaf189ce
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: AA314B72615B8086D780DF1AE45475A7BB0F389BC4F215026EF8D87B28DF3AC482CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 5240 Parent PID: 1400 rundll32.exeCOMMON

Executed Functions

Function 000001BDDBA62252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 000001BDDBA623B0
VirtualProtect.KERNELBASE ref: 000001BDDBA62471
RtlAvlRemoveNode.NTDLL ref: 000001BDDBA625B4
VirtualProtect.KERNELBASE ref: 000001BDDBA62677

Memory Dump Source

Source File: 0000000A.00000002.268783591.000001BDDBA60000.00000040.00000001.sdmp, Offset: 000001BDDBA60000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: 3481b4de6050818cae99368fb484f7698d48aedb637a640c11b95a2f8ab43898
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: 11B145B6618BC48AD770CB5AF4407DAB7A1F7C9B84F108026DEC997B58DB79C8418F44

Uniqueness

Uniqueness Score: -1.00%

Function 000001BDDBA62057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,000001BDDBA629A8), ref: 000001BDDBA620A7

Memory Dump Source

Source File: 0000000A.00000002.268783591.000001BDDBA60000.00000040.00000001.sdmp, Offset: 000001BDDBA60000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: 72314e19af568c38dae526fdd65bb4e92819058fb949be1b73807ea4d1de4992
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: 62314BB6615B8086D780DF1AF45479A7BA0F389BC8F205026EF8D87B58DF3AC442CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 3268 Parent PID: 1400 rundll32.exeCOMMON

Executed Functions

Function 000001BD68012252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 000001BD680123B0
VirtualProtect.KERNELBASE ref: 000001BD68012471
RtlAvlRemoveNode.NTDLL ref: 000001BD680125B4
VirtualProtect.KERNELBASE ref: 000001BD68012677

Memory Dump Source

Source File: 0000000B.00000002.280414700.000001BD68010000.00000040.00000001.sdmp, Offset: 000001BD68010000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: 2b7df8e3bb4b337119048d732324bb5de57b15f5a411907504331a134ed1b040
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: 71B142B6A18BC486D770CB5AF4417DAB7A1F7C9B90F108026EEC957B58DB7AC8418F40

Uniqueness

Uniqueness Score: -1.00%

Function 000001BD68012057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,000001BD680129A8), ref: 000001BD680120A7

Memory Dump Source

Source File: 0000000B.00000002.280414700.000001BD68010000.00000040.00000001.sdmp, Offset: 000001BD68010000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: 5188efcd67cf883662881c1a74f1bfaaeca5dd514618791f98e997801233fce2
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: 74314BB2615B8086D780DF5AF45579A7BA0F389BD4F205026EF8D87B28DF3AC442CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 1748 Parent PID: 1400 rundll32.exeCOMMON

Executed Functions

Function 000001CC358D2252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 000001CC358D23B0
VirtualProtect.KERNELBASE ref: 000001CC358D2471
RtlAvlRemoveNode.NTDLL ref: 000001CC358D25B4
VirtualProtect.KERNELBASE ref: 000001CC358D2677

Memory Dump Source

Source File: 0000000D.00000002.284194357.000001CC358D0000.00000040.00000001.sdmp, Offset: 000001CC358D0000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: b1389dcd41a9c5572447c2d643b5868c4dec12f9c10bd96f9955e22d3cef38a7
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: B0B13276618BC486E7708B1AF440BDEB7A1F7D9B80F108026EE8D57B58DB79C8518F40

Uniqueness

Uniqueness Score: -1.00%

Function 000001CC358D2057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,000001CC358D29A8), ref: 000001CC358D20A7

Memory Dump Source

Source File: 0000000D.00000002.284194357.000001CC358D0000.00000040.00000001.sdmp, Offset: 000001CC358D0000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: c4ad503f94cb4b95ad947099e5bc67373d1368fdcd125d3fbdfe1370eac4684d
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: B9312B72615B9086D790DF1AF45479A7BA0F789BD4F209026EF8D87B18DF3AC446CB40

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 1744 Parent PID: 1400 rundll32.exeCOMMON

Executed Functions

Function 0000019CB47F2252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 0000019CB47F23B0
VirtualProtect.KERNELBASE ref: 0000019CB47F2471
RtlAvlRemoveNode.NTDLL ref: 0000019CB47F25B4
VirtualProtect.KERNELBASE ref: 0000019CB47F2677

Memory Dump Source

Source File: 00000011.00000002.292345279.0000019CB47F0000.00000040.00000001.sdmp, Offset: 0000019CB47F0000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: e46f4c4f8aa581ed80b3ea4312cadeaabf055cd70fdc5e506e783c807992d63d
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: 23B13377618BD486DB708B1AE4507DAB7A1F7C9B80F108126EEC967B58DB79C841CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0000019CB47F2057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,0000019CB47F29A8), ref: 0000019CB47F20A7

Memory Dump Source

Source File: 00000011.00000002.292345279.0000019CB47F0000.00000040.00000001.sdmp, Offset: 0000019CB47F0000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: cf56871d140d0b63b1d7b25fdb6f9ca3e71e6a3f1f2466d2ffc232b044325927
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: C7315E72615B9086D780DF1AE45579A7BA1F389FC4F204026EF8D97B18DF39C446CB40

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 6164 Parent PID: 1400 rundll32.exeCOMMON

Executed Functions

Function 000002C055402252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 000002C0554023B0
VirtualProtect.KERNELBASE ref: 000002C055402471
RtlAvlRemoveNode.NTDLL ref: 000002C0554025B4
VirtualProtect.KERNELBASE ref: 000002C055402677

Memory Dump Source

Source File: 00000016.00000002.299815845.000002C055400000.00000040.00000001.sdmp, Offset: 000002C055400000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: 14f3366468722a3160903bce2971b8096e296f4e39e8a92f9ae0111583f26cc2
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: 92B14676618BC486E770CB5AE480B9EB7A1F7C9B84F508026DF8957B98DB79C8418F40

Uniqueness

Uniqueness Score: -1.00%

Function 000002C055402057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,000002C0554029A8), ref: 000002C0554020A7

Memory Dump Source

Source File: 00000016.00000002.299815845.000002C055400000.00000040.00000001.sdmp, Offset: 000002C055400000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: ebc5a8f34cc65e48eb2dee2cd7cf4f80561c844b3ff4841f882d93d4008988f2
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: 6C312A72615B9086D790DF1AE49475E7BA0F389BD4F605026EF8D87B68DF3AC446CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 6260 Parent PID: 1400 rundll32.exeCOMMON

Executed Functions

Function 000001FF74BA2252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 000001FF74BA23B0
VirtualProtect.KERNELBASE ref: 000001FF74BA2471
RtlAvlRemoveNode.NTDLL ref: 000001FF74BA25B4
VirtualProtect.KERNELBASE ref: 000001FF74BA2677

Memory Dump Source

Source File: 00000018.00000002.307022362.000001FF74BA0000.00000040.00000001.sdmp, Offset: 000001FF74BA0000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: 4c1193495dc50e30ef545298fbd4dd28a87ddc0661e42eb375923c096767bcfe
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: 9BB15776618BC586D770CB1AE440BDEB7A1F7C9B80F10812ADEC957B68DB79C8428F40

Uniqueness

Uniqueness Score: -1.00%

Function 000001FF74BA2057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,000001FF74BA29A8), ref: 000001FF74BA20A7

Memory Dump Source

Source File: 00000018.00000002.307022362.000001FF74BA0000.00000040.00000001.sdmp, Offset: 000001FF74BA0000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: 148dad6822c832f3b5c8bf1509d84e9f96ba5303f9a666f029dda52a9de12102
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: 99314B72715B9086D790DF1AE45479A7BA0F789BD4F208126EF8D87B28DF3AC442CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 6284 Parent PID: 1400 rundll32.exeCOMMON

Executed Functions

Function 0000015A7E3C2252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 0000015A7E3C23B0
VirtualProtect.KERNELBASE ref: 0000015A7E3C2471
RtlAvlRemoveNode.NTDLL ref: 0000015A7E3C25B4
VirtualProtect.KERNELBASE ref: 0000015A7E3C2677

Memory Dump Source

Source File: 00000019.00000002.314540883.0000015A7E3C0000.00000040.00000001.sdmp, Offset: 0000015A7E3C0000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: 0634876f84274ec1033e7003c9b654b8d171cfe257305557786993b17fb17250
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: C3B14677618BC48AD770CB1AE440BDAB7A1F7C9B80F508126EF8957B58DB79C8418F40

Uniqueness

Uniqueness Score: -1.00%

Function 0000015A7E3C2057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,0000015A7E3C29A8), ref: 0000015A7E3C20A7

Memory Dump Source

Source File: 00000019.00000002.314540883.0000015A7E3C0000.00000040.00000001.sdmp, Offset: 0000015A7E3C0000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: 40e15513296e4945fb01157fe7df39508439624d45986accbcdd1f14996c6968
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: 98314B72615B9086D780DF1AE45479A7BB0F789BC4F608126EF8D87B68DF3AC442CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 6300 Parent PID: 1400 rundll32.exeCOMMON

Executed Functions

Function 000001B1BE182252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 000001B1BE1823B0
VirtualProtect.KERNELBASE ref: 000001B1BE182471
RtlAvlRemoveNode.NTDLL ref: 000001B1BE1825B4
VirtualProtect.KERNELBASE ref: 000001B1BE182677

Memory Dump Source

Source File: 0000001A.00000002.321465590.000001B1BE180000.00000040.00000001.sdmp, Offset: 000001B1BE180000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: a68c139af4e330a5919e3b5a0335aad8a1238d5d000e3d05d2f25fa3757ccf37
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: 49B131B7618BC486D7708B1AE450BDEB7A1F7C9B80F518026EE8957B58DB79C842CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000001B1BE182057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,000001B1BE1829A8), ref: 000001B1BE1820A7

Memory Dump Source

Source File: 0000001A.00000002.321465590.000001B1BE180000.00000040.00000001.sdmp, Offset: 000001B1BE180000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: bfe3acba5d419ea03f28880a7fa4f31345d482f69483aa9656c58c21fe28049f
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: 4B312572615B9086D780DB1AE45479A7BA0F789BC4F618026EF8D87B28DB3AC442CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 6320 Parent PID: 1400 rundll32.exeCOMMON

Executed Functions

Function 000002339DE72252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 000002339DE723B0
VirtualProtect.KERNELBASE ref: 000002339DE72471
RtlAvlRemoveNode.NTDLL ref: 000002339DE725B4
VirtualProtect.KERNELBASE ref: 000002339DE72677

Memory Dump Source

Source File: 0000001B.00000002.327915909.000002339DE70000.00000040.00000001.sdmp, Offset: 000002339DE70000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: 18b6a7c9006750ddff67c0386b70c30e472e8df3b0c5003e9423cc63ab439760
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: 8EB15576619BC58AD770CB1AF44079EB7A1F7C9B84F108026EE8957B68CB7DCA418F40

Uniqueness

Uniqueness Score: -1.00%

Function 000002339DE72057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,000002339DE729A8), ref: 000002339DE720A7

Memory Dump Source

Source File: 0000001B.00000002.327915909.000002339DE70000.00000040.00000001.sdmp, Offset: 000002339DE70000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: bd257accfd3582fd43cbd8b27ed91d4b6169b17f7f6a795c52db77ce742eef91
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: 75315A72615B80C6D790DF1AE45575A7BA0F389BC4F209026EF8D87B28DF3AC542CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 6376 Parent PID: 1400 rundll32.exeCOMMON

Executed Functions

Function 0000025651682252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00000256516823B0
VirtualProtect.KERNELBASE ref: 0000025651682471
RtlAvlRemoveNode.NTDLL ref: 00000256516825B4
VirtualProtect.KERNELBASE ref: 0000025651682677

Memory Dump Source

Source File: 0000001D.00000002.335804452.0000025651680000.00000040.00000001.sdmp, Offset: 0000025651680000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: 77e904a39dfa7877e84c9f9ee76e5c8b41aa5fa1ce2529b57fa6845bccfaf271
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: D0B14476618BC486D770CB1AE44479EB7A1F7C9B80F50802AEEC957B58DB79C886CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0000025651682057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,00000256516829A8), ref: 00000256516820A7

Memory Dump Source

Source File: 0000001D.00000002.335804452.0000025651680000.00000040.00000001.sdmp, Offset: 0000025651680000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: f8422cb53b55eb3d300c75724c88b80a5322013ef5b57303023d6f27b96f2517
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: A4313C72715B9086D790DF1AE45475A7BA0F389BD4F605026EF8D97B18DF3AC486CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 6404 Parent PID: 1400 rundll32.exeCOMMON

Executed Functions

Function 000001F41D762252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 000001F41D7623B0
VirtualProtect.KERNELBASE ref: 000001F41D762471
RtlAvlRemoveNode.NTDLL ref: 000001F41D7625B4
VirtualProtect.KERNELBASE ref: 000001F41D762677

Memory Dump Source

Source File: 0000001E.00000002.395619813.000001F41D760000.00000040.00000001.sdmp, Offset: 000001F41D760000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: bf9f4a52d02baf1db99b7d7f9d70bbbc584e42fbca1e876045abffb596922fb6
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: 10B156B6618BC586E770CB1AE4507DEB7A0F7C9B80F108126DEC957B58DB79C8858F40

Uniqueness

Uniqueness Score: -1.00%

Function 000001F41D762057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,000001F41D7629A8), ref: 000001F41D7620A7

Memory Dump Source

Source File: 0000001E.00000002.395619813.000001F41D760000.00000040.00000001.sdmp, Offset: 000001F41D760000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: ebbf72882504544a5dc6d0c22415da9669004c8a1de21dc8f084f7b6925848cb
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: 7D312AB6615B9086D790DF1AE45479A7BB0F389BD4F205126EF8D87B18DF3AC486CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: msinfo32.exe PID: 6468 Parent PID: 3292 msinfo32.exeCOMMON

Executed Functions

Function 000002BA048C2252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 000002BA048C23B0
VirtualProtect.KERNELBASE ref: 000002BA048C2471
RtlAvlRemoveNode.NTDLL ref: 000002BA048C25B4
VirtualProtect.KERNELBASE ref: 000002BA048C2677

Memory Dump Source

Source File: 00000020.00000002.347974682.000002BA048C0000.00000040.00000001.sdmp, Offset: 000002BA048C0000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: eaf2169c1166214edb2af1d0156fce6b94d4399ac88714917511f852574cb522
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: A1B14277618BC486D770CB1AE440B9EB7A1F7C9B80F148026EE8957B98DF79C8568F40

Uniqueness

Uniqueness Score: -1.00%

Function 000002BA048C2057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,000002BA048C29A8), ref: 000002BA048C20A7

Memory Dump Source

Source File: 00000020.00000002.347974682.000002BA048C0000.00000040.00000001.sdmp, Offset: 000002BA048C0000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: 584431538ba5990a83c283f381374fc37939feade33e67ff207f1ceff85b587d
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: 9B312B72619B9086D790DF1AE49475A7BB0F389BD4F209426EF8D87B18DF3AC446CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF72A9E6334, Relevance: 82.5, APIs: 46, Strings: 1, Instructions: 226fileCOMMON

Download Yara Rule

APIs

#620.MFC42U ref: 00007FF72A9E6371
#624.MFC42U ref: 00007FF72A9E6384
#6050.MFC42U ref: 00007FF72A9E639F
#1040.MFC42U ref: 00007FF72A9E63CC
#1040.MFC42U ref: 00007FF72A9E63D8
#4436.MFC42U ref: 00007FF72A9E63F8
#1122.MFC42U ref: 00007FF72A9E6407
#1040.MFC42U ref: 00007FF72A9E6413
#624.MFC42U ref: 00007FF72A9E6425
#1259.MFC42U ref: 00007FF72A9E6439
#1040.MFC42U ref: 00007FF72A9E6445
#626.MFC42U ref: 00007FF72A9E6450
FindFirstFileW.KERNEL32 ref: 00007FF72A9E6460
#624.MFC42U ref: 00007FF72A9E6491
#1259.MFC42U ref: 00007FF72A9E64A5
#1262.MFC42U ref: 00007FF72A9E64B8
#1122.MFC42U ref: 00007FF72A9E64C7
#1040.MFC42U ref: 00007FF72A9E64D3
#1040.MFC42U ref: 00007FF72A9E64DF
#1040.MFC42U ref: 00007FF72A9E64EB
_wcsicmp.MSVCRT ref: 00007FF72A9E64F9
SetFileAttributesW.KERNEL32 ref: 00007FF72A9E650D
DeleteFileW.KERNEL32 ref: 00007FF72A9E6518
FindNextFileW.KERNEL32 ref: 00007FF72A9E6525
FindClose.KERNEL32 ref: 00007FF72A9E6535
#624.MFC42U ref: 00007FF72A9E6547
#1259.MFC42U ref: 00007FF72A9E655B
#1040.MFC42U ref: 00007FF72A9E6567
FindFirstFileW.KERNEL32 ref: 00007FF72A9E6576
#622.MFC42U ref: 00007FF72A9E65E0
#624.MFC42U ref: 00007FF72A9E65F2
#624.MFC42U ref: 00007FF72A9E6607
#1259.MFC42U ref: 00007FF72A9E661B
#1259.MFC42U ref: 00007FF72A9E662D
#1040.MFC42U ref: 00007FF72A9E6645
#1040.MFC42U ref: 00007FF72A9E6651
#1040.MFC42U ref: 00007FF72A9E665D
#1040.MFC42U ref: 00007FF72A9E6669
#1040.MFC42U ref: 00007FF72A9E6675
FindNextFileW.KERNEL32 ref: 00007FF72A9E6682
FindClose.KERNEL32 ref: 00007FF72A9E6693
RemoveDirectoryW.KERNEL32 ref: 00007FF72A9E669E
#1040.MFC42U ref: 00007FF72A9E66AA
#1040.MFC42U ref: 00007FF72A9E66B6
#1040.MFC42U ref: 00007FF72A9E66C2
#1040.MFC42U ref: 00007FF72A9E66CE

Strings

\*.*, xrefs: 00007FF72A9E6419

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040$#624FileFind$#1259$#1122CloseFirstNext$#1262#4436#6050#620#622#626AttributesDeleteDirectoryRemove_wcsicmp
String ID: \*.*
API String ID: 228190193-1173974218
Opcode ID: 123c3de671249aa7b21267ecfe61914600876896b2d4683cec9b587b27820976
Instruction ID: 49151e77cd38447070cc3e5f21eef5c7f9b3ad5894d1ab68b08fecfdd0c028b0
Opcode Fuzzy Hash: 123c3de671249aa7b21267ecfe61914600876896b2d4683cec9b587b27820976
Instruction Fuzzy Hash: BFB14E21A0894392FB10AB16EC541B9B770FF95B95FD01172DA8EC26A8DF2CD98DCF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9EB7AC, Relevance: 81.3, APIs: 54, Instructions: 315windowCOMMON

Download Yara Rule

APIs

BeginPaint.USER32 ref: 00007FF72A9EB7F2
GetClientRect.USER32 ref: 00007FF72A9EB803
GetSysColor.USER32 ref: 00007FF72A9EB810
SetTextColor.GDI32 ref: 00007FF72A9EB81B
GetSysColor.USER32 ref: 00007FF72A9EB823
CreateSolidBrush.GDI32 ref: 00007FF72A9EB82B
FillRect.USER32 ref: 00007FF72A9EB83B
InvalidateRect.USER32 ref: 00007FF72A9EB84E
RedrawWindow.USER32 ref: 00007FF72A9EB865
InvalidateRect.USER32 ref: 00007FF72A9EB874
RedrawWindow.USER32 ref: 00007FF72A9EB886
InvalidateRect.USER32 ref: 00007FF72A9EB898
RedrawWindow.USER32 ref: 00007FF72A9EB8AD
InvalidateRect.USER32 ref: 00007FF72A9EB8BF
RedrawWindow.USER32 ref: 00007FF72A9EB8D4
InvalidateRect.USER32 ref: 00007FF72A9EB8E6
RedrawWindow.USER32 ref: 00007FF72A9EB8FB
InvalidateRect.USER32 ref: 00007FF72A9EB90D
RedrawWindow.USER32 ref: 00007FF72A9EB922
InvalidateRect.USER32 ref: 00007FF72A9EB934
RedrawWindow.USER32 ref: 00007FF72A9EB949
InvalidateRect.USER32 ref: 00007FF72A9EB95B
RedrawWindow.USER32 ref: 00007FF72A9EB970
InvalidateRect.USER32 ref: 00007FF72A9EB982
RedrawWindow.USER32 ref: 00007FF72A9EB997
InvalidateRect.USER32 ref: 00007FF72A9EB9A9
RedrawWindow.USER32 ref: 00007FF72A9EB9BE
IsWindowVisible.USER32 ref: 00007FF72A9EB9C8
GetWindowRect.USER32 ref: 00007FF72A9EB9E2
ScreenToClient.USER32 ref: 00007FF72A9EBA1B
ScreenToClient.USER32 ref: 00007FF72A9EBA2A
#336.MFC42U ref: 00007FF72A9EBA53
#1646.MFC42U ref: 00007FF72A9EBA62
GetSysColor.USER32 ref: 00007FF72A9EBA6C
GetSysColor.USER32 ref: 00007FF72A9EBA78
#2574.MFC42U ref: 00007FF72A9EBA8E
InflateRect.USER32 ref: 00007FF72A9EBAD1
#6138.MFC42U ref: 00007FF72A9EBAE3
GetSysColor.USER32 ref: 00007FF72A9EBAEF
#6577.MFC42U ref: 00007FF72A9EBAFC
#6243.MFC42U ref: 00007FF72A9EBB0D
#6138.MFC42U ref: 00007FF72A9EBB2E
GetObjectW.GDI32 ref: 00007FF72A9EBB42
CreateFontIndirectW.GDI32 ref: 00007FF72A9EBB72
#1647.MFC42U ref: 00007FF72A9EBB80
#6133.MFC42U ref: 00007FF72A9EBB90
CopyRect.USER32 ref: 00007FF72A9EBB9F
#6133.MFC42U ref: 00007FF72A9EBC19
#6127.MFC42U ref: 00007FF72A9EBC7B
#6577.MFC42U ref: 00007FF72A9EBC89
#6243.MFC42U ref: 00007FF72A9EBC97
#2461.MFC42U ref: 00007FF72A9EBCA2
#851.MFC42U ref: 00007FF72A9EBCAE
EndPaint.USER32 ref: 00007FF72A9EBCBC

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: Rect$Window$InvalidateRedraw$Color$Client$#6133#6138#6243#6577CreatePaintScreen$#1646#1647#2461#2574#336#6127#851BeginBrushCopyFillFontIndirectInflateObjectSolidTextVisible
String ID:
API String ID: 1845886185-0
Opcode ID: 05b826c957b0f371659ecd55c0a518a94a86a38c81a8c1fab40690293cef1d3d
Instruction ID: 224926183624966a384419f419d7e0ad8972e577e4fd622a7c8538e6f31a9958
Opcode Fuzzy Hash: 05b826c957b0f371659ecd55c0a518a94a86a38c81a8c1fab40690293cef1d3d
Instruction Fuzzy Hash: B6F10C36718A4287E714DB27E85466AB7A1FB88B84F904171DB8EC3768DF38D449CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D9370, Relevance: 58.9, APIs: 39, Instructions: 410synchronizationwindowCOMMON

Download Yara Rule

APIs

#420.MFC42U ref: 00007FF72A9D939F
#568.MFC42U ref: 00007FF72A9D93AC
#626.MFC42U ref: 00007FF72A9D93BE
CoInitialize.OLE32 ref: 00007FF72A9D93D0
#6886.MFC42U ref: 00007FF72A9D93EB
#1355.MFC42U ref: 00007FF72A9D9445
#5950.MFC42U ref: 00007FF72A9D946E
EnterCriticalSection.KERNEL32 ref: 00007FF72A9D949C
#1122.MFC42U ref: 00007FF72A9D94B3
LeaveCriticalSection.KERNEL32 ref: 00007FF72A9D94BD
GetTickCount.KERNEL32 ref: 00007FF72A9D9503
#4500.MFC42U ref: 00007FF72A9D95AE
#1219.MFC42U ref: 00007FF72A9D9612
EnterCriticalSection.KERNEL32 ref: 00007FF72A9D964A
#5950.MFC42U ref: 00007FF72A9D969A
free.MSVCRT ref: 00007FF72A9D980F
GetTickCount.KERNEL32 ref: 00007FF72A9D9816
#1381.MFC42U ref: 00007FF72A9D982E
PostMessageW.USER32 ref: 00007FF72A9D987D
SetEvent.KERNEL32 ref: 00007FF72A9D9887
WaitForSingleObject.KERNEL32 ref: 00007FF72A9D9894
ResetEvent.KERNEL32 ref: 00007FF72A9D989E
ResetEvent.KERNEL32 ref: 00007FF72A9D98A8
#5925.MFC42U ref: 00007FF72A9D98B2
#3579.MFC42U ref: 00007FF72A9D98F4
#5914.MFC42U ref: 00007FF72A9D992C
CoUninitialize.OLE32 ref: 00007FF72A9D9949

Part of subcall function 00007FF72A9D746C: #626.MFC42U ref: 00007FF72A9D74A1
Part of subcall function 00007FF72A9D746C: #626.MFC42U ref: 00007FF72A9D74AC
Part of subcall function 00007FF72A9D746C: #626.MFC42U ref: 00007FF72A9D74B7
Part of subcall function 00007FF72A9D746C: #626.MFC42U ref: 00007FF72A9D74C2
Part of subcall function 00007FF72A9D746C: #1463.MFC42U ref: 00007FF72A9D74D5
Part of subcall function 00007FF72A9D746C: #4473.MFC42U ref: 00007FF72A9D74E8
Part of subcall function 00007FF72A9D746C: #4473.MFC42U ref: 00007FF72A9D74F7
Part of subcall function 00007FF72A9D746C: #4473.MFC42U ref: 00007FF72A9D7506
Part of subcall function 00007FF72A9D746C: #4473.MFC42U ref: 00007FF72A9D7515
Part of subcall function 00007FF72A9D746C: #624.MFC42U ref: 00007FF72A9D7539
Part of subcall function 00007FF72A9D746C: #624.MFC42U ref: 00007FF72A9D7547
Part of subcall function 00007FF72A9D746C: #624.MFC42U ref: 00007FF72A9D7555

#1040.MFC42U ref: 00007FF72A9D9955
#1006.MFC42U ref: 00007FF72A9D9960
#915.MFC42U ref: 00007FF72A9D996B

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #626$#4473$#624CriticalEventSection$#5950CountEnterResetTick$#1006#1040#1122#1219#1355#1381#1463#3579#420#4500#568#5914#5925#6886#915InitializeLeaveMessageObjectPostSingleUninitializeWaitfree
String ID:
API String ID: 2729432003-0
Opcode ID: 192d2e3a58c0226b8357b73c83b0f576c6476680b55e08a0fa070b6ffddc9b04
Instruction ID: 2a19fbd558b49a04a8a0bf21491a2e51f70dcef5603236eed48b4b72286c0f7a
Opcode Fuzzy Hash: 192d2e3a58c0226b8357b73c83b0f576c6476680b55e08a0fa070b6ffddc9b04
Instruction Fuzzy Hash: 7A024C36A09A428AFB14FF26D854269B3A4FB44B44F900075CB9EC7B94DF3CE499CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9EB184, Relevance: 56.3, APIs: 31, Strings: 1, Instructions: 305windowCOMMON

Download Yara Rule

APIs

#620.MFC42U ref: 00007FF72A9EB1C4
#6704.MFC42U ref: 00007FF72A9EB1D6
#6707.MFC42U ref: 00007FF72A9EB1E7
#4521.MFC42U ref: 00007FF72A9EB1F1
#626.MFC42U ref: 00007FF72A9EB20F
#4521.MFC42U ref: 00007FF72A9EB235
#2783.MFC42U ref: 00007FF72A9EB243
SendMessageW.USER32 ref: 00007FF72A9EB287
SendMessageW.USER32 ref: 00007FF72A9EB29D
SetFocus.USER32 ref: 00007FF72A9EB2F9
#1040.MFC42U ref: 00007FF72A9EB648
#1040.MFC42U ref: 00007FF72A9EB653

Strings

, xrefs: 00007FF72A9EB1CB, 00007FF72A9EB1DC

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040#4521MessageSend$#2783#620#626#6704#6707Focus
String ID:
API String ID: 3083724974-2501233543
Opcode ID: dbddddb9c6a28a9a28cff8b5c7730f7ea0380c028335484c6d464e520a6ae7fa
Instruction ID: 2126db13756b1a0bc1eac4b62537168ab6d05c891aa54ac3e3907fba5a96bc72
Opcode Fuzzy Hash: dbddddb9c6a28a9a28cff8b5c7730f7ea0380c028335484c6d464e520a6ae7fa
Instruction Fuzzy Hash: BBE18272A08A4686FB10AF26DD402ACB3A1FB54F58F944072CF5DD76A5DF38D885CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9E08D8, Relevance: 56.3, APIs: 28, Strings: 4, Instructions: 267registrylibraryloaderCOMMON

Download Yara Rule

APIs

#626.MFC42U ref: 00007FF72A9E0925
#626.MFC42U ref: 00007FF72A9E0931
#626.MFC42U ref: 00007FF72A9E093D
#626.MFC42U ref: 00007FF72A9E0949
#4473.MFC42U ref: 00007FF72A9E0963
#6641.MFC42U ref: 00007FF72A9E097A
#1122.MFC42U ref: 00007FF72A9E0989
#1040.MFC42U ref: 00007FF72A9E0995
#4473.MFC42U ref: 00007FF72A9E09A5
#4473.MFC42U ref: 00007FF72A9E09B5
#6641.MFC42U ref: 00007FF72A9E09CC
#1122.MFC42U ref: 00007FF72A9E09DB
#1040.MFC42U ref: 00007FF72A9E09E7
#4473.MFC42U ref: 00007FF72A9E09F7
RegOpenKeyExW.ADVAPI32 ref: 00007FF72A9E0A2C
RegQueryValueExW.ADVAPI32 ref: 00007FF72A9E0A5C
#4473.MFC42U ref: 00007FF72A9E0A93
RegCloseKey.ADVAPI32 ref: 00007FF72A9E0A9E
#4473.MFC42U ref: 00007FF72A9E0AB0
GetSystemDirectoryW.KERNEL32 ref: 00007FF72A9E0AC2
LoadLibraryExW.KERNEL32 ref: 00007FF72A9E0B7B
GetProcAddress.KERNEL32 ref: 00007FF72A9E0B97
#4473.MFC42U ref: 00007FF72A9E0C14
FreeLibrary.KERNEL32 ref: 00007FF72A9E0C1D
#1040.MFC42U ref: 00007FF72A9E0CA8
#1040.MFC42U ref: 00007FF72A9E0CB4
#1040.MFC42U ref: 00007FF72A9E0CC0
#1040.MFC42U ref: 00007FF72A9E0CCC

Strings

UEFISecureBootEnabled, xrefs: 00007FF72A9E0A50
System\CurrentControlSet\Control\SecureBoot\State, xrefs: 00007FF72A9E0A1E
FveGetSecureBootBindingState, xrefs: 00007FF72A9E0B8D
\fveapi.dll, xrefs: 00007FF72A9E0B23

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #4473$#1040$#626$#1122#6641Library$AddressCloseDirectoryFreeLoadOpenProcQuerySystemValue
String ID: FveGetSecureBootBindingState$System\CurrentControlSet\Control\SecureBoot\State$UEFISecureBootEnabled$\fveapi.dll
API String ID: 3989508364-2132896872
Opcode ID: 9645be71e12f77ba72aa4cc849ffe60a999fad8a571d36fb1196081d54c5c21f
Instruction ID: 041238cf7800b081f732b4bc87c96d18725b1b49084a45b0560a77db76f6b7d7
Opcode Fuzzy Hash: 9645be71e12f77ba72aa4cc849ffe60a999fad8a571d36fb1196081d54c5c21f
Instruction Fuzzy Hash: C3C15232A1CA8292FB10AB16ED5417AB360FF95B50F904172DA8EC7AA4DF3CD549CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9E7D98, Relevance: 52.9, APIs: 35, Instructions: 411COMMON

Download Yara Rule

APIs

LoadCursorW.USER32 ref: 00007FF72A9E7E57
SetCursor.USER32 ref: 00007FF72A9E7E60
SetCursor.USER32 ref: 00007FF72A9E7E7E

Part of subcall function 00007FF72A9EADA4: SetFocus.USER32 ref: 00007FF72A9EADD2
Part of subcall function 00007FF72A9EADA4: LoadCursorW.USER32 ref: 00007FF72A9EAE08
Part of subcall function 00007FF72A9EADA4: SetCursor.USER32 ref: 00007FF72A9EAE11
Part of subcall function 00007FF72A9EADA4: SetCursor.USER32 ref: 00007FF72A9EAE2D

Part of subcall function 00007FF72A9E8EA8: SendMessageW.USER32(?,?,?,?,?,?,?,?,?,?,?,00007FF72A9E9C36), ref: 00007FF72A9E8EC1
Part of subcall function 00007FF72A9E8EA8: SendMessageW.USER32 ref: 00007FF72A9E8EEA

Part of subcall function 00007FF72A9E8F04: WinSqmAddToStream.NTDLL ref: 00007FF72A9E8F5F
Part of subcall function 00007FF72A9E8F04: SendMessageW.USER32 ref: 00007FF72A9E8F91
Part of subcall function 00007FF72A9E8F04: SendMessageW.USER32 ref: 00007FF72A9E8FCD
Part of subcall function 00007FF72A9E8F04: SendMessageW.USER32 ref: 00007FF72A9E9002
Part of subcall function 00007FF72A9E8F04: #626.MFC42U ref: 00007FF72A9E903A

IsDlgButtonChecked.USER32 ref: 00007FF72A9E7F04
CheckDlgButton.USER32 ref: 00007FF72A9E7F39

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: Cursor$MessageSend$ButtonLoad$#626CheckCheckedFocusStream
String ID:
API String ID: 4199799261-0
Opcode ID: abfe374a37bba582e40b8465c52d72300ab7a82d32ca916d957030b6a615dcce
Instruction ID: 712f56e50ce35ba8812d74a82c1583feaede9505a55b4e65900206dc0249bcbe
Opcode Fuzzy Hash: abfe374a37bba582e40b8465c52d72300ab7a82d32ca916d957030b6a615dcce
Instruction Fuzzy Hash: 2802B721A0C59282FB54B767DE5437CE291EF51B80F8040B6DACDC3AA6DF2DE8558F60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9E5DE8, Relevance: 52.7, APIs: 35, Instructions: 182fileCOMMON

Download Yara Rule

APIs

#626.MFC42U ref: 00007FF72A9E5E28
#626.MFC42U ref: 00007FF72A9E5E34
#1122.MFC42U ref: 00007FF72A9E5E43
#624.MFC42U ref: 00007FF72A9E5E55
#6050.MFC42U ref: 00007FF72A9E5E6E
#1040.MFC42U ref: 00007FF72A9E5E9E
#1040.MFC42U ref: 00007FF72A9E5EAA
#624.MFC42U ref: 00007FF72A9E5EC0
#1284.MFC42U ref: 00007FF72A9E5ECF
#1040.MFC42U ref: 00007FF72A9E5EDB
#1259.MFC42U ref: 00007FF72A9E5EEE
#1122.MFC42U ref: 00007FF72A9E5EFD
#1040.MFC42U ref: 00007FF72A9E5F09
FindFirstFileW.KERNEL32 ref: 00007FF72A9E5F19
#624.MFC42U ref: 00007FF72A9E5F32
#1259.MFC42U ref: 00007FF72A9E5F46
#1358.MFC42U ref: 00007FF72A9E5F53
#1040.MFC42U ref: 00007FF72A9E5F5F
#1040.MFC42U ref: 00007FF72A9E5F6B
FindNextFileW.KERNEL32 ref: 00007FF72A9E5F79
FindClose.KERNEL32 ref: 00007FF72A9E5F86
#624.MFC42U ref: 00007FF72A9E5F98
#1259.MFC42U ref: 00007FF72A9E5FAC
#1122.MFC42U ref: 00007FF72A9E5FBB
#1040.MFC42U ref: 00007FF72A9E5FC7
#1040.MFC42U ref: 00007FF72A9E5FD3
FindFirstFileW.KERNEL32 ref: 00007FF72A9E5FE3
#624.MFC42U ref: 00007FF72A9E6046
#1259.MFC42U ref: 00007FF72A9E605A
#1040.MFC42U ref: 00007FF72A9E6075
#1040.MFC42U ref: 00007FF72A9E6081
FindNextFileW.KERNEL32 ref: 00007FF72A9E608F
FindClose.KERNEL32 ref: 00007FF72A9E60A0
#1040.MFC42U ref: 00007FF72A9E60AC
#1040.MFC42U ref: 00007FF72A9E60B8

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040$Find$#624$#1259File$#1122$#626CloseFirstNext$#1284#1358#6050
String ID:
API String ID: 920172037-0
Opcode ID: 0003ae628ada9153b90ec556ba0d9446620adde957a55f958715e17a3fa4ae4f
Instruction ID: 632338c1eea083895ebd341735fce44238f7f03e96977c2f8993d6ef292f32e8
Opcode Fuzzy Hash: 0003ae628ada9153b90ec556ba0d9446620adde957a55f958715e17a3fa4ae4f
Instruction Fuzzy Hash: 76815D2161898392FB10AB16EC541BAB360FF95B95FD01172D69EC26B8EF2CD58CCF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D7C40, Relevance: 38.7, APIs: 20, Strings: 2, Instructions: 188comnetworkCOMMON

Download Yara Rule

APIs

#1126.MFC42U ref: 00007FF72A9D7C8D
#1126.MFC42U ref: 00007FF72A9D7CAC
#4436.MFC42U ref: 00007FF72A9D7CBF
#1040.MFC42U ref: 00007FF72A9D7CFB
#6050.MFC42U ref: 00007FF72A9D7D17
#1122.MFC42U ref: 00007FF72A9D7D24
#1040.MFC42U ref: 00007FF72A9D7D2F
#2783.MFC42U ref: 00007FF72A9D7D3F
DnsHostnameToComputerNameW.KERNEL32 ref: 00007FF72A9D7D87
#1126.MFC42U ref: 00007FF72A9D7D98
free.MSVCRT ref: 00007FF72A9D7DA8
#1122.MFC42U ref: 00007FF72A9D7DB6
#1126.MFC42U ref: 00007FF72A9D7DCA
#1126.MFC42U ref: 00007FF72A9D7DE1
CoCreateInstance.OLE32 ref: 00007FF72A9D7E17
#626.MFC42U ref: 00007FF72A9D7E35
#2846.MFC42U ref: 00007FF72A9D7E4D
#1606.MFC42U ref: 00007FF72A9D7E57
SysFreeString.OLEAUT32 ref: 00007FF72A9D7EA1
#1040.MFC42U ref: 00007FF72A9D7EC0

Strings

\\%s\root\%s, xrefs: 00007FF72A9D7E42
cimv2, xrefs: 00007FF72A9D7DC0

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1126$#1040$#1122$#1606#2783#2846#4436#6050#626ComputerCreateFreeHostnameInstanceNameStringfree
String ID: \\%s\root\%s$cimv2
API String ID: 3799178805-4141223442
Opcode ID: c0574d8a8ee21954aa3249faee857f8bff5220f21cba5606047d2ba842d777d8
Instruction ID: 91608d87b3d706ea1b9d77a09237ca4ee3a5c94e15fde76f41e49c5230533ef2
Opcode Fuzzy Hash: c0574d8a8ee21954aa3249faee857f8bff5220f21cba5606047d2ba842d777d8
Instruction Fuzzy Hash: 11817D26604A43C6FB14AF26DC540B9B3A0FB44B94B944175DE9EC77A4DF3ED488CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9EA9C4, Relevance: 31.6, APIs: 21, Instructions: 140windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 00007FF72A9EA9E9
IsWindowVisible.USER32 ref: 00007FF72A9EA9F7
IsWindowEnabled.USER32 ref: 00007FF72A9EAA08
SendMessageW.USER32 ref: 00007FF72A9EAA24
#626.MFC42U ref: 00007FF72A9EAA33
#1126.MFC42U ref: 00007FF72A9EAA45
SendMessageW.USER32 ref: 00007FF72A9EAA95
SendMessageW.USER32 ref: 00007FF72A9EAAB7
#1287.MFC42U ref: 00007FF72A9EAB05
#1284.MFC42U ref: 00007FF72A9EAB13
#1287.MFC42U ref: 00007FF72A9EAB2B
SendMessageW.USER32 ref: 00007FF72A9EAB43
OpenClipboard.USER32 ref: 00007FF72A9EAB59
EmptyClipboard.USER32 ref: 00007FF72A9EAB63
GlobalAlloc.KERNEL32 ref: 00007FF72A9EAB84
GlobalLock.KERNEL32 ref: 00007FF72A9EAB95
memcpy.MSVCRT ref: 00007FF72A9EABAA
GlobalUnlock.KERNEL32 ref: 00007FF72A9EABB2
SetClipboardData.USER32 ref: 00007FF72A9EABC0
CloseClipboard.USER32 ref: 00007FF72A9EABC6
#1040.MFC42U ref: 00007FF72A9EABD1

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: ClipboardMessageSend$Global$#1287Window$#1040#1126#1284#626AllocCloseDataEmptyEnabledFocusLockOpenUnlockVisiblememcpy
String ID:
API String ID: 4277881370-0
Opcode ID: 6bb0119cfa0304f784cce7c8d5a1ae844f374396d877477d093fbac96076e341
Instruction ID: 522143a393fd192479602620ed92e84084c474e9d7a7288c988c341def88df39
Opcode Fuzzy Hash: 6bb0119cfa0304f784cce7c8d5a1ae844f374396d877477d093fbac96076e341
Instruction Fuzzy Hash: 4E519431B08A4385FB10AF26ED54778A361EB94B95F941172CE5EC3AA8DF3CD449CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D9CEC, Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 89COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 00007FF72A9D9D5E
GetLocaleInfoW.KERNEL32 ref: 00007FF72A9D9D78
memset.MSVCRT ref: 00007FF72A9D9D89
#626.MFC42U ref: 00007FF72A9D9DC0
#626.MFC42U ref: 00007FF72A9D9DCC
#2846.MFC42U ref: 00007FF72A9D9DE2
#2846.MFC42U ref: 00007FF72A9D9DFA

Part of subcall function 00007FF72A9E38B0: #620.MFC42U ref: 00007FF72A9E38E0
Part of subcall function 00007FF72A9E38B0: #626.MFC42U ref: 00007FF72A9E38EB
Part of subcall function 00007FF72A9E38B0: #624.MFC42U ref: 00007FF72A9E38F9
Part of subcall function 00007FF72A9E38B0: #624.MFC42U ref: 00007FF72A9E3907
Part of subcall function 00007FF72A9E38B0: #2783.MFC42U ref: 00007FF72A9E3927
Part of subcall function 00007FF72A9E38B0: #1284.MFC42U ref: 00007FF72A9E393C
Part of subcall function 00007FF72A9E38B0: #2629.MFC42U ref: 00007FF72A9E3946
Part of subcall function 00007FF72A9E38B0: #4436.MFC42U ref: 00007FF72A9E3959
Part of subcall function 00007FF72A9E38B0: #1284.MFC42U ref: 00007FF72A9E3967
Part of subcall function 00007FF72A9E38B0: #1040.MFC42U ref: 00007FF72A9E3972
Part of subcall function 00007FF72A9E38B0: #1284.MFC42U ref: 00007FF72A9E3980
Part of subcall function 00007FF72A9E38B0: #6050.MFC42U ref: 00007FF72A9E399C
Part of subcall function 00007FF72A9E38B0: #1122.MFC42U ref: 00007FF72A9E39AA
Part of subcall function 00007FF72A9E38B0: #1040.MFC42U ref: 00007FF72A9E39B5
Part of subcall function 00007FF72A9E38B0: #1122.MFC42U ref: 00007FF72A9E39D5
Part of subcall function 00007FF72A9E38B0: #1040.MFC42U ref: 00007FF72A9E39E0
Part of subcall function 00007FF72A9E38B0: #1040.MFC42U ref: 00007FF72A9E39EB
Part of subcall function 00007FF72A9E38B0: #1040.MFC42U ref: 00007FF72A9E39F6
Part of subcall function 00007FF72A9E38B0: #1040.MFC42U ref: 00007FF72A9E3A01

GetNumberFormatW.KERNEL32 ref: 00007FF72A9D9E38
#624.MFC42U ref: 00007FF72A9D9E45
#1040.MFC42U ref: 00007FF72A9D9E51
#1040.MFC42U ref: 00007FF72A9D9E5D

Strings

,, xrefs: 00007FF72A9D9D38
%%.%df, xrefs: 00007FF72A9D9DD6
., xrefs: 00007FF72A9D9D41

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040$#1284#624#626$#1122#2846InfoLocale$#2629#2783#4436#6050#620FormatNumbermemset
String ID: %%.%df$,$.
API String ID: 3321813277-1171236212
Opcode ID: a81c70535312e65379755c52843ca6296e23f36f7cb0517dc87fd6d9092921ad
Instruction ID: 9bc7c9df85a80a87464f2c9f8cb0d0a748fdedda54c2bc4d743e72b0c9a6355e
Opcode Fuzzy Hash: a81c70535312e65379755c52843ca6296e23f36f7cb0517dc87fd6d9092921ad
Instruction Fuzzy Hash: CC418532618A8296F7109B26E8447EAB760FB95754F901132E78E83AB8DF3CD54DCF40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9E15C4, Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 139libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF72A9E1609
GetProcAddress.KERNEL32 ref: 00007FF72A9E1625
GetProcAddress.KERNEL32 ref: 00007FF72A9E1641
GetProcAddress.KERNEL32 ref: 00007FF72A9E165D
RegGetValueW.ADVAPI32 ref: 00007FF72A9E1721
GetProcessHeap.KERNEL32 ref: 00007FF72A9E179C
HeapFree.KERNEL32 ref: 00007FF72A9E17AB

Strings

NgscbCheckDmaSecurity, xrefs: 00007FF72A9E1653
NgscbCheckHSTIPrerequisitesVerified, xrefs: 00007FF72A9E1637
NgscbCheckIsHSTIVerified, xrefs: 00007FF72A9E161B
HSTIVerificationRequired, xrefs: 00007FF72A9E16F2
SYSTEM\CurrentControlSet\Control\BitLocker\AutoDE\HSTI, xrefs: 00007FF72A9E16FE
NgscbCheckIsAOACDevice, xrefs: 00007FF72A9E15E9

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$Heap$FreeProcessValue
String ID: HSTIVerificationRequired$NgscbCheckDmaSecurity$NgscbCheckHSTIPrerequisitesVerified$NgscbCheckIsAOACDevice$NgscbCheckIsHSTIVerified$SYSTEM\CurrentControlSet\Control\BitLocker\AutoDE\HSTI
API String ID: 1339651749-646076505
Opcode ID: ce5227b95ab2595cb430ebec089761dcfc1c0aeb47fd99824ac5f7ae5be088df
Instruction ID: 87eb5f095c7bd6d436296b0a0ef3e8fc7499c68294bf60e5440d443c143c030f
Opcode Fuzzy Hash: ce5227b95ab2595cb430ebec089761dcfc1c0aeb47fd99824ac5f7ae5be088df
Instruction Fuzzy Hash: 5751B065F0979285FB04AB639D003B9A7A0FB64B88F944476CE8D92789DF3DD148CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9E0F98, Relevance: 18.2, APIs: 12, Instructions: 209COMMON

Download Yara Rule

APIs

#626.MFC42U ref: 00007FF72A9E0FCA
#626.MFC42U ref: 00007FF72A9E0FD5
#4473.MFC42U ref: 00007FF72A9E0FEB
#4473.MFC42U ref: 00007FF72A9E1036
#4473.MFC42U ref: 00007FF72A9E1071
#4473.MFC42U ref: 00007FF72A9E10CA
#4473.MFC42U ref: 00007FF72A9E1124
#4473.MFC42U ref: 00007FF72A9E117E
#4473.MFC42U ref: 00007FF72A9E11E5
#4473.MFC42U ref: 00007FF72A9E123E
#1040.MFC42U ref: 00007FF72A9E1293
#1040.MFC42U ref: 00007FF72A9E129E

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #4473$#1040#626
String ID:
API String ID: 2017961946-0
Opcode ID: a433a37330a2c919878dbcb9010eaf22fb017bb63fb2bb40da1cd9743983d97e
Instruction ID: f569ea623772e3414504c0a1e74e3d90a3e86373a1ab8b9e9e83e122280ba8c0
Opcode Fuzzy Hash: a433a37330a2c919878dbcb9010eaf22fb017bb63fb2bb40da1cd9743983d97e
Instruction Fuzzy Hash: 7F914F72604B4686EB10EF22DC54999B725FB98FC8B805172EE4E93B68CF3CC549CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9EBD00, Relevance: 15.2, APIs: 10, Instructions: 188windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF72A9EBD75
PostQuitMessage.USER32 ref: 00007FF72A9EBD7D
SetCurrentDirectoryW.KERNEL32 ref: 00007FF72A9EBDB1

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentDialogDirectoryMessagePostQuit
String ID:
API String ID: 2039437324-0
Opcode ID: 7a59c514b7f671bfc38efdd70fc387632833d7683acd63a306ee0d334db6626a
Instruction ID: eb4ded5860751d11ffbbd6d29b72e1802ee02dd9228d799708200340328647d6
Opcode Fuzzy Hash: 7a59c514b7f671bfc38efdd70fc387632833d7683acd63a306ee0d334db6626a
Instruction Fuzzy Hash: 0E913D31E0C64285FB11BB36DD506B8A7B0EF60744FC081B7D98ED26A6CE7CA446DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9E07E8, Relevance: 12.1, APIs: 8, Instructions: 64nativeCOMMON

Download Yara Rule

APIs

#626.MFC42U ref: 00007FF72A9E0805
#626.MFC42U ref: 00007FF72A9E0810
#4473.MFC42U ref: 00007FF72A9E0829
#4473.MFC42U ref: 00007FF72A9E0838
NtQuerySystemInformation.NTDLL ref: 00007FF72A9E0855
#4473.MFC42U ref: 00007FF72A9E0873
#1040.MFC42U ref: 00007FF72A9E08BD
#1040.MFC42U ref: 00007FF72A9E08C8

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #4473$#1040#626$InformationQuerySystem
String ID:
API String ID: 2212375957-0
Opcode ID: f68813a96abbc8204f48e9ca342802b0526f36e0031b6775678b5111bf9632ef
Instruction ID: 4b5899a72ea74833ff4c693f9a6e2771b12d85dd2164bd98746102b0e4c8844d
Opcode Fuzzy Hash: f68813a96abbc8204f48e9ca342802b0526f36e0031b6775678b5111bf9632ef
Instruction Fuzzy Hash: B2218532604A4296F700AF62DC442A87720FB55B99F901272DA5EC7AE8DF3CD588CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9EFC05, Relevance: 12.0, APIs: 8, Instructions: 41windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF72A9EFC13
FormatMessageW.KERNEL32 ref: 00007FF72A9EFC3D
#626.MFC42U ref: 00007FF72A9EFC47
#1463.MFC42U ref: 00007FF72A9EFC55
#4473.MFC42U ref: 00007FF72A9EFC68
MessageBoxW.USER32 ref: 00007FF72A9EFC84
LocalFree.KERNEL32 ref: 00007FF72A9EFC8E
#1040.MFC42U ref: 00007FF72A9EFC99

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: Message$#1040#1463#4473#626ErrorFormatFreeLastLocal
String ID:
API String ID: 4176705450-0
Opcode ID: b884465a053e7bfb3a21246e26b19fb96e93fb32a7afefd74ad7e812a584c37b
Instruction ID: b5576ec95b0e2f00022c29e2ce73e51ae1257c81dd6ac43eb3156f675ff69f14
Opcode Fuzzy Hash: b884465a053e7bfb3a21246e26b19fb96e93fb32a7afefd74ad7e812a584c37b
Instruction Fuzzy Hash: 3F115472604E02D6F704EF22EC506687760FB99B96FA40071DA4DD3664CF3DD589CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9ED2B0, Relevance: 9.0, APIs: 6, Instructions: 50timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF72A9ED2E1
GetCurrentProcessId.KERNEL32 ref: 00007FF72A9ED2EF
GetCurrentThreadId.KERNEL32 ref: 00007FF72A9ED2FB
GetTickCount.KERNEL32 ref: 00007FF72A9ED307
GetTickCount.KERNEL32 ref: 00007FF72A9ED317
QueryPerformanceCounter.KERNEL32 ref: 00007FF72A9ED332

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: CountCurrentTickTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 4104442557-0
Opcode ID: 4a2c5396cd79b94af59d6a3c562de864c05332e0fa517de845a0bfb9dbbdd3d0
Instruction ID: eb4b4b116334c44575697bf76a3736f6a1774a7b89cda8087408582ffd97003e
Opcode Fuzzy Hash: 4a2c5396cd79b94af59d6a3c562de864c05332e0fa517de845a0bfb9dbbdd3d0
Instruction Fuzzy Hash: 0F111F21A04F428AEB00EF76EC4416973E4FB08758B841A75EA9DC3B54EF3CD5A5CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D89B8, Relevance: 7.6, APIs: 5, Instructions: 128COMMON

Download Yara Rule

APIs

#626.MFC42U ref: 00007FF72A9D8A6A
#624.MFC42U ref: 00007FF72A9D8A7B
GetVersionExW.KERNEL32 ref: 00007FF72A9D8AE1
#624.MFC42U ref: 00007FF72A9D8B3B
#620.MFC42U ref: 00007FF72A9D8B4C

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624$#620#626Version
String ID:
API String ID: 2160352763-0
Opcode ID: caed7d176e80cfe1c767313ba3c5ca3efb97bc74d9263d70fc981ef111e02ad8
Instruction ID: d4d3a0d9e4081437ba3dfa81900065f6718ec7706bc84198c8fce1cdd0f52d44
Opcode Fuzzy Hash: caed7d176e80cfe1c767313ba3c5ca3efb97bc74d9263d70fc981ef111e02ad8
Instruction Fuzzy Hash: 34518172604B81C6EB64EF16E944269B3B4FB48F94F604235CB9C977A0CF39D4A2CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9ED120, Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF72A9ED12B

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: cd4300029522dc6765e4999749bcee3136f369972b823a85ac0d1da766966a49
Instruction ID: 044dc84aa36286e14ac610da2dbf9db60b77283539046ed36f7cfac156c27dc5
Opcode Fuzzy Hash: cd4300029522dc6765e4999749bcee3136f369972b823a85ac0d1da766966a49
Instruction Fuzzy Hash: 35B09210E29442C1EB04BBA39C8116152A0AB68311FD404B2C14EC0120DE1C929B8F10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D4F80, Relevance: 135.0, APIs: 40, Strings: 37, Instructions: 229COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D4FA2
#624.MFC42U ref: 00007FF72A9D4FB7
#624.MFC42U ref: 00007FF72A9D4FF0
#624.MFC42U ref: 00007FF72A9D5005
#624.MFC42U ref: 00007FF72A9D5036
#624.MFC42U ref: 00007FF72A9D504B
#624.MFC42U ref: 00007FF72A9D507A
#624.MFC42U ref: 00007FF72A9D508F
#624.MFC42U ref: 00007FF72A9D50BE
#624.MFC42U ref: 00007FF72A9D50D3
#624.MFC42U ref: 00007FF72A9D5107
#624.MFC42U ref: 00007FF72A9D511C
#624.MFC42U ref: 00007FF72A9D5150
#624.MFC42U ref: 00007FF72A9D5165
#624.MFC42U ref: 00007FF72A9D5199
#624.MFC42U ref: 00007FF72A9D51AE
#624.MFC42U ref: 00007FF72A9D51E2
#624.MFC42U ref: 00007FF72A9D51F7
#624.MFC42U ref: 00007FF72A9D5226
#624.MFC42U ref: 00007FF72A9D523B
#624.MFC42U ref: 00007FF72A9D526F
#624.MFC42U ref: 00007FF72A9D5284
#624.MFC42U ref: 00007FF72A9D52B8
#624.MFC42U ref: 00007FF72A9D52CD
#624.MFC42U ref: 00007FF72A9D5301
#624.MFC42U ref: 00007FF72A9D5316
#624.MFC42U ref: 00007FF72A9D534A
#624.MFC42U ref: 00007FF72A9D535F
#624.MFC42U ref: 00007FF72A9D538E
#624.MFC42U ref: 00007FF72A9D53A3
#624.MFC42U ref: 00007FF72A9D53D2
#624.MFC42U ref: 00007FF72A9D53E7
#624.MFC42U ref: 00007FF72A9D5416
#624.MFC42U ref: 00007FF72A9D542B
#624.MFC42U ref: 00007FF72A9D545F
#624.MFC42U ref: 00007FF72A9D5474
#624.MFC42U ref: 00007FF72A9D54A8
#624.MFC42U ref: 00007FF72A9D54BD
#624.MFC42U ref: 00007FF72A9D54E8
#624.MFC42U ref: 00007FF72A9D54FD

Strings

Name, ConnectionlessService, GuaranteesDelivery, GuaranteesSequencing, MSIAdvancedMaximumAddressSize, MSIAdvancedMaximumMessageSiz, xrefs: 00007FF72A9D51A0
Win32_NetworkProtocol, xrefs: 00007FF72A9D518B
Win32_LogicalProgramGroup, xrefs: 00007FF72A9D5028
Win32_Printer, xrefs: 00007FF72A9D533C
Win32_StartupCommand, xrefs: 00007FF72A9D506C
Caption, Manufacturer, Status, MSIAdvancedPNPDeviceID, xrefs: 00007FF72A9D522D, 00007FF72A9D5466
DisplayName, Name, State, StartMode, ServiceType, PathName, ErrorControl, StartName, TagId, xrefs: 00007FF72A9D4FF7
Name, VariableValue, UserName, xrefs: 00007FF72A9D51E9
Win32_Keyboard, xrefs: 00007FF72A9D50B0
Caption, xrefs: 00007FF72A9D52BF
Name, DriverName, PortName, ServerName, xrefs: 00007FF72A9D5351
Win32_SystemDriver, xrefs: 00007FF72A9D53C4
Win32_PointingDevice, xrefs: 00007FF72A9D50F9
Win32_Environment, xrefs: 00007FF72A9D51D4
Name, MSIAdvancedPNPDeviceID, VideoProcessor, AdapterCompatibility, MSIAdvancedDescription, MSIAdvancedAdapterRAM, MSIAdvancedInst, xrefs: 00007FF72A9D5276
Win32_Service, xrefs: 00007FF72A9D4FE2
Caption, Manufacturer, Status, PNPDeviceID, xrefs: 00007FF72A9D541D
Win32_PrintJob, xrefs: 00007FF72A9D549A
Caption, Description, DeviceID, DeviceType, AttachedTo, AnswerMode, MSIAdvancedPNPDeviceID, MSIAdvancedProviderName, MSIAdvancedMo, xrefs: 00007FF72A9D5157
Description, Name, Layout, MSIAdvancedPNPDeviceID, NumberOfFunctionKeys, xrefs: 00007FF72A9D50C5
Win32_ParallelPort, xrefs: 00007FF72A9D52F3
Win32_NetworkConnection, xrefs: 00007FF72A9D5380
Win32_POTSModem, xrefs: 00007FF72A9D5142
Win32_CDRomDrive, xrefs: 00007FF72A9D4F94
Document, Size, Owner, Notify, Status, TimeSubmitted, StartTime, UntilTime, ElapsedTime, PagesPrinted, JobId, Priority, Parameters, xrefs: 00007FF72A9D54AF
Win32_SoundDevice, xrefs: 00007FF72A9D5218
Name, MSIAdvancedPNPDeviceID, xrefs: 00007FF72A9D5308
Name, Description, PathName, ServiceType, Started, StartMode, State, Status, ErrorControl, AcceptPause, AcceptStop, xrefs: 00007FF72A9D53D9
Win32_IDEController, xrefs: 00007FF72A9D5408
Win32_InfraredDevice, xrefs: 00007FF72A9D52AA
Drive, Description, MediaLoaded, MediaType, Name, Manufacturer, Status, TransferRate, MSIAdvancedSCSITargetId, MSIAdvancedPNPDevic, xrefs: 00007FF72A9D4FA9
LocalName, RemoteName, ResourceType, ConnectionType, UserName, xrefs: 00007FF72A9D5395
Win32_VideoController, xrefs: 00007FF72A9D5261
Caption, Command, User, Location, xrefs: 00007FF72A9D5081
GroupName, Name, UserName, xrefs: 00007FF72A9D503D
HardwareType, NumberOfButtons, Status, MSIAdvancedPNPDeviceID, MSIAdvancedPowerManagementSupported, MSIAdvancedDoubleSpeedThreshol, xrefs: 00007FF72A9D510E
Win32_SCSIController, xrefs: 00007FF72A9D5451

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624
String ID: Caption$Caption, Command, User, Location$Caption, Description, DeviceID, DeviceType, AttachedTo, AnswerMode, MSIAdvancedPNPDeviceID, MSIAdvancedProviderName, MSIAdvancedMo$Caption, Manufacturer, Status, MSIAdvancedPNPDeviceID$Caption, Manufacturer, Status, PNPDeviceID$Description, Name, Layout, MSIAdvancedPNPDeviceID, NumberOfFunctionKeys$DisplayName, Name, State, StartMode, ServiceType, PathName, ErrorControl, StartName, TagId$Document, Size, Owner, Notify, Status, TimeSubmitted, StartTime, UntilTime, ElapsedTime, PagesPrinted, JobId, Priority, Parameters$Drive, Description, MediaLoaded, MediaType, Name, Manufacturer, Status, TransferRate, MSIAdvancedSCSITargetId, MSIAdvancedPNPDevic$GroupName, Name, UserName$HardwareType, NumberOfButtons, Status, MSIAdvancedPNPDeviceID, MSIAdvancedPowerManagementSupported, MSIAdvancedDoubleSpeedThreshol$LocalName, RemoteName, ResourceType, ConnectionType, UserName$Name, ConnectionlessService, GuaranteesDelivery, GuaranteesSequencing, MSIAdvancedMaximumAddressSize, MSIAdvancedMaximumMessageSiz$Name, Description, PathName, ServiceType, Started, StartMode, State, Status, ErrorControl, AcceptPause, AcceptStop$Name, DriverName, PortName, ServerName$Name, MSIAdvancedPNPDeviceID$Name, MSIAdvancedPNPDeviceID, VideoProcessor, AdapterCompatibility, MSIAdvancedDescription, MSIAdvancedAdapterRAM, MSIAdvancedInst$Name, VariableValue, UserName$Win32_CDRomDrive$Win32_Environment$Win32_IDEController$Win32_InfraredDevice$Win32_Keyboard$Win32_LogicalProgramGroup$Win32_NetworkConnection$Win32_NetworkProtocol$Win32_POTSModem$Win32_ParallelPort$Win32_PointingDevice$Win32_PrintJob$Win32_Printer$Win32_SCSIController$Win32_Service$Win32_SoundDevice$Win32_StartupCommand$Win32_SystemDriver$Win32_VideoController
API String ID: 2145510954-269020594
Opcode ID: 411d9060192af6922504c4ce6f843cc5b6f5fd8c416719410114f62871a0b006
Instruction ID: 08f00d3cb6a8fdd8dcff3fd665435b95fc4cd3ce6172a92bd66557e6a9e21274
Opcode Fuzzy Hash: 411d9060192af6922504c4ce6f843cc5b6f5fd8c416719410114f62871a0b006
Instruction Fuzzy Hash: 04F18C60908A4796FB00AF2AEC98A65B7B0FF45355FD090B6C14DC6260DF7CA58ACF60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D7860, Relevance: 89.5, APIs: 49, Strings: 2, Instructions: 261COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D7897
#2783.MFC42U ref: 00007FF72A9D78AC
#2783.MFC42U ref: 00007FF72A9D78C6
#2783.MFC42U ref: 00007FF72A9D78D5
#620.MFC42U ref: 00007FF72A9D78EB
#626.MFC42U ref: 00007FF72A9D78F6
#626.MFC42U ref: 00007FF72A9D7901
#4436.MFC42U ref: 00007FF72A9D7916
#1040.MFC42U ref: 00007FF72A9D7952
#6050.MFC42U ref: 00007FF72A9D7970
#1122.MFC42U ref: 00007FF72A9D797E
#1040.MFC42U ref: 00007FF72A9D7989
#1126.MFC42U ref: 00007FF72A9D799A
#2783.MFC42U ref: 00007FF72A9D79AB
#6050.MFC42U ref: 00007FF72A9D79CC
#1122.MFC42U ref: 00007FF72A9D79DA
#1040.MFC42U ref: 00007FF72A9D79E5
#1259.MFC42U ref: 00007FF72A9D79F7
#1259.MFC42U ref: 00007FF72A9D7A09
#1122.MFC42U ref: 00007FF72A9D7A17

Strings

\root\, xrefs: 00007FF72A9D7AB5
cimv2, xrefs: 00007FF72A9D7A65

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #2783$#1040#1122$#1259#6050#626$#1126#4436#620#624
String ID: \root\$cimv2
API String ID: 2084944479-2123305542
Opcode ID: 73ceb55e98ba7c3aa0eb79623c8468733cc10f001e9d4d44b7f072301eb62d44
Instruction ID: 9650420ec16f136c950b26dc1d2c44ad32377dda8e2b9bb3a27b3641a67ae80f
Opcode Fuzzy Hash: 73ceb55e98ba7c3aa0eb79623c8468733cc10f001e9d4d44b7f072301eb62d44
Instruction Fuzzy Hash: 08C12922A04A13D6FB00AF66DC541BCB770FB45B96BD11072DA4EC66A4DF2CD98DCB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9E48B0, Relevance: 86.1, APIs: 37, Strings: 12, Instructions: 393COMMON

Download Yara Rule

APIs

#626.MFC42U ref: 00007FF72A9E48F1
#626.MFC42U ref: 00007FF72A9E48FC
#626.MFC42U ref: 00007FF72A9E4907
#626.MFC42U ref: 00007FF72A9E4912
#626.MFC42U ref: 00007FF72A9E491D
#626.MFC42U ref: 00007FF72A9E4928
#626.MFC42U ref: 00007FF72A9E4933
#626.MFC42U ref: 00007FF72A9E493E
#626.MFC42U ref: 00007FF72A9E4949
#626.MFC42U ref: 00007FF72A9E4954
#626.MFC42U ref: 00007FF72A9E495F
#2629.MFC42U ref: 00007FF72A9E49C8
#2629.MFC42U ref: 00007FF72A9E49D2
#2629.MFC42U ref: 00007FF72A9E49DC
#2629.MFC42U ref: 00007FF72A9E49E6
#2629.MFC42U ref: 00007FF72A9E49F0
#2629.MFC42U ref: 00007FF72A9E49FA
#2629.MFC42U ref: 00007FF72A9E4A04
#2629.MFC42U ref: 00007FF72A9E4A0E
#2629.MFC42U ref: 00007FF72A9E4A18
#2629.MFC42U ref: 00007FF72A9E4A22

Strings

FileSize, xrefs: 00007FF72A9E4C49
Version, xrefs: 00007FF72A9E4C7D
Win32_Process, xrefs: 00007FF72A9E4979
MinimumWorkingSetSize, xrefs: 00007FF72A9E4B38
CreationDate, xrefs: 00007FF72A9E4BA6, 00007FF72A9E4C12
ProcessID, xrefs: 00007FF72A9E4ACA
CIM_DataFile.Name='%s', xrefs: 00007FF72A9E4BBB
Name, ExecutablePath, ProcessID, Priority, MinimumWorkingSetSize, MaximumWorkingSetSize, CreationDate, xrefs: 00007FF72A9E496E
MaximumWorkingSetSize, xrefs: 00007FF72A9E4B6F
Name, xrefs: 00007FF72A9E4A5F
ExecutablePath, xrefs: 00007FF72A9E4A93
Priority, xrefs: 00007FF72A9E4B01

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #626$#2629
String ID: CIM_DataFile.Name='%s'$CreationDate$ExecutablePath$FileSize$MaximumWorkingSetSize$MinimumWorkingSetSize$Name$Name, ExecutablePath, ProcessID, Priority, MinimumWorkingSetSize, MaximumWorkingSetSize, CreationDate$Priority$ProcessID$Version$Win32_Process
API String ID: 3296578064-3881747719
Opcode ID: 2cec7d420e0d0caf3d2f929db1f37778add34b295067ff9e4a87fb10b91fb839
Instruction ID: 550464d63a1750d5a308599ee2913dbaa7b2cd9b4fab8a67e89b923d204a873b
Opcode Fuzzy Hash: 2cec7d420e0d0caf3d2f929db1f37778add34b295067ff9e4a87fb10b91fb839
Instruction Fuzzy Hash: 6C220876B08A06D6FB109F66D8402ACB770FB88B99F904172CE4D97B68DF38D549CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9DA938, Relevance: 82.5, APIs: 46, Strings: 1, Instructions: 261COMMON

Download Yara Rule

APIs

#626.MFC42U ref: 00007FF72A9DA96B
#626.MFC42U ref: 00007FF72A9DA976
#626.MFC42U ref: 00007FF72A9DA981
#624.MFC42U ref: 00007FF72A9DA993
#620.MFC42U ref: 00007FF72A9DA9A1
#2783.MFC42U ref: 00007FF72A9DA9C5
#6050.MFC42U ref: 00007FF72A9DA9EE
#2783.MFC42U ref: 00007FF72A9DAA00
#1040.MFC42U ref: 00007FF72A9DAA14
#1122.MFC42U ref: 00007FF72A9DAA27
#2629.MFC42U ref: 00007FF72A9DAA31
iswalpha.MSVCRT ref: 00007FF72A9DAAB7
#2783.MFC42U ref: 00007FF72A9DAAD4
#4436.MFC42U ref: 00007FF72A9DAAEB
#1122.MFC42U ref: 00007FF72A9DAAF9
#1040.MFC42U ref: 00007FF72A9DAB04
#6050.MFC42U ref: 00007FF72A9DAB1E
#1122.MFC42U ref: 00007FF72A9DAB2B
#1040.MFC42U ref: 00007FF72A9DAB36
#6705.MFC42U ref: 00007FF72A9DAB58
#6708.MFC42U ref: 00007FF72A9DAB62
#624.MFC42U ref: 00007FF72A9DAB73
#4436.MFC42U ref: 00007FF72A9DAB8A
#1122.MFC42U ref: 00007FF72A9DAC76
#1122.MFC42U ref: 00007FF72A9DAC96
#1040.MFC42U ref: 00007FF72A9DACA1
#1040.MFC42U ref: 00007FF72A9DACB3
#1040.MFC42U ref: 00007FF72A9DACBE
#1040.MFC42U ref: 00007FF72A9DACC9
#1040.MFC42U ref: 00007FF72A9DACD4
#1040.MFC42U ref: 00007FF72A9DACDF

Strings

MSIAdvanced, xrefs: 00007FF72A9DAB68

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040$#1122$#2783#626$#4436#6050#624$#2629#620#6705#6708iswalpha
String ID: MSIAdvanced
API String ID: 1385368612-1989392477
Opcode ID: ee3d414c1a470e450228d949333630ac67e9bd4b24430be373e60fc059080357
Instruction ID: c6b9d8421839e50995630b9db55f7cdb1609c06d7c4e414bb73bb72604289cc1
Opcode Fuzzy Hash: ee3d414c1a470e450228d949333630ac67e9bd4b24430be373e60fc059080357
Instruction Fuzzy Hash: 0BC15E32B0490296FB10AF66DC841ACB370FB45B99B914171CA4ED3AA4DF3CD98DCB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9DEB04, Relevance: 72.0, APIs: 39, Strings: 2, Instructions: 243COMMON

Download Yara Rule

APIs

#6886.MFC42U ref: 00007FF72A9DEB5A
#336.MFC42U ref: 00007FF72A9DEB70
#1646.MFC42U ref: 00007FF72A9DEB8F
#622.MFC42U ref: 00007FF72A9DEBB4
#626.MFC42U ref: 00007FF72A9DEBC0
#626.MFC42U ref: 00007FF72A9DEBCF
#626.MFC42U ref: 00007FF72A9DEBDE
#626.MFC42U ref: 00007FF72A9DEBEA
#626.MFC42U ref: 00007FF72A9DEBF9
#4473.MFC42U ref: 00007FF72A9DEC0A
#4473.MFC42U ref: 00007FF72A9DEC1D
#4473.MFC42U ref: 00007FF72A9DEC30
#4473.MFC42U ref: 00007FF72A9DEC40
#4473.MFC42U ref: 00007FF72A9DEC53
_wtol.MSVCRT ref: 00007FF72A9DEC65
_wtoi.MSVCRT ref: 00007FF72A9DEC74
_wtoi.MSVCRT ref: 00007FF72A9DEC8A
_wtoi.MSVCRT ref: 00007FF72A9DECA0
_wtoi.MSVCRT ref: 00007FF72A9DECB3
#6705.MFC42U ref: 00007FF72A9DECC4
#622.MFC42U ref: 00007FF72A9DECE6
#1040.MFC42U ref: 00007FF72A9DED27
#1122.MFC42U ref: 00007FF72A9DED42
#6886.MFC42U ref: 00007FF72A9DED4D
#1040.MFC42U ref: 00007FF72A9DED86
#1040.MFC42U ref: 00007FF72A9DED92
#1040.MFC42U ref: 00007FF72A9DEDA1
#1040.MFC42U ref: 00007FF72A9DEDB0
#1040.MFC42U ref: 00007FF72A9DEDBC
#1040.MFC42U ref: 00007FF72A9DEDCB
GetDeviceCaps.GDI32 ref: 00007FF72A9DEDE3
CreateFontW.GDI32 ref: 00007FF72A9DEE54
#1647.MFC42U ref: 00007FF72A9DEE60
memset.MSVCRT ref: 00007FF72A9DEE90
#626.MFC42U ref: 00007FF72A9DEEA4
#4473.MFC42U ref: 00007FF72A9DEEB8
StartDocW.GDI32 ref: 00007FF72A9DEEDE
StartPage.GDI32 ref: 00007FF72A9DEEEC
#1040.MFC42U ref: 00007FF72A9DEF06

Strings

facename, xrefs: 00007FF72A9DECD7
Courier New, xrefs: 00007FF72A9DEBA5

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040$#4473#626$_wtoi$#622#6886Start$#1122#1646#1647#336#6705CapsCreateDeviceFontPage_wtolmemset
String ID: Courier New$facename
API String ID: 1366719250-2780318960
Opcode ID: 84f5c2e5b08a9b5756a573ebc68c1105b480b25ced378bb7c9c0c5fc6a02e535
Instruction ID: a903c6105d90000c0f577c7745bb81c8763661cbde290f6ffea1cd221e52c404
Opcode Fuzzy Hash: 84f5c2e5b08a9b5756a573ebc68c1105b480b25ced378bb7c9c0c5fc6a02e535
Instruction Fuzzy Hash: F4B14232609A8282F764AF16EC54269B3A4FB85B95F904075CB8EC3B64DF3CD499CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9E044C, Relevance: 65.0, APIs: 33, Strings: 4, Instructions: 240COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9E049E
#624.MFC42U ref: 00007FF72A9E04B0
#624.MFC42U ref: 00007FF72A9E04C2
#626.MFC42U ref: 00007FF72A9E04E2
#626.MFC42U ref: 00007FF72A9E04ED
#626.MFC42U ref: 00007FF72A9E04F8
#1040.MFC42U ref: 00007FF72A9E0745
#1040.MFC42U ref: 00007FF72A9E0750
#1040.MFC42U ref: 00007FF72A9E075B
GetTickCount.KERNEL32 ref: 00007FF72A9E079E

Strings

Win32_CIMLogicalDeviceCIMDataFile, xrefs: 00007FF72A9E04A5
Antecedent, xrefs: 00007FF72A9E054F
Win32_PnPAllocatedResource, xrefs: 00007FF72A9E0493
Dependent, xrefs: 00007FF72A9E0573

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040#624#626$CountTick
String ID: Antecedent$Dependent$Win32_CIMLogicalDeviceCIMDataFile$Win32_PnPAllocatedResource
API String ID: 3853208860-1470127382
Opcode ID: 967790ab0ff7f6e124075a269a7d7b59806321f96e3408a7607a7acf07958bee
Instruction ID: 1df28846273478fe1fd921a9705367cb5aadf96fc61856a9501089a982562d98
Opcode Fuzzy Hash: 967790ab0ff7f6e124075a269a7d7b59806321f96e3408a7607a7acf07958bee
Instruction Fuzzy Hash: 75B11B22B08A4796FB00AF66DC542ACB370FB55B89F944172CE4ED36A4DF38D54ACB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9DE530, Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 221COMMON

Download Yara Rule

APIs

#626.MFC42U ref: 00007FF72A9DE55F
#626.MFC42U ref: 00007FF72A9DE56A
#4473.MFC42U ref: 00007FF72A9DE57A
#1122.MFC42U ref: 00007FF72A9DE588
#626.MFC42U ref: 00007FF72A9DE592
#626.MFC42U ref: 00007FF72A9DE59D
#1284.MFC42U ref: 00007FF72A9DE5C4
#4473.MFC42U ref: 00007FF72A9DE5D3
#1284.MFC42U ref: 00007FF72A9DE5E1
#622.MFC42U ref: 00007FF72A9DE5F5

Part of subcall function 00007FF72A9DE888: #6708.MFC42U(?,?,?,?,?,?,00000000), ref: 00007FF72A9DE8B1
Part of subcall function 00007FF72A9DE888: GetTextExtentPoint32W.GDI32 ref: 00007FF72A9DE8E0
Part of subcall function 00007FF72A9DE888: GetDeviceCaps.GDI32 ref: 00007FF72A9DE8F8
Part of subcall function 00007FF72A9DE888: GetDeviceCaps.GDI32 ref: 00007FF72A9DE903
Part of subcall function 00007FF72A9DE888: StartPage.GDI32 ref: 00007FF72A9DE94F
Part of subcall function 00007FF72A9DE888: GetDeviceCaps.GDI32 ref: 00007FF72A9DE96C
Part of subcall function 00007FF72A9DE888: #626.MFC42U(?,?,?,?,?,?,00000000), ref: 00007FF72A9DE981
Part of subcall function 00007FF72A9DE888: #1286.MFC42U(?,?,?,?,?,?,00000000), ref: 00007FF72A9DE9B6
Part of subcall function 00007FF72A9DE888: GetTextExtentPoint32W.GDI32 ref: 00007FF72A9DE9D0

#620.MFC42U ref: 00007FF72A9DE60E

Part of subcall function 00007FF72A9DE888: #1040.MFC42U(?,?,?,?,?,?,00000000), ref: 00007FF72A9DEA93

#626.MFC42U ref: 00007FF72A9DE63B
#622.MFC42U ref: 00007FF72A9DE64D
#622.MFC42U ref: 00007FF72A9DE65B

Part of subcall function 00007FF72A9DE888: #4436.MFC42U(?,?,?,?,?,?,00000000), ref: 00007FF72A9DEA08
Part of subcall function 00007FF72A9DE888: #1122.MFC42U(?,?,?,?,?,?,00000000), ref: 00007FF72A9DEA16
Part of subcall function 00007FF72A9DE888: #1040.MFC42U(?,?,?,?,?,?,00000000), ref: 00007FF72A9DEA21
Part of subcall function 00007FF72A9DE888: TextOutW.GDI32(?,?,?,?,?,?,00000000), ref: 00007FF72A9DEA62
Part of subcall function 00007FF72A9DE888: #6050.MFC42U(?,?,?,?,?,?,00000000), ref: 00007FF72A9DEA7D
Part of subcall function 00007FF72A9DE888: TextOutW.GDI32(?,?,?,?,?,?,00000000), ref: 00007FF72A9DEAE7

#626.MFC42U ref: 00007FF72A9DE67C
#4473.MFC42U ref: 00007FF72A9DE68C
#620.MFC42U ref: 00007FF72A9DE69A
#626.MFC42U ref: 00007FF72A9DE6BF
#1284.MFC42U ref: 00007FF72A9DE701
#1284.MFC42U ref: 00007FF72A9DE70F
#620.MFC42U ref: 00007FF72A9DE724
#1124.MFC42U ref: 00007FF72A9DE73C
#626.MFC42U ref: 00007FF72A9DE746
#1122.MFC42U ref: 00007FF72A9DE775
#1284.MFC42U ref: 00007FF72A9DE783
#1284.MFC42U ref: 00007FF72A9DE791
#620.MFC42U ref: 00007FF72A9DE7A8
#1124.MFC42U ref: 00007FF72A9DE7C4
#1040.MFC42U ref: 00007FF72A9DE7D5
#1040.MFC42U ref: 00007FF72A9DE7E0
#1040.MFC42U ref: 00007FF72A9DE833
#1040.MFC42U ref: 00007FF72A9DE83E
#1040.MFC42U ref: 00007FF72A9DE849
#1040.MFC42U ref: 00007FF72A9DE854
#1040.MFC42U ref: 00007FF72A9DE85F
#1040.MFC42U ref: 00007FF72A9DE86A

Strings

, xrefs: 00007FF72A9DE642

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040$#626$#1284$#620Text$#1122#4473#622CapsDevice$#1124ExtentPoint32$#1286#4436#6050#6708PageStart
String ID:
API String ID: 3984351784-399585960
Opcode ID: 6ade4b85d3fa46687568fd7b5b8ce18b45ce9a3b673ac188330dc9beb8031c3d
Instruction ID: 14972d4d1a373583b8b91bd469e87a3bb600df8f1a84d15df8d3d72476492a82
Opcode Fuzzy Hash: 6ade4b85d3fa46687568fd7b5b8ce18b45ce9a3b673ac188330dc9beb8031c3d
Instruction Fuzzy Hash: 83A1FD32B0890796FB10AF66DC541ACB370FB55B89BD040B2CA4ED6A68DF38D59DCB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9E4F40, Relevance: 54.5, APIs: 28, Strings: 3, Instructions: 262COMMON

Download Yara Rule

APIs

#626.MFC42U ref: 00007FF72A9E4F7B
#628.MFC42U ref: 00007FF72A9E4F8B
#4521.MFC42U ref: 00007FF72A9E500E
#2785.MFC42U ref: 00007FF72A9E501F
#1383.MFC42U ref: 00007FF72A9E5032
#626.MFC42U ref: 00007FF72A9E5076
#1040.MFC42U ref: 00007FF72A9E5319
#1042.MFC42U ref: 00007FF72A9E5324
#1040.MFC42U ref: 00007FF72A9E532F

Strings

FileName, Version, FileSize, CreationDate, Manufacturer, Name, xrefs: 00007FF72A9E5126
Antecedent, xrefs: 00007FF72A9E4FF5
CIM_ProcessExecutable, xrefs: 00007FF72A9E4FA1

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040#626$#1042#1383#2785#4521#628
String ID: Antecedent$CIM_ProcessExecutable$FileName, Version, FileSize, CreationDate, Manufacturer, Name
API String ID: 337054143-240683506
Opcode ID: 2d1d23f33113e3a6e44000f7db036aa5a61a84b2769b3eb2e2e228315172099e
Instruction ID: 9eaafe53102c2f0f9b07da30b85e94ea83464756635983016b0bcccf41c6188d
Opcode Fuzzy Hash: 2d1d23f33113e3a6e44000f7db036aa5a61a84b2769b3eb2e2e228315172099e
Instruction Fuzzy Hash: 80D11832B08A4796FB10AF66DC542ACB330FB55B99F804072CA4ED7668DF38D549CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9DD800, Relevance: 51.3, APIs: 34, Instructions: 265COMMON

Download Yara Rule

APIs

#626.MFC42U ref: 00007FF72A9DD82A
#626.MFC42U ref: 00007FF72A9DD835
#4473.MFC42U ref: 00007FF72A9DD845
#1122.MFC42U ref: 00007FF72A9DD853
#626.MFC42U ref: 00007FF72A9DD85D
#626.MFC42U ref: 00007FF72A9DD868
#1284.MFC42U ref: 00007FF72A9DD88F
#4473.MFC42U ref: 00007FF72A9DD89E
#1284.MFC42U ref: 00007FF72A9DD8AC
#622.MFC42U ref: 00007FF72A9DD8C0
#620.MFC42U ref: 00007FF72A9DD8E4
#626.MFC42U ref: 00007FF72A9DD91C
#622.MFC42U ref: 00007FF72A9DD92E
#622.MFC42U ref: 00007FF72A9DD93C
#622.MFC42U ref: 00007FF72A9DD95F
#626.MFC42U ref: 00007FF72A9DD98D
#4473.MFC42U ref: 00007FF72A9DD99D
#620.MFC42U ref: 00007FF72A9DD9AB
#620.MFC42U ref: 00007FF72A9DDA07
#620.MFC42U ref: 00007FF72A9DDA2B
#622.MFC42U ref: 00007FF72A9DDA55
#626.MFC42U ref: 00007FF72A9DDA75
#1122.MFC42U ref: 00007FF72A9DDAB0
#4473.MFC42U ref: 00007FF72A9DDAC1
#620.MFC42U ref: 00007FF72A9DDACF
#620.MFC42U ref: 00007FF72A9DDAF3
#622.MFC42U ref: 00007FF72A9DDB27
#1040.MFC42U ref: 00007FF72A9DDB52
#1040.MFC42U ref: 00007FF72A9DDBA5
#1040.MFC42U ref: 00007FF72A9DDBB0
#1040.MFC42U ref: 00007FF72A9DDBBB
#1040.MFC42U ref: 00007FF72A9DDBC6
#1040.MFC42U ref: 00007FF72A9DDBD1
#1040.MFC42U ref: 00007FF72A9DDBDC

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040#626$#620#622$#4473$#1122#1284
String ID:
API String ID: 4087260484-0
Opcode ID: 05e8663b9f17e6353925fd6a870e1b78b784616e39163e095d1532c26e0c7b70
Instruction ID: e4ac8f8d732cc5a6dda4322c05cc66546b5ce572b856b2d9c57611536b47a738
Opcode Fuzzy Hash: 05e8663b9f17e6353925fd6a870e1b78b784616e39163e095d1532c26e0c7b70
Instruction Fuzzy Hash: 2EC1D862B04A4696FB00AF66DC541ACA730FB49F89B904072CE4ED7668DF3DD54ACB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9DD1FC, Relevance: 49.4, APIs: 27, Strings: 1, Instructions: 371windowCOMMON

Download Yara Rule

APIs

#6886.MFC42U ref: 00007FF72A9DD226
#369.MFC42U ref: 00007FF72A9DD23F
#6886.MFC42U ref: 00007FF72A9DD261
#626.MFC42U ref: 00007FF72A9DD2EA
#626.MFC42U ref: 00007FF72A9DD2F6
#1463.MFC42U ref: 00007FF72A9DD304
#4473.MFC42U ref: 00007FF72A9DD318
#4473.MFC42U ref: 00007FF72A9DD328
MessageBoxW.USER32 ref: 00007FF72A9DD33D
#1040.MFC42U ref: 00007FF72A9DD349
#1040.MFC42U ref: 00007FF72A9DD355
#6886.MFC42U ref: 00007FF72A9DD39B
#626.MFC42U ref: 00007FF72A9DD406
#626.MFC42U ref: 00007FF72A9DD412
#1463.MFC42U ref: 00007FF72A9DD420
#4473.MFC42U ref: 00007FF72A9DD434
#4473.MFC42U ref: 00007FF72A9DD444
MessageBoxW.USER32 ref: 00007FF72A9DD459
#1040.MFC42U ref: 00007FF72A9DD465
#1040.MFC42U ref: 00007FF72A9DD471

Strings

(%s), xrefs: 00007FF72A9DD4A0

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040#4473#626$#6886$#1463Message$#369
String ID: (%s)
API String ID: 1212076415-440625562
Opcode ID: 10e017698194cacabb72d4ce187a9c3d450b2a0290b8a03cf2e97a6756b7d48b
Instruction ID: 50d9b7aeebfcebca899180c86a156f12d14bef1f67e713496febf6d45fbc4e67
Opcode Fuzzy Hash: 10e017698194cacabb72d4ce187a9c3d450b2a0290b8a03cf2e97a6756b7d48b
Instruction Fuzzy Hash: 70F15F21A09F0681FB20BB1AEC54279A760EB85B94F944071DACEC7BB4DF3CE585CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9DF8E0, Relevance: 49.3, APIs: 21, Strings: 7, Instructions: 281COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF72A9DF924
GetNativeSystemInfo.KERNEL32 ref: 00007FF72A9DF92D
#626.MFC42U ref: 00007FF72A9DF937
#624.MFC42U ref: 00007FF72A9DF9D1
#624.MFC42U ref: 00007FF72A9DF9E3
#624.MFC42U ref: 00007FF72A9DF9F5
#624.MFC42U ref: 00007FF72A9DFA07
GetSystemWow64DirectoryW.KERNEL32 ref: 00007FF72A9DFA60
#1126.MFC42U ref: 00007FF72A9DFA7A
free.MSVCRT ref: 00007FF72A9DFA83
#626.MFC42U ref: 00007FF72A9DFAA0
#2846.MFC42U ref: 00007FF72A9DFABE
#1040.MFC42U ref: 00007FF72A9DFB4E
#1122.MFC42U ref: 00007FF72A9DFB8A
#1040.MFC42U ref: 00007FF72A9DFB95
#1040.MFC42U ref: 00007FF72A9DFBE0
#626.MFC42U ref: 00007FF72A9DFC05
#2846.MFC42U ref: 00007FF72A9DFC23
#1040.MFC42U ref: 00007FF72A9DFCB3
#1040.MFC42U ref: 00007FF72A9DFCE9
#1040.MFC42U ref: 00007FF72A9DFD11

Strings

CIM_DataFile.Name='%s\%s', xrefs: 00007FF72A9DFAB3, 00007FF72A9DFC18
SystemDirectory, xrefs: 00007FF72A9DFB6D
wsock32.dll, xrefs: 00007FF72A9DF9D8
Name, FileSize, Version, xrefs: 00007FF72A9DFB08, 00007FF72A9DFC6D
winsock.dll, xrefs: 00007FF72A9DF9C6
wsock32n.dll, xrefs: 00007FF72A9DF9EA
Win32_OperatingSystem, xrefs: 00007FF72A9DF95B

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040$#624$#626$#2846System$#1122#1126DirectoryInfoNativeWow64freememset
String ID: CIM_DataFile.Name='%s\%s'$Name, FileSize, Version$SystemDirectory$Win32_OperatingSystem$winsock.dll$wsock32.dll$wsock32n.dll
API String ID: 1343741336-3688877225
Opcode ID: 2841e64238242eb6f2dacc06468e4686d870a7e53217aec2f1ee954f2cd5c02b
Instruction ID: 05356d5c9f9d51531c3980e56b4592e3689711c425aaf90b4c0e50c4cc1e069b
Opcode Fuzzy Hash: 2841e64238242eb6f2dacc06468e4686d870a7e53217aec2f1ee954f2cd5c02b
Instruction Fuzzy Hash: E7D12A26B08A0696FB10EF66D8542ACB371FB44B98B814072CE8DD7764DF38D589CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9E1C00, Relevance: 44.0, APIs: 19, Strings: 6, Instructions: 258libraryloaderCOMMON

Download Yara Rule

APIs

#626.MFC42U ref: 00007FF72A9E1C45
#626.MFC42U ref: 00007FF72A9E1C51
#4473.MFC42U ref: 00007FF72A9E1C73
#6641.MFC42U ref: 00007FF72A9E1C8A
#1122.MFC42U ref: 00007FF72A9E1C99
#1040.MFC42U ref: 00007FF72A9E1CA5
#4473.MFC42U ref: 00007FF72A9E1CB5
LoadLibraryExW.KERNEL32 ref: 00007FF72A9E1CDA
GetLastError.KERNEL32 ref: 00007FF72A9E1CE8
GetProcAddress.KERNEL32 ref: 00007FF72A9E1D0B
#4473.MFC42U ref: 00007FF72A9E1D67
GetProcAddress.KERNEL32 ref: 00007FF72A9E1EC6
GetProcAddress.KERNEL32 ref: 00007FF72A9E1EFF
GetProcAddress.KERNEL32 ref: 00007FF72A9E1F83
FreeLibrary.KERNEL32 ref: 00007FF72A9E1FBF
#1040.MFC42U ref: 00007FF72A9E200B
#1040.MFC42U ref: 00007FF72A9E2017

Strings

FveQueryDeviceEncryptionSupport, xrefs: 00007FF72A9E1D01
NgscbGetWinReConfiguration, xrefs: 00007FF72A9E1EF5
NgscbIsHostOsOnRoamableDrive, xrefs: 00007FF72A9E1E62
fveapi.dll, xrefs: 00007FF72A9E1CD3
NgscbCheckPreventDeviceEncryption, xrefs: 00007FF72A9E1EBC
FveCheckTpmCapability, xrefs: 00007FF72A9E1F79

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$#1040#4473$#626Library$#1122#6641ErrorFreeLastLoad
String ID: FveCheckTpmCapability$FveQueryDeviceEncryptionSupport$NgscbCheckPreventDeviceEncryption$NgscbGetWinReConfiguration$NgscbIsHostOsOnRoamableDrive$fveapi.dll
API String ID: 2451326352-3911767899
Opcode ID: edc2e5528a6f53398729398c13033451ef0027c485903aba9c49cbe42b7f840a
Instruction ID: 8af26c62300d0c6519c34f61a812eaed16551550cd7f021b15c6dd2baaaf05f6
Opcode Fuzzy Hash: edc2e5528a6f53398729398c13033451ef0027c485903aba9c49cbe42b7f840a
Instruction Fuzzy Hash: B5C1513260DA8292FB14EB56E9406AAE760FBA1740FE00076E68DC3A65DF3DD549CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D909C, Relevance: 43.9, APIs: 22, Strings: 3, Instructions: 111COMMON

Download Yara Rule

APIs

#626.MFC42U ref: 00007FF72A9D90DA
#626.MFC42U ref: 00007FF72A9D9101
#624.MFC42U ref: 00007FF72A9D9133
CoCreateGuid.OLE32 ref: 00007FF72A9D913E
StringFromCLSID.OLE32 ref: 00007FF72A9D9150
#1126.MFC42U ref: 00007FF72A9D9162
CoTaskMemFree.OLE32 ref: 00007FF72A9D916C
GetTickCount.KERNEL32 ref: 00007FF72A9D917C
#2846.MFC42U ref: 00007FF72A9D9190
#624.MFC42U ref: 00007FF72A9D91A1
#1259.MFC42U ref: 00007FF72A9D91B3
CreateEventW.KERNEL32 ref: 00007FF72A9D91C8
#1040.MFC42U ref: 00007FF72A9D91D6
#1040.MFC42U ref: 00007FF72A9D91E1
#624.MFC42U ref: 00007FF72A9D91F2
#1259.MFC42U ref: 00007FF72A9D9204
CreateEventW.KERNEL32 ref: 00007FF72A9D9214
#1040.MFC42U ref: 00007FF72A9D9222
#1040.MFC42U ref: 00007FF72A9D922D
InitializeCriticalSection.KERNEL32 ref: 00007FF72A9D9237
InitializeCriticalSection.KERNEL32 ref: 00007FF72A9D9241
#1040.MFC42U ref: 00007FF72A9D924C

Strings

MSInfoStart, xrefs: 00007FF72A9D91E7
MSInfoDone, xrefs: 00007FF72A9D9196
%08x, xrefs: 00007FF72A9D9185

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040$#624Create$#1259#626CriticalEventInitializeSection$#1126#2846CountFreeFromGuidStringTaskTick
String ID: %08x$MSInfoDone$MSInfoStart
API String ID: 78435787-2137078265
Opcode ID: 6822c1ca05de65b677cdb92adac1d4f3aa986e13c1cda2bae402f2e2ce152064
Instruction ID: 755173c4c92efe37d8a481e53e6214e7dd71844627b711eb3c2ad2e0fced0920
Opcode Fuzzy Hash: 6822c1ca05de65b677cdb92adac1d4f3aa986e13c1cda2bae402f2e2ce152064
Instruction Fuzzy Hash: CA511832B04A0696FB00AF62DC543AD7371FB45B95F900076CA4ED7A64DF38E599CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9E4240, Relevance: 42.2, APIs: 7, Strings: 17, Instructions: 227COMMON

Download Yara Rule

APIs

#568.MFC42U ref: 00007FF72A9E4280
#1381.MFC42U ref: 00007FF72A9E43EB
#1483.MFC42U ref: 00007FF72A9E4450
#1040.MFC42U ref: 00007FF72A9E4524
#6880.MFC42U ref: 00007FF72A9E455B
#5950.MFC42U ref: 00007FF72A9E4566
#1006.MFC42U ref: 00007FF72A9E4592

Strings

FileSize, xrefs: 00007FF72A9E3F9C
Win32_NetworkAdapterConfiguration, xrefs: 00007FF72A9E4376
Version, xrefs: 00007FF72A9E3FB8
Caption, AdapterType, MSIAdvancedProductName, MSIAdvancedInstalled, MSIAdvancedPNPDeviceID, MSIAdvancedTimeOfLastReset, MSIAdvance, xrefs: 00007FF72A9E4290, 00007FF72A9E4317
CreationDate, xrefs: 00007FF72A9E3FEC
__CLASS, xrefs: 00007FF72A9E3E51
Win32_DeviceMemoryAddress, xrefs: 00007FF72A9E3EC7
Index, xrefs: 00007FF72A9E4345, 00007FF72A9E439F, 00007FF72A9E4471
Win32_IRQResource, xrefs: 00007FF72A9E3E75
CIM_DataFile, xrefs: 00007FF72A9E3EE1, 00007FF72A9E3F40
ServiceName, IPAddress, IPSubnet, DefaultIPGateway, DHCPEnabled, MSIAdvancedDHCPServer, MSIAdvancedDHCPLeaseExpires, MSIAdvancedDH, xrefs: 00007FF72A9E42DE, 00007FF72A9E449C, 00007FF72A9E44C5
Caption, xrefs: 00007FF72A9E3F27
Win32_PortResource, xrefs: 00007FF72A9E3E93
Win32_DMAChannel, xrefs: 00007FF72A9E3EAD
Win32_PnPEntity.DeviceID="%s", xrefs: 00007FF72A9E3DA1
Win32_NetworkAdapter, xrefs: 00007FF72A9E429B
PNPDeviceID, xrefs: 00007FF72A9E44D3

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1006#1040#1381#1483#568#5950#6880
String ID: CIM_DataFile$Caption$Caption, AdapterType, MSIAdvancedProductName, MSIAdvancedInstalled, MSIAdvancedPNPDeviceID, MSIAdvancedTimeOfLastReset, MSIAdvance$CreationDate$FileSize$Index$PNPDeviceID$ServiceName, IPAddress, IPSubnet, DefaultIPGateway, DHCPEnabled, MSIAdvancedDHCPServer, MSIAdvancedDHCPLeaseExpires, MSIAdvancedDH$Version$Win32_DMAChannel$Win32_DeviceMemoryAddress$Win32_IRQResource$Win32_NetworkAdapter$Win32_NetworkAdapterConfiguration$Win32_PnPEntity.DeviceID="%s"$Win32_PortResource$__CLASS
API String ID: 240093352-983493820
Opcode ID: 8da3edde5d8a88810689a24032e5a00d79f648107da86e437d16ff7efe47f919
Instruction ID: 466a9cc0d879043960a6f0851fe40691d1d0560c3cd0c8572ce8bd3e52f7c2f3
Opcode Fuzzy Hash: 8da3edde5d8a88810689a24032e5a00d79f648107da86e437d16ff7efe47f919
Instruction Fuzzy Hash: A3B12766B08A4685FB10DF67D8401ACA7B0FB89F88B844072DE8D93BA4DF39D545CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9E60E0, Relevance: 40.6, APIs: 27, Instructions: 144COMMON

Download Yara Rule

APIs

#626.MFC42U ref: 00007FF72A9E6122
#626.MFC42U ref: 00007FF72A9E612E
#626.MFC42U ref: 00007FF72A9E613A
GetTempPathW.KERNEL32 ref: 00007FF72A9E614D
#1126.MFC42U ref: 00007FF72A9E6163
#4473.MFC42U ref: 00007FF72A9E6178
#1126.MFC42U ref: 00007FF72A9E6188
#624.MFC42U ref: 00007FF72A9E619A
#6050.MFC42U ref: 00007FF72A9E61B3
#1040.MFC42U ref: 00007FF72A9E61E0
#1040.MFC42U ref: 00007FF72A9E61EC
#1259.MFC42U ref: 00007FF72A9E6205
#1122.MFC42U ref: 00007FF72A9E6214
#1040.MFC42U ref: 00007FF72A9E6289
CreateDirectoryExW.KERNEL32 ref: 00007FF72A9E62A9
GetLastError.KERNEL32 ref: 00007FF72A9E62B3
#1124.MFC42U ref: 00007FF72A9E62CA
#1040.MFC42U ref: 00007FF72A9E62EA
#1040.MFC42U ref: 00007FF72A9E62F6
#1040.MFC42U ref: 00007FF72A9E6302

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040$#626$#1126$#1122#1124#1259#4473#6050#624CreateDirectoryErrorLastPathTemp
String ID:
API String ID: 1440905893-0
Opcode ID: 73e69c9fc100f9bbd87430763eca5c2d94187731cc7c26902284eb01646e7757
Instruction ID: f8b28fea81d0cfded3f7e1760ba9ba56785f99d78709eefee32749ef4129b3c6
Opcode Fuzzy Hash: 73e69c9fc100f9bbd87430763eca5c2d94187731cc7c26902284eb01646e7757
Instruction Fuzzy Hash: 3F614D2261CA8392FB10AB12EC541A9B370FB99B95FD01172D68EC2668DF3CD58DCF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D69E0, Relevance: 40.4, APIs: 22, Strings: 1, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF72A9D6A0E
SafeArrayGetDim.OLEAUT32 ref: 00007FF72A9D6A5A
SafeArrayGetLBound.OLEAUT32 ref: 00007FF72A9D6A7B
SafeArrayGetUBound.OLEAUT32 ref: 00007FF72A9D6A8B
SafeArrayGetElement.OLEAUT32 ref: 00007FF72A9D6AB0
SysStringLen.OLEAUT32 ref: 00007FF72A9D6ADF
#1126.MFC42U ref: 00007FF72A9D6B0B
VariantChangeType.OLEAUT32 ref: 00007FF72A9D6B2B
SysAllocString.OLEAUT32 ref: 00007FF72A9D6B3D
SysStringLen.OLEAUT32 ref: 00007FF72A9D6B57
#626.MFC42U ref: 00007FF72A9D6B97
#1286.MFC42U ref: 00007FF72A9D6BB7
#626.MFC42U ref: 00007FF72A9D6BC3
#2846.MFC42U ref: 00007FF72A9D6BD9
#1284.MFC42U ref: 00007FF72A9D6BE7
#1040.MFC42U ref: 00007FF72A9D6BF2
#1122.MFC42U ref: 00007FF72A9D6C08
#1040.MFC42U ref: 00007FF72A9D6C13
#1126.MFC42U ref: 00007FF72A9D6C21
SysFreeString.OLEAUT32 ref: 00007FF72A9D6C2B
#6705.MFC42U ref: 00007FF72A9D6C3C
VariantClear.OLEAUT32 ref: 00007FF72A9D6C46

Strings

&#x%04x;, xrefs: 00007FF72A9D6BCE

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: ArraySafeString$Variant$#1040#1126#626Bound$#1122#1284#1286#2846#6705AllocChangeClearElementFreeInitType
String ID: &#x%04x;
API String ID: 3695369597-3482982230
Opcode ID: dec1e65d3530692364032acfde9ccc3c18d83559e858daea50f14e784fb585cc
Instruction ID: 313bacd69d65a6aa800ee0e7de8a7dc7240415ccb9ce71e5e6cbbb51a1540522
Opcode Fuzzy Hash: dec1e65d3530692364032acfde9ccc3c18d83559e858daea50f14e784fb585cc
Instruction Fuzzy Hash: 94714B22B18A5386FB00AF66DC541BCB761FB44B99B904071DF8ED3A98DF3DD4898B50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9E8A24, Relevance: 39.3, APIs: 26, Instructions: 312COMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 00007FF72A9E8A68
GetWindowRect.USER32 ref: 00007FF72A9E8A79
GetWindowRect.USER32 ref: 00007FF72A9E8A8A
GetWindowRect.USER32 ref: 00007FF72A9E8A9B
GetWindowRect.USER32 ref: 00007FF72A9E8AAC
GetWindowRect.USER32 ref: 00007FF72A9E8ABD
GetWindowRect.USER32 ref: 00007FF72A9E8ACE
InflateRect.USER32 ref: 00007FF72A9E8AE9
InflateRect.USER32 ref: 00007FF72A9E8B81

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: Rect$Window$Inflate$Client
String ID:
API String ID: 2472249040-0
Opcode ID: af5f0ec3b8e80f5ec4a88da630daab0c0dd69fe9ad4447557a2ea91f08802f34
Instruction ID: 7a84b0a53c0f96b0da9736fd3157c56f8f574ded37a631e134e94ca2eb2ec197
Opcode Fuzzy Hash: af5f0ec3b8e80f5ec4a88da630daab0c0dd69fe9ad4447557a2ea91f08802f34
Instruction Fuzzy Hash: DEF13433B245528FE724DFBAD8849AC7771F788788B504221EA49A3A4CDF38E915CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9EC2C0, Relevance: 31.6, APIs: 13, Strings: 5, Instructions: 117COMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32 ref: 00007FF72A9EC2DF
CommandLineToArgvW.SHELL32 ref: 00007FF72A9EC2ED
_wcsicmp.MSVCRT ref: 00007FF72A9EC345
_wcsicmp.MSVCRT ref: 00007FF72A9EC35D
_wcsicmp.MSVCRT ref: 00007FF72A9EC381
#1126.MFC42U ref: 00007FF72A9EC39D
_wcsicmp.MSVCRT ref: 00007FF72A9EC3B7
#1126.MFC42U ref: 00007FF72A9EC3D3
#1126.MFC42U ref: 00007FF72A9EC45E
WinSqmAddToStream.NTDLL ref: 00007FF72A9EC486

Strings

help, xrefs: 00007FF72A9EC353
report, xrefs: 00007FF72A9EC3AD
category, xrefs: 00007FF72A9EC413
nfo, xrefs: 00007FF72A9EC377
computer, xrefs: 00007FF72A9EC3E0

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: _wcsicmp$#1126$CommandLine$ArgvStream
String ID: category$computer$help$nfo$report
API String ID: 3023956975-2197154551
Opcode ID: dd57c27a3e2fb093dbee0c48663c9ece98d63fd635a0705210a64f7ef306ce7b
Instruction ID: e04588210a2d0f6de7bc1111ec8f12613a610cebcdfda928c933b7978738c495
Opcode Fuzzy Hash: dd57c27a3e2fb093dbee0c48663c9ece98d63fd635a0705210a64f7ef306ce7b
Instruction Fuzzy Hash: 90514B21A0C64396FB15AF26ED40679B3A1EF54790FC440B2D9CED2265EE3CE445CAA0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9DE888, Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 182COMMON

Download Yara Rule

APIs

#6708.MFC42U(?,?,?,?,?,?,00000000), ref: 00007FF72A9DE8B1

Part of subcall function 00007FF72A9E38B0: #620.MFC42U ref: 00007FF72A9E38E0
Part of subcall function 00007FF72A9E38B0: #626.MFC42U ref: 00007FF72A9E38EB
Part of subcall function 00007FF72A9E38B0: #624.MFC42U ref: 00007FF72A9E38F9
Part of subcall function 00007FF72A9E38B0: #624.MFC42U ref: 00007FF72A9E3907
Part of subcall function 00007FF72A9E38B0: #2783.MFC42U ref: 00007FF72A9E3927
Part of subcall function 00007FF72A9E38B0: #1284.MFC42U ref: 00007FF72A9E393C
Part of subcall function 00007FF72A9E38B0: #2629.MFC42U ref: 00007FF72A9E3946
Part of subcall function 00007FF72A9E38B0: #4436.MFC42U ref: 00007FF72A9E3959
Part of subcall function 00007FF72A9E38B0: #1284.MFC42U ref: 00007FF72A9E3967
Part of subcall function 00007FF72A9E38B0: #1040.MFC42U ref: 00007FF72A9E3972
Part of subcall function 00007FF72A9E38B0: #1284.MFC42U ref: 00007FF72A9E3980
Part of subcall function 00007FF72A9E38B0: #6050.MFC42U ref: 00007FF72A9E399C
Part of subcall function 00007FF72A9E38B0: #1122.MFC42U ref: 00007FF72A9E39AA
Part of subcall function 00007FF72A9E38B0: #1040.MFC42U ref: 00007FF72A9E39B5
Part of subcall function 00007FF72A9E38B0: #1122.MFC42U ref: 00007FF72A9E39D5
Part of subcall function 00007FF72A9E38B0: #1040.MFC42U ref: 00007FF72A9E39E0
Part of subcall function 00007FF72A9E38B0: #1040.MFC42U ref: 00007FF72A9E39EB
Part of subcall function 00007FF72A9E38B0: #1040.MFC42U ref: 00007FF72A9E39F6
Part of subcall function 00007FF72A9E38B0: #1040.MFC42U ref: 00007FF72A9E3A01

GetTextExtentPoint32W.GDI32 ref: 00007FF72A9DE8E0

Part of subcall function 00007FF72A9DF254: #626.MFC42U ref: 00007FF72A9DF26B
Part of subcall function 00007FF72A9DF254: #4473.MFC42U ref: 00007FF72A9DF27C
Part of subcall function 00007FF72A9DF254: GetTextExtentPoint32W.GDI32 ref: 00007FF72A9DF298
Part of subcall function 00007FF72A9DF254: #1040.MFC42U ref: 00007FF72A9DF2AC

GetDeviceCaps.GDI32 ref: 00007FF72A9DE8F8
GetDeviceCaps.GDI32 ref: 00007FF72A9DE903

Part of subcall function 00007FF72A9DF0C4: #626.MFC42U ref: 00007FF72A9DF0E3
Part of subcall function 00007FF72A9DF0C4: #4473.MFC42U ref: 00007FF72A9DF0F4
Part of subcall function 00007FF72A9DF0C4: wcstod.MSVCRT ref: 00007FF72A9DF101
Part of subcall function 00007FF72A9DF0C4: #1040.MFC42U ref: 00007FF72A9DF122

StartPage.GDI32 ref: 00007FF72A9DE94F
GetDeviceCaps.GDI32 ref: 00007FF72A9DE96C
#626.MFC42U(?,?,?,?,?,?,00000000), ref: 00007FF72A9DE981
#1286.MFC42U(?,?,?,?,?,?,00000000), ref: 00007FF72A9DE9B6
GetTextExtentPoint32W.GDI32 ref: 00007FF72A9DE9D0
#1040.MFC42U(?,?,?,?,?,?,00000000), ref: 00007FF72A9DEA93

Part of subcall function 00007FF72A9DF138: #626.MFC42U ref: 00007FF72A9DF17A
Part of subcall function 00007FF72A9DF138: #626.MFC42U ref: 00007FF72A9DF186
Part of subcall function 00007FF72A9DF138: #4473.MFC42U ref: 00007FF72A9DF197
Part of subcall function 00007FF72A9DF138: #2846.MFC42U ref: 00007FF72A9DF1AB
Part of subcall function 00007FF72A9DF138: GetDeviceCaps.GDI32 ref: 00007FF72A9DF1BE
Part of subcall function 00007FF72A9DF138: GetDeviceCaps.GDI32 ref: 00007FF72A9DF1D3
Part of subcall function 00007FF72A9DF138: EndPage.GDI32 ref: 00007FF72A9DF216
Part of subcall function 00007FF72A9DF138: #1040.MFC42U ref: 00007FF72A9DF225
Part of subcall function 00007FF72A9DF138: #1040.MFC42U ref: 00007FF72A9DF231

#4436.MFC42U(?,?,?,?,?,?,00000000), ref: 00007FF72A9DEA08
#1122.MFC42U(?,?,?,?,?,?,00000000), ref: 00007FF72A9DEA16
#1040.MFC42U(?,?,?,?,?,?,00000000), ref: 00007FF72A9DEA21
TextOutW.GDI32(?,?,?,?,?,?,00000000), ref: 00007FF72A9DEA62
#6050.MFC42U(?,?,?,?,?,?,00000000), ref: 00007FF72A9DEA7D
TextOutW.GDI32(?,?,?,?,?,?,00000000), ref: 00007FF72A9DEAE7

Strings

, xrefs: 00007FF72A9DE8B7

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040$#626$CapsDeviceText$#1122#1284#4473ExtentPoint32$#4436#6050#624Page$#1286#2629#2783#2846#620#6708Startwcstod
String ID:
API String ID: 2970609968-829830573
Opcode ID: f676c7f46952c6daac101dcd2e4c64c7b1075a263c5b3e150624142cc8c0e139
Instruction ID: 18c6087f6a917b69b48c9b21f9859e304690fe77438458c703de58a295e7d453
Opcode Fuzzy Hash: f676c7f46952c6daac101dcd2e4c64c7b1075a263c5b3e150624142cc8c0e139
Instruction Fuzzy Hash: E1813D36604A428AF764EF27D8840ACB360FB45B94B9441B6DB9EC3794CF39E8858F50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9E12C0, Relevance: 29.9, APIs: 8, Strings: 9, Instructions: 151COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF72A9D746C: #626.MFC42U ref: 00007FF72A9D74A1
Part of subcall function 00007FF72A9D746C: #626.MFC42U ref: 00007FF72A9D74AC
Part of subcall function 00007FF72A9D746C: #626.MFC42U ref: 00007FF72A9D74B7
Part of subcall function 00007FF72A9D746C: #626.MFC42U ref: 00007FF72A9D74C2
Part of subcall function 00007FF72A9D746C: #1463.MFC42U ref: 00007FF72A9D74D5
Part of subcall function 00007FF72A9D746C: #4473.MFC42U ref: 00007FF72A9D74E8
Part of subcall function 00007FF72A9D746C: #4473.MFC42U ref: 00007FF72A9D74F7
Part of subcall function 00007FF72A9D746C: #4473.MFC42U ref: 00007FF72A9D7506
Part of subcall function 00007FF72A9D746C: #4473.MFC42U ref: 00007FF72A9D7515
Part of subcall function 00007FF72A9D746C: #624.MFC42U ref: 00007FF72A9D7539
Part of subcall function 00007FF72A9D746C: #624.MFC42U ref: 00007FF72A9D7547
Part of subcall function 00007FF72A9D746C: #624.MFC42U ref: 00007FF72A9D7555

#655.MFC42U ref: 00007FF72A9E12FC
#655.MFC42U ref: 00007FF72A9E1307
#655.MFC42U ref: 00007FF72A9E1312
#655.MFC42U ref: 00007FF72A9E131E

Part of subcall function 00007FF72A9D7C40: #1126.MFC42U ref: 00007FF72A9D7C8D
Part of subcall function 00007FF72A9D7C40: #1126.MFC42U ref: 00007FF72A9D7CAC
Part of subcall function 00007FF72A9D7C40: #4436.MFC42U ref: 00007FF72A9D7CBF
Part of subcall function 00007FF72A9D7C40: #1040.MFC42U ref: 00007FF72A9D7CFB
Part of subcall function 00007FF72A9D7C40: #6050.MFC42U ref: 00007FF72A9D7D17
Part of subcall function 00007FF72A9D7C40: #1122.MFC42U ref: 00007FF72A9D7D24
Part of subcall function 00007FF72A9D7C40: #1040.MFC42U ref: 00007FF72A9D7D2F
Part of subcall function 00007FF72A9D7C40: #2783.MFC42U ref: 00007FF72A9D7D3F
Part of subcall function 00007FF72A9D7C40: #1126.MFC42U ref: 00007FF72A9D7DCA
Part of subcall function 00007FF72A9D7C40: #1126.MFC42U ref: 00007FF72A9D7DE1

#1059.MFC42U ref: 00007FF72A9E14D1
#1059.MFC42U ref: 00007FF72A9E14DC
#1059.MFC42U ref: 00007FF72A9E14E7
#1059.MFC42U ref: 00007FF72A9E14F2

Part of subcall function 00007FF72A9E0F98: #626.MFC42U ref: 00007FF72A9E0FCA
Part of subcall function 00007FF72A9E0F98: #626.MFC42U ref: 00007FF72A9E0FD5
Part of subcall function 00007FF72A9E0F98: #4473.MFC42U ref: 00007FF72A9E0FEB
Part of subcall function 00007FF72A9E0F98: #4473.MFC42U ref: 00007FF72A9E1036
Part of subcall function 00007FF72A9E0F98: #4473.MFC42U ref: 00007FF72A9E1071
Part of subcall function 00007FF72A9E0F98: #4473.MFC42U ref: 00007FF72A9E10CA

Strings

UsermodeCodeIntegrityPolicyEnforcementStatus, xrefs: 00007FF72A9E1457
SecurityServicesConfigured, xrefs: 00007FF72A9E13E5
AvailableSecurityProperties, xrefs: 00007FF72A9E13C0
CodeIntegrityPolicyEnforcementStatus, xrefs: 00007FF72A9E1433
Win32_DeviceGuard, xrefs: 00007FF72A9E1352
Microsoft\Windows\DeviceGuard, xrefs: 00007FF72A9E1333
VirtualizationBasedSecurityStatus, xrefs: 00007FF72A9E137A
SecurityServicesRunning, xrefs: 00007FF72A9E140B
RequiredSecurityProperties, xrefs: 00007FF72A9E139B

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #4473$#626$#1059#1126#655$#624$#1040$#1122#1463#2783#4436#6050
String ID: AvailableSecurityProperties$CodeIntegrityPolicyEnforcementStatus$Microsoft\Windows\DeviceGuard$RequiredSecurityProperties$SecurityServicesConfigured$SecurityServicesRunning$UsermodeCodeIntegrityPolicyEnforcementStatus$VirtualizationBasedSecurityStatus$Win32_DeviceGuard
API String ID: 1155648073-3086600114
Opcode ID: 07bf0a1fbc8d9a249ddd76cb60e960851fc3c08cf00dc2f49fb72b693df9f88a
Instruction ID: 552adb2aec66f4ae4ffc13133f9a566313d6a924d5fd674ca6ceda489d52a73f
Opcode Fuzzy Hash: 07bf0a1fbc8d9a249ddd76cb60e960851fc3c08cf00dc2f49fb72b693df9f88a
Instruction Fuzzy Hash: AC615E32608B8796FB00AF66DC402A9B760FB95B99F950172CA4DC3768EF3CD549CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D28E0, Relevance: 28.7, APIs: 19, Instructions: 197COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D290E
#624.MFC42U ref: 00007FF72A9D2958
#624.MFC42U ref: 00007FF72A9D2995
#624.MFC42U ref: 00007FF72A9D29CF
#624.MFC42U ref: 00007FF72A9D2A08
#624.MFC42U ref: 00007FF72A9D2A42
#624.MFC42U ref: 00007FF72A9D2A7C
#624.MFC42U ref: 00007FF72A9D2AB5
#624.MFC42U ref: 00007FF72A9D2AEE
#624.MFC42U ref: 00007FF72A9D2B27
#624.MFC42U ref: 00007FF72A9D2B61
#624.MFC42U ref: 00007FF72A9D2B9D
#624.MFC42U ref: 00007FF72A9D2BD6
#624.MFC42U ref: 00007FF72A9D2C12
#624.MFC42U ref: 00007FF72A9D2C4B
#624.MFC42U ref: 00007FF72A9D2C84
#624.MFC42U ref: 00007FF72A9D2CBD
#624.MFC42U ref: 00007FF72A9D2CFA
#624.MFC42U ref: 00007FF72A9D2D30

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624
String ID:
API String ID: 2145510954-0
Opcode ID: 1c8912f12b9a46800d002aac5d06bec0220e0c3238bfcf154546c3f0ea26c222
Instruction ID: d0b1efb83d0f1815a0a4e1ac0992f20e8da5b0f078c036a641353561d5ea6309
Opcode Fuzzy Hash: 1c8912f12b9a46800d002aac5d06bec0220e0c3238bfcf154546c3f0ea26c222
Instruction Fuzzy Hash: D7D18370D187138AF700AF25ED54B65B6B4FF14B51FD081BAD54D862A0CFBCA44A8FA0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9E38B0, Relevance: 28.6, APIs: 19, Instructions: 95COMMON

Download Yara Rule

APIs

#620.MFC42U ref: 00007FF72A9E38E0
#626.MFC42U ref: 00007FF72A9E38EB
#624.MFC42U ref: 00007FF72A9E38F9
#624.MFC42U ref: 00007FF72A9E3907
#2783.MFC42U ref: 00007FF72A9E3927
#1284.MFC42U ref: 00007FF72A9E393C
#2629.MFC42U ref: 00007FF72A9E3946
#4436.MFC42U ref: 00007FF72A9E3959
#1284.MFC42U ref: 00007FF72A9E3967
#1040.MFC42U ref: 00007FF72A9E3972
#1284.MFC42U ref: 00007FF72A9E3980
#6050.MFC42U ref: 00007FF72A9E399C
#1122.MFC42U ref: 00007FF72A9E39AA
#1040.MFC42U ref: 00007FF72A9E39B5
#1122.MFC42U ref: 00007FF72A9E39D5
#1040.MFC42U ref: 00007FF72A9E39E0
#1040.MFC42U ref: 00007FF72A9E39EB
#1040.MFC42U ref: 00007FF72A9E39F6
#1040.MFC42U ref: 00007FF72A9E3A01

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040$#1284$#1122#624$#2629#2783#4436#6050#620#626
String ID:
API String ID: 463546917-0
Opcode ID: 37feb81470ef423d7a02116ab151e562b833487108198d06b79fc3f95df8aac5
Instruction ID: 76162e3947e3c65fe3259feda4f7d5f8288fc216f46984c8c394af2d36be6ff0
Opcode Fuzzy Hash: 37feb81470ef423d7a02116ab151e562b833487108198d06b79fc3f95df8aac5
Instruction Fuzzy Hash: E1416F32B14A0295FB009F76DC440AC7770FB49BA9B951171DB5ED3AA8DF28D88DCB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9DDC00, Relevance: 27.1, APIs: 18, Instructions: 132COMMON

Download Yara Rule

APIs

#6886.MFC42U ref: 00007FF72A9DDC32
#369.MFC42U ref: 00007FF72A9DDC48
#6886.MFC42U ref: 00007FF72A9DDC8F

Part of subcall function 00007FF72A9DBB30: #626.MFC42U ref: 00007FF72A9DBB4E

#4046.MFC42U ref: 00007FF72A9DDCC8
#626.MFC42U ref: 00007FF72A9DDCD3
#4473.MFC42U ref: 00007FF72A9DDCE4
#2849.MFC42U ref: 00007FF72A9DDCF9
#620.MFC42U ref: 00007FF72A9DDD0A
#626.MFC42U ref: 00007FF72A9DDD2D
#4473.MFC42U ref: 00007FF72A9DDD3E
_wcsupr.MSVCRT ref: 00007FF72A9DDD47
#1287.MFC42U ref: 00007FF72A9DDD55
#620.MFC42U ref: 00007FF72A9DDD65
#1040.MFC42U ref: 00007FF72A9DDD84
#1040.MFC42U ref: 00007FF72A9DDDAC
#1040.MFC42U ref: 00007FF72A9DDDB8
#1040.MFC42U ref: 00007FF72A9DDDDC
#1040.MFC42U ref: 00007FF72A9DDDE8

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040$#626$#4473#620#6886$#1287#2849#369#4046_wcsupr
String ID:
API String ID: 2575489402-0
Opcode ID: 59adb3753fb1e52487020a1dd2234d637386a992f7e744c9d4f7d0b5b1a971de
Instruction ID: e3c7b80ac9f6ada580ef48186dad215d432d6d6433dc47afc4528d061b2a27b6
Opcode Fuzzy Hash: 59adb3753fb1e52487020a1dd2234d637386a992f7e744c9d4f7d0b5b1a971de
Instruction Fuzzy Hash: 98514B21619B4282FB10AB26EC58169B760FB89FD1F904071DA9EC37B8DF3DD549CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D59B0, Relevance: 25.6, APIs: 17, Instructions: 120windowCOMMON

Download Yara Rule

APIs

IsDlgButtonChecked.USER32 ref: 00007FF72A9D5A24
EnableWindow.USER32 ref: 00007FF72A9D5A3C
EnableWindow.USER32 ref: 00007FF72A9D5A49
#2975.MFC42U ref: 00007FF72A9D5A64
GetWindowTextW.USER32 ref: 00007FF72A9D5A77
#5887.MFC42U ref: 00007FF72A9D5A84
GetDlgItem.USER32 ref: 00007FF72A9D5AA6
GetWindowTextW.USER32 ref: 00007FF72A9D5ABA
#1126.MFC42U ref: 00007FF72A9D5AD4
GetDlgItem.USER32 ref: 00007FF72A9D5B0B
GetDlgItem.USER32 ref: 00007FF72A9D5B1D
SendMessageW.USER32 ref: 00007FF72A9D5B37
SetDlgItemTextW.USER32 ref: 00007FF72A9D5B49
EnableWindow.USER32 ref: 00007FF72A9D5B68
EnableWindow.USER32 ref: 00007FF72A9D5B74
CheckRadioButton.USER32 ref: 00007FF72A9D5B89
EndDialog.USER32 ref: 00007FF72A9D5B93

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$EnableItem$Text$Button$#1126#2975#5887CheckCheckedDialogMessageRadioSend
String ID:
API String ID: 3889471064-0
Opcode ID: d5dd3d21459ebceed21451c779777c28eefcb29f3c2ad1b42b22ade22f25f99c
Instruction ID: 26d359675880e649cf834c5fcd9f2233e08cb76eb3ca2ac05719e1d3e6de6051
Opcode Fuzzy Hash: d5dd3d21459ebceed21451c779777c28eefcb29f3c2ad1b42b22ade22f25f99c
Instruction Fuzzy Hash: CB51F376A08A4282F710AF27EC58779A361FB88B44F948172CA9D87758DF3CD585CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9E6FD8, Relevance: 24.1, APIs: 16, Instructions: 68COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 00007FF72A9E700B
ShowWindow.USER32 ref: 00007FF72A9E701A
ShowWindow.USER32 ref: 00007FF72A9E7029
ShowWindow.USER32 ref: 00007FF72A9E7038
ShowWindow.USER32 ref: 00007FF72A9E7047
ShowWindow.USER32 ref: 00007FF72A9E7056
ShowWindow.USER32 ref: 00007FF72A9E7065
ShowWindow.USER32 ref: 00007FF72A9E7074
EnableWindow.USER32 ref: 00007FF72A9E7087
EnableWindow.USER32 ref: 00007FF72A9E7096
EnableWindow.USER32 ref: 00007FF72A9E70A5
EnableWindow.USER32 ref: 00007FF72A9E70B4
EnableWindow.USER32 ref: 00007FF72A9E70C3
EnableWindow.USER32 ref: 00007FF72A9E70D2
EnableWindow.USER32 ref: 00007FF72A9E70E1
EnableWindow.USER32 ref: 00007FF72A9E70F0

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: d090d9b331c5107e3db24b6f9f870d08d79886a4a1754ccb1ece8f2e3128c150
Instruction ID: 8c634162316e28100f5332679b710c17ae82db43024111d347d85401439bfb9d
Opcode Fuzzy Hash: d090d9b331c5107e3db24b6f9f870d08d79886a4a1754ccb1ece8f2e3128c150
Instruction Fuzzy Hash: 6231FD26A05B9282E705AF23E894279A326FBC8F55F984071DE4EC7358CF3CD5858B60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9E45BC, Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 191COMMON

Download Yara Rule

APIs

#626.MFC42U ref: 00007FF72A9E469C
#626.MFC42U ref: 00007FF72A9E4722
_wcsicmp.MSVCRT ref: 00007FF72A9E4751
#1040.MFC42U ref: 00007FF72A9E4787
#1040.MFC42U ref: 00007FF72A9E4826
#1040.MFC42U ref: 00007FF72A9E4831

Strings

BaudRate, BitsPerByte, StopBits, Parity, IsBusy, MSIAdvancedAbortReadWriteOnError, MSIAdvancedBinaryModeEnabled, MSIAdvancedContin, xrefs: 00007FF72A9E464A, 00007FF72A9E4717, 00007FF72A9E47B3
Win32_SerialPortConfiguration, xrefs: 00007FF72A9E46D6
Name, xrefs: 00007FF72A9E4734
Win32_SerialPort, xrefs: 00007FF72A9E4600
Name, Status, MSIAdvancedPNPDeviceID, MSIAdvancedMaximumInputBufferSize, MSIAdvancedMaximumOutputBufferSize, MSIAdvancedSettableBa, xrefs: 00007FF72A9E45F5, 00007FF72A9E4675
DeviceID, xrefs: 00007FF72A9E46AE
PNPDeviceID, xrefs: 00007FF72A9E47F1

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040$#626$_wcsicmp
String ID: BaudRate, BitsPerByte, StopBits, Parity, IsBusy, MSIAdvancedAbortReadWriteOnError, MSIAdvancedBinaryModeEnabled, MSIAdvancedContin$DeviceID$Name$Name, Status, MSIAdvancedPNPDeviceID, MSIAdvancedMaximumInputBufferSize, MSIAdvancedMaximumOutputBufferSize, MSIAdvancedSettableBa$PNPDeviceID$Win32_SerialPort$Win32_SerialPortConfiguration
API String ID: 3787307322-293919242
Opcode ID: ca5aa592ca30cf2aa2b8561604f9c96128594aa730bbf9fb436cd5b6b613148f
Instruction ID: 4b9245997e2cf36b3d2d1f7b173b342bda3c6cf38d6506106bdbcd8e42e12949
Opcode Fuzzy Hash: ca5aa592ca30cf2aa2b8561604f9c96128594aa730bbf9fb436cd5b6b613148f
Instruction Fuzzy Hash: B0912366B08B5685FB00AF66DC842ADA770FB89F88F804172CE5D93768DF39D449CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9E00D0, Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

#1040.MFC42U ref: 00007FF72A9E034C

Strings

__PATH, xrefs: 00007FF72A9E0197
Antecedent, xrefs: 00007FF72A9E0211
Win32_USBControllerDevice, xrefs: 00007FF72A9E01CA
Caption, PNPDeviceID, xrefs: 00007FF72A9E0161
Caption, PNPDeviceID, __PATH, xrefs: 00007FF72A9E0110
Win32_USBController, xrefs: 00007FF72A9E011B
Dependent, xrefs: 00007FF72A9E024B

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040
String ID: Antecedent$Caption, PNPDeviceID$Caption, PNPDeviceID, __PATH$Dependent$Win32_USBController$Win32_USBControllerDevice$__PATH
API String ID: 2974555078-265556894
Opcode ID: bc143e54c2a95a232214ed129a092be0b3b0007f9078ac64f5481a2cb144d593
Instruction ID: 2378653fbe1f70ef2a4aa00348497282f93400e1083c4247724d85185357945c
Opcode Fuzzy Hash: bc143e54c2a95a232214ed129a092be0b3b0007f9078ac64f5481a2cb144d593
Instruction Fuzzy Hash: 6D91E366B18B5686FB00AB66DC843ADA770FB48F88F944172CE8D97764DF38D448CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D6F40, Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

#626.MFC42U ref: 00007FF72A9D6F6F
#626.MFC42U ref: 00007FF72A9D6F9B
#626.MFC42U ref: 00007FF72A9D6FA6
#624.MFC42U ref: 00007FF72A9D6FE2
VariantInit.OLEAUT32 ref: 00007FF72A9D6FF1
VariantInit.OLEAUT32 ref: 00007FF72A9D6FFB
#1040.MFC42U ref: 00007FF72A9D7045
#1122.MFC42U ref: 00007FF72A9D7058
#1040.MFC42U ref: 00007FF72A9D7063
#1040.MFC42U ref: 00007FF72A9D706E
#1122.MFC42U ref: 00007FF72A9D707B
#1040.MFC42U ref: 00007FF72A9D7086

Strings

__CLASS, xrefs: 00007FF72A9D6FBF

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040$#626$#1122InitVariant$#624
String ID: __CLASS
API String ID: 2217512159-1762971696
Opcode ID: 9c4181c2fcf864e23048072fdbe479b684d2d5838e65ea9fc02f019027621ffe
Instruction ID: 286e8141053d654bbf959f11992bc5a639b92eeb59d65f38e161ff2de298acb0
Opcode Fuzzy Hash: 9c4181c2fcf864e23048072fdbe479b684d2d5838e65ea9fc02f019027621ffe
Instruction Fuzzy Hash: A2413E32604E02A5FB00AF26DC842ECB364FB45B99F9501B2DA5DD37A8DF38D588CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9DE3A0, Relevance: 22.6, APIs: 15, Instructions: 94COMMON

Download Yara Rule

APIs

#6886.MFC42U ref: 00007FF72A9DE3CE
#4046.MFC42U ref: 00007FF72A9DE40E
#626.MFC42U ref: 00007FF72A9DE419
#4473.MFC42U ref: 00007FF72A9DE42A
#2849.MFC42U ref: 00007FF72A9DE43F
#620.MFC42U ref: 00007FF72A9DE450
#626.MFC42U ref: 00007FF72A9DE473
#4473.MFC42U ref: 00007FF72A9DE484
_wcsupr.MSVCRT ref: 00007FF72A9DE48D
#1287.MFC42U ref: 00007FF72A9DE49B
#620.MFC42U ref: 00007FF72A9DE4AB
#1040.MFC42U ref: 00007FF72A9DE4C2
#1040.MFC42U ref: 00007FF72A9DE4E7
#1040.MFC42U ref: 00007FF72A9DE4F3
#6887.MFC42U ref: 00007FF72A9DE50C

Part of subcall function 00007FF72A9DEB04: #6886.MFC42U ref: 00007FF72A9DEB5A
Part of subcall function 00007FF72A9DEB04: #336.MFC42U ref: 00007FF72A9DEB70

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040$#4473#620#626#6886$#1287#2849#336#4046#6887_wcsupr
String ID:
API String ID: 3180011925-0
Opcode ID: 78bdc2038ec6af75282e75d9c9f064dca31a2899cc7966ba038a48d5b4b84de3
Instruction ID: 45aa0d791f4b2f0daae16207d881b59b06d62ca212cc316a3e7c0a97e9faf6a1
Opcode Fuzzy Hash: 78bdc2038ec6af75282e75d9c9f064dca31a2899cc7966ba038a48d5b4b84de3
Instruction Fuzzy Hash: 3D414F31608A4292FB10AB17EC48169F764FB89BD5F9401B1DA9EC37A8DE3CD549CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9E6CDC, Relevance: 21.2, APIs: 14, Instructions: 158COMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 00007FF72A9E6D0A
CopyRect.USER32 ref: 00007FF72A9E6D22
MoveWindow.USER32 ref: 00007FF72A9E6D92
CopyRect.USER32 ref: 00007FF72A9E6DA0
MoveWindow.USER32 ref: 00007FF72A9E6DDC
GetWindowRect.USER32 ref: 00007FF72A9E6DEA
GetWindowRect.USER32 ref: 00007FF72A9E6DF8
ScreenToClient.USER32 ref: 00007FF72A9E6E28
ScreenToClient.USER32 ref: 00007FF72A9E6E36
ScreenToClient.USER32 ref: 00007FF72A9E6E74
ScreenToClient.USER32 ref: 00007FF72A9E6E82
SetRect.USER32 ref: 00007FF72A9E6EDF
InvalidateRect.USER32 ref: 00007FF72A9E6EEF
UpdateWindow.USER32 ref: 00007FF72A9E6EF9

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: Rect$ClientWindow$Screen$CopyMove$InvalidateUpdate
String ID:
API String ID: 446844291-0
Opcode ID: d9f360af53bdeb1fd13415f01d6b0af0a6f20f78cd0c72f397f5939d18a2f8ba
Instruction ID: db10a7b7f167e4780fdeb38a8f978dafba0d64cb0f8ad3935a192210478df273
Opcode Fuzzy Hash: d9f360af53bdeb1fd13415f01d6b0af0a6f20f78cd0c72f397f5939d18a2f8ba
Instruction Fuzzy Hash: 48811576F146618FE714DFBAE98059C7BB1F748748B60412ADF0AA3B18DB38A915CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9E2048, Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 112registryCOMMON

Download Yara Rule

APIs

#626.MFC42U ref: 00007FF72A9E2093
#626.MFC42U ref: 00007FF72A9E209F
#4473.MFC42U ref: 00007FF72A9E20AD
#4473.MFC42U ref: 00007FF72A9E20C7
RegOpenKeyExW.ADVAPI32 ref: 00007FF72A9E20F4
RegGetValueW.ADVAPI32 ref: 00007FF72A9E2129
#624.MFC42U ref: 00007FF72A9E216A
#1040.MFC42U ref: 00007FF72A9E2197
RegCloseKey.ADVAPI32 ref: 00007FF72A9E21C4
#1040.MFC42U ref: 00007FF72A9E21D6
#1040.MFC42U ref: 00007FF72A9E21E2

Strings

Software\Microsoft\Windows NT\CurrentVersion, xrefs: 00007FF72A9E20E6

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040$#4473#626$#624CloseOpenValue
String ID: Software\Microsoft\Windows NT\CurrentVersion
API String ID: 171597728-3133129975
Opcode ID: 34f7367214746ef4aab41ed977d7871e8b17ce7f6a3f824b86a3ae194bbc7b62
Instruction ID: f15de74fc851d4f66f1c6410104b2ea8e04752c7f934532e927f449ff7ec7ef9
Opcode Fuzzy Hash: 34f7367214746ef4aab41ed977d7871e8b17ce7f6a3f824b86a3ae194bbc7b62
Instruction Fuzzy Hash: E9414F32608A4296F710AB26EC406AAF760FB99B90F900172DF9D83A64DF3CD549CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9E84A0, Relevance: 21.1, APIs: 14, Instructions: 89COMMON

Download Yara Rule

APIs

#1040.MFC42U ref: 00007FF72A9E84D0
#6887.MFC42U ref: 00007FF72A9E84D9
#6886.MFC42U ref: 00007FF72A9E84EC
#624.MFC42U ref: 00007FF72A9E850E
#1126.MFC42U ref: 00007FF72A9E8550
DialogBoxParamW.USER32 ref: 00007FF72A9E8576
LoadCursorW.USER32 ref: 00007FF72A9E858D
SetCursor.USER32 ref: 00007FF72A9E8596
#626.MFC42U ref: 00007FF72A9E85A4
#1122.MFC42U ref: 00007FF72A9E85BE
#2629.MFC42U ref: 00007FF72A9E85CD
_wcsicmp.MSVCRT ref: 00007FF72A9E85DC
SetCursor.USER32 ref: 00007FF72A9E85F6
#1040.MFC42U ref: 00007FF72A9E8602

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: Cursor$#1040$#1122#1126#2629#624#626#6886#6887DialogLoadParam_wcsicmp
String ID:
API String ID: 1590014547-0
Opcode ID: e2b993dac77233529470ceae7e28cd8d0de963de85954ebdb5be505c4fc65c91
Instruction ID: 9c951090acba9c3aed0a45dad3db4846632f41ceb6751d9e82713662762d028d
Opcode Fuzzy Hash: e2b993dac77233529470ceae7e28cd8d0de963de85954ebdb5be505c4fc65c91
Instruction Fuzzy Hash: 0A415E72A08B8282FB10EF12E844369B364FB94B95F854176CB9E877A4CF7CD449CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9EA41C, Relevance: 19.6, APIs: 13, Instructions: 142windowfileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF72A9EA216), ref: 00007FF72A9EA509
memset.MSVCRT ref: 00007FF72A9EA533
GetComputerNameW.KERNEL32 ref: 00007FF72A9EA559
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF72A9EA216), ref: 00007FF72A9EA63D

Part of subcall function 00007FF72A9EB670: #6887.MFC42U ref: 00007FF72A9EB6B7
Part of subcall function 00007FF72A9EB670: #6886.MFC42U ref: 00007FF72A9EB6CD
Part of subcall function 00007FF72A9EB670: memset.MSVCRT ref: 00007FF72A9EB6E3
Part of subcall function 00007FF72A9EB670: DialogBoxParamW.USER32 ref: 00007FF72A9EB761
Part of subcall function 00007FF72A9EB670: #6887.MFC42U ref: 00007FF72A9EB771

wcsncpy_s.MSVCRT ref: 00007FF72A9EA568
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF72A9EA216), ref: 00007FF72A9EA594
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF72A9EA216), ref: 00007FF72A9EA5C3
#626.MFC42U(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF72A9EA216), ref: 00007FF72A9EA5CE
#1463.MFC42U(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF72A9EA216), ref: 00007FF72A9EA5DC
#4473.MFC42U(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF72A9EA216), ref: 00007FF72A9EA5F0
MessageBoxW.USER32 ref: 00007FF72A9EA60A
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF72A9EA216), ref: 00007FF72A9EA61A
#1040.MFC42U(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF72A9EA216), ref: 00007FF72A9EA626

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #6887Messagememset$#1040#1463#4473#626#6886CloseComputerCreateDialogErrorFileFormatFreeHandleLastLocalNameParamwcsncpy_s
String ID:
API String ID: 921785262-0
Opcode ID: 4dd1187132921cfec4187158c1aae5c75f299d110a02327c2ec84146104eb283
Instruction ID: e68119cc1c48972e2dd8da360a23a9bdc769ded5bb4ea16294f44797ede57d82
Opcode Fuzzy Hash: 4dd1187132921cfec4187158c1aae5c75f299d110a02327c2ec84146104eb283
Instruction Fuzzy Hash: D851822160CA4282FB10AB17ED54269A3A0FB95BA1F944272DEAD83BF5DF3CD445CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9E7108, Relevance: 19.6, APIs: 13, Instructions: 98COMMON

Download Yara Rule

APIs

#1463.MFC42U ref: 00007FF72A9E712F
ShowWindow.USER32 ref: 00007FF72A9E714D
ShowWindow.USER32 ref: 00007FF72A9E7169
ShowWindow.USER32 ref: 00007FF72A9E7183
ShowWindow.USER32 ref: 00007FF72A9E719F
EnableWindow.USER32 ref: 00007FF72A9E71B7
EnableWindow.USER32 ref: 00007FF72A9E71DB
EnableWindow.USER32 ref: 00007FF72A9E7208
EnableWindow.USER32 ref: 00007FF72A9E7235
EnableWindow.USER32 ref: 00007FF72A9E724D
EnableWindow.USER32 ref: 00007FF72A9E7265
EnableWindow.USER32 ref: 00007FF72A9E727D
EnableWindow.USER32 ref: 00007FF72A9E7296

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Enable$Show$#1463
String ID:
API String ID: 2128900493-0
Opcode ID: 5491cf668ca737c9933e28ac077b73ea8f87b9f89579950e42fb61d3e6d0f8f8
Instruction ID: a4eda5ce58e3925c51dc531dc2a123987a514de585231644b642222caf827dc4
Opcode Fuzzy Hash: 5491cf668ca737c9933e28ac077b73ea8f87b9f89579950e42fb61d3e6d0f8f8
Instruction Fuzzy Hash: 1B416132A44B83C3E7199F26E880679F3AAFBD4B41F544176D7AA83254CF7CE584CA10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D99B0, Relevance: 19.6, APIs: 13, Instructions: 97COMMON

Download Yara Rule

APIs

#1463.MFC42U ref: 00007FF72A9D99E7
#626.MFC42U ref: 00007FF72A9D99F5
#4473.MFC42U ref: 00007FF72A9D9A02
#6886.MFC42U ref: 00007FF72A9D9A24
#6641.MFC42U ref: 00007FF72A9D9A45
#624.MFC42U ref: 00007FF72A9D9A58
#1040.MFC42U ref: 00007FF72A9D9A77
#6050.MFC42U ref: 00007FF72A9D9A9C
#1122.MFC42U ref: 00007FF72A9D9AAA
#1040.MFC42U ref: 00007FF72A9D9AB5
#1381.MFC42U ref: 00007FF72A9D9AC8
#2629.MFC42U ref: 00007FF72A9D9ADB
#1040.MFC42U ref: 00007FF72A9D9AF3

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040$#1122#1381#1463#2629#4473#6050#624#626#6641#6886
String ID:
API String ID: 3029990784-0
Opcode ID: 0800639bfa46a144a1b40401f6c5c1304868ae41cce709642e10c1a00c5b7ce4
Instruction ID: 59ea33105d88df69b85bb45c600f47ba8b28949f83fbbda6ed3537433131c3cb
Opcode Fuzzy Hash: 0800639bfa46a144a1b40401f6c5c1304868ae41cce709642e10c1a00c5b7ce4
Instruction Fuzzy Hash: 15417E33B14A029AFB00AF62DC441ACB7B4FB44BA5F944171CE5D976A4DF38D889CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D24B0, Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D24DE
#624.MFC42U ref: 00007FF72A9D2528
#624.MFC42U ref: 00007FF72A9D2566
#624.MFC42U ref: 00007FF72A9D25A2
#624.MFC42U ref: 00007FF72A9D25DC
#624.MFC42U ref: 00007FF72A9D2615
#624.MFC42U ref: 00007FF72A9D264E
#624.MFC42U ref: 00007FF72A9D2688
#624.MFC42U ref: 00007FF72A9D26C2
#624.MFC42U ref: 00007FF72A9D26FB
#624.MFC42U ref: 00007FF72A9D2734
#624.MFC42U ref: 00007FF72A9D276A

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624
String ID:
API String ID: 2145510954-0
Opcode ID: 0412b9de4b418c5d74b1dbefd5f38eaaf4cc0075ee0f2638197ca588b79e2d99
Instruction ID: 7208c31d4e012dfd8f4fe7746f7d5e4bd2f3e0acd429001f1823490876186ebb
Opcode Fuzzy Hash: 0412b9de4b418c5d74b1dbefd5f38eaaf4cc0075ee0f2638197ca588b79e2d99
Instruction Fuzzy Hash: 29917070D186028BF701BF26FD44B61B6B4FF54B51F9241BAD55C862A0CF7CA49A8FA0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9DEF30, Relevance: 18.1, APIs: 12, Instructions: 114windowCOMMON

Download Yara Rule

APIs

EndPage.GDI32 ref: 00007FF72A9DEF56
EndDoc.GDI32 ref: 00007FF72A9DEF65
#287.MFC42U ref: 00007FF72A9DEF84
#626.MFC42U ref: 00007FF72A9DEF90
#626.MFC42U ref: 00007FF72A9DEF9C
#4473.MFC42U ref: 00007FF72A9DEFD6
#4473.MFC42U ref: 00007FF72A9DEFE7
#1471.MFC42U ref: 00007FF72A9DEFF8
MessageBoxW.USER32 ref: 00007FF72A9DF02E
#1040.MFC42U ref: 00007FF72A9DF041
#1040.MFC42U ref: 00007FF72A9DF04D
#2461.MFC42U ref: 00007FF72A9DF098

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040#4473#626$#1471#2461#287MessagePage
String ID:
API String ID: 2542517654-0
Opcode ID: cf0ef29e2391e01af99f98274539b2fa68c1e18e817ac8bc6dff7e08e0b1c1f8
Instruction ID: 00909592bcca286399baa323f0dd5cf5e6d0a8ebcad299c208e954593e4f957b
Opcode Fuzzy Hash: cf0ef29e2391e01af99f98274539b2fa68c1e18e817ac8bc6dff7e08e0b1c1f8
Instruction Fuzzy Hash: 9D414032609E0682FB10AB26DC5453DA760EB85F95FA05172CA9EC37B4DF3DD889CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9EC0EC, Relevance: 18.1, APIs: 12, Instructions: 112windowCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF72A9EC117
InitCommonControlsEx.COMCTL32 ref: 00007FF72A9EC12E
LoadAcceleratorsW.USER32 ref: 00007FF72A9EC147
CreateDialogParamW.USER32 ref: 00007FF72A9EC176
DestroyAcceleratorTable.USER32 ref: 00007FF72A9EC29F

Part of subcall function 00007FF72A9E8620: #624.MFC42U ref: 00007FF72A9E863F
Part of subcall function 00007FF72A9E8620: #6886.MFC42U ref: 00007FF72A9E8652
Part of subcall function 00007FF72A9E8620: #1040.MFC42U ref: 00007FF72A9E87D7

ShowWindow.USER32 ref: 00007FF72A9EC20D
GetMessageW.USER32 ref: 00007FF72A9EC26C
WinSqmAddToStream.NTDLL ref: 00007FF72A9EC296

Part of subcall function 00007FF72A9EA250: CreateFileW.KERNEL32 ref: 00007FF72A9EA31A
Part of subcall function 00007FF72A9EA250: CloseHandle.KERNEL32 ref: 00007FF72A9EA354

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: Create$#1040#624#6886AcceleratorAcceleratorsCloseCommonControlsDestroyDialogFileHandleInitLoadMessageParamShowStreamTableWindowmemset
String ID:
API String ID: 3685597001-0
Opcode ID: f2bb53cfc0f651db819d138365d6f397746f285f37ec586c7eb7f4f83d13daaa
Instruction ID: 914ada87448d3f90a46a3e926d8b443c73dcc447467a7a562846c1deae201443
Opcode Fuzzy Hash: f2bb53cfc0f651db819d138365d6f397746f285f37ec586c7eb7f4f83d13daaa
Instruction Fuzzy Hash: 63516D31A1865285FB11EB62ED44668B3B5FF54B44FD040B2EA8EC2695DF3CE845CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D746C, Relevance: 18.1, APIs: 12, Instructions: 67COMMON

Download Yara Rule

APIs

#626.MFC42U ref: 00007FF72A9D74A1
#626.MFC42U ref: 00007FF72A9D74AC
#626.MFC42U ref: 00007FF72A9D74B7
#626.MFC42U ref: 00007FF72A9D74C2
#1463.MFC42U ref: 00007FF72A9D74D5
#4473.MFC42U ref: 00007FF72A9D74E8
#4473.MFC42U ref: 00007FF72A9D74F7
#4473.MFC42U ref: 00007FF72A9D7506
#4473.MFC42U ref: 00007FF72A9D7515
#624.MFC42U ref: 00007FF72A9D7539
#624.MFC42U ref: 00007FF72A9D7547
#624.MFC42U ref: 00007FF72A9D7555

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #4473#626$#624$#1463
String ID:
API String ID: 2599115686-0
Opcode ID: 08dece799beaaa2902401dbb13b0408e5c7330fded2a0aea73bd0aeb11c541ac
Instruction ID: 05b534429df043730a8fd2d87b9558f958d3ff894568bc42970b686da963bc9d
Opcode Fuzzy Hash: 08dece799beaaa2902401dbb13b0408e5c7330fded2a0aea73bd0aeb11c541ac
Instruction Fuzzy Hash: 83311032615B0292F700AF16EC486697374FB99B61FA24171CA6DC23A0DF3CD58DCB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9E3A50, Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 211COMMON

Download Yara Rule

APIs

#6886.MFC42U ref: 00007FF72A9E3AD3
#422.MFC42U ref: 00007FF72A9E3AF2
#917.MFC42U ref: 00007FF72A9E3B2F
#6887.MFC42U ref: 00007FF72A9E3B39
#620.MFC42U ref: 00007FF72A9E3BF1
#1040.MFC42U ref: 00007FF72A9E3C87
#1040.MFC42U ref: 00007FF72A9E3CB0

Part of subcall function 00007FF72A9E45BC: #626.MFC42U ref: 00007FF72A9E469C
Part of subcall function 00007FF72A9E45BC: #626.MFC42U ref: 00007FF72A9E4722
Part of subcall function 00007FF72A9E45BC: _wcsicmp.MSVCRT ref: 00007FF72A9E4751

Strings

PNPDeviceID, xrefs: 00007FF72A9E3C53

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040#626$#422#620#6886#6887#917_wcsicmp
String ID: PNPDeviceID
API String ID: 2354679368-3952963323
Opcode ID: a6a25ac2dae78668a91e867a8e5755f3ff453803b202ee3df80a9cdf6b97dbcf
Instruction ID: f1ec26275a1ca49520e140a2e9b11bc10e9a94ed40d4099bcba0bb65da192fcd
Opcode Fuzzy Hash: a6a25ac2dae78668a91e867a8e5755f3ff453803b202ee3df80a9cdf6b97dbcf
Instruction Fuzzy Hash: A7917D32A08A8286FB04AF27DD44179B7A1FB58F94B8540B6CE9EC3795DF38D844DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9DF610, Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 177COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF72A9DF666

Strings

DeviceID, Description, Compressed, MSIAdvancedFileSystem, Size, FreeSpace, MSIAdvancedVolumeName, MSIAdvancedVolumeSerialNumber, M, xrefs: 00007FF72A9DF8D3
DeviceID, Description, xrefs: 00007FF72A9DF794
DeviceID, Description, ProviderName, xrefs: 00007FF72A9DF89E
Win32_LogicalDisk, xrefs: 00007FF72A9DF67F
DriveType, xrefs: 00007FF72A9DF7AF
DeviceID, xrefs: 00007FF72A9DF6BD
DriveType, DeviceID, Description, Compressed, FileSystem, Size, FreeSpace, VolumeName, VolumeSerialNumber, PNPDeviceID, ProviderNa, xrefs: 00007FF72A9DF673

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: memset
String ID: DeviceID$DeviceID, Description$DeviceID, Description, Compressed, MSIAdvancedFileSystem, Size, FreeSpace, MSIAdvancedVolumeName, MSIAdvancedVolumeSerialNumber, M$DeviceID, Description, ProviderName$DriveType$DriveType, DeviceID, Description, Compressed, FileSystem, Size, FreeSpace, VolumeName, VolumeSerialNumber, PNPDeviceID, ProviderNa$Win32_LogicalDisk
API String ID: 2221118986-2180222787
Opcode ID: 1da2b18cd9cc71465a60988f6c194b2bf34a925ab5e455f66e69627c1430bc49
Instruction ID: b3dee2cb0ac07116c89ea94a8f3b987db3d614fa8cdc47bd6d4ba87e747d465e
Opcode Fuzzy Hash: 1da2b18cd9cc71465a60988f6c194b2bf34a925ab5e455f66e69627c1430bc49
Instruction Fuzzy Hash: CB815936608E4681FB10AF2BE844769A760FB84F94F904172DE9D87BA8DF7DD485CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9DC070, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 173commemoryCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FF72A9DC0AA
CoCreateInstance.OLE32 ref: 00007FF72A9DC0DA
VariantClear.OLEAUT32 ref: 00007FF72A9DC150
VariantClear.OLEAUT32 ref: 00007FF72A9DC1B3
VariantClear.OLEAUT32 ref: 00007FF72A9DC1E0
SysAllocString.OLEAUT32 ref: 00007FF72A9DC1F9
VariantClear.OLEAUT32 ref: 00007FF72A9DC261
CoUninitialize.OLE32 ref: 00007FF72A9DC2EF

Strings

AllowXsltScript, xrefs: 00007FF72A9DC189
ProhibitDTD, xrefs: 00007FF72A9DC11E

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: ClearVariant$AllocCreateInitializeInstanceStringUninitialize
String ID: AllowXsltScript$ProhibitDTD
API String ID: 994123456-3507678377
Opcode ID: 208f2b42aea418b5be76d74f2a5f8593d1d8ad3f3b8ececdfbfa4a466205c3a0
Instruction ID: f06f02ed572f951c9912d7dcc02b020c9f4fca6501fb8892a8be399c45294e12
Opcode Fuzzy Hash: 208f2b42aea418b5be76d74f2a5f8593d1d8ad3f3b8ececdfbfa4a466205c3a0
Instruction Fuzzy Hash: 23815726B04B5289FB11EFB6DC402ACA7B1FB44BA8F504139DE4DA3A58EF38D485C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D5C10, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

#4436.MFC42U ref: 00007FF72A9D5CC6
#1040.MFC42U ref: 00007FF72A9D5CE4
#2975.MFC42U ref: 00007FF72A9D5CFA
_wtoi.MSVCRT ref: 00007FF72A9D5D04
#5887.MFC42U ref: 00007FF72A9D5D14
#2975.MFC42U ref: 00007FF72A9D5D26
_wtoi.MSVCRT ref: 00007FF72A9D5D30
#5887.MFC42U ref: 00007FF72A9D5D40
_wcsicoll.MSVCRT ref: 00007FF72A9D5D63

Strings

IRQ, xrefs: 00007FF72A9D5CCC

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #2975#5887_wtoi$#1040#4436_wcsicoll
String ID: IRQ
API String ID: 534139910-350958057
Opcode ID: 184b4f2ae8438707fb33515ad6134d06a055dac0fc964edda90b99394ceb4d76
Instruction ID: f411abded02cbe8fd4d048fc5e31af31e631a8294defb559d5775c6380c844b0
Opcode Fuzzy Hash: 184b4f2ae8438707fb33515ad6134d06a055dac0fc964edda90b99394ceb4d76
Instruction Fuzzy Hash: AB410F76A14E1686FB10EF66D88406CB7B1FB84B98B504562DE8E83B64DF3CD485CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9E1B38, Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 50libraryloaderCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF72A9E1B6E
memset.MSVCRT ref: 00007FF72A9E1B7E

Part of subcall function 00007FF72A9E1B38: memset.MSVCRT ref: 00007FF72A9E18CF
Part of subcall function 00007FF72A9E1B38: memset.MSVCRT ref: 00007FF72A9E18E1

GetProcAddress.KERNEL32 ref: 00007FF72A9E1BB3

Strings

h, xrefs: 00007FF72A9E1B8B
\, xrefs: 00007FF72A9E1A8C
%s%s, xrefs: 00007FF72A9E1AA8
\\.\, xrefs: 00007FF72A9E1A9C
FveGetStatusW, xrefs: 00007FF72A9E1BA9
\, xrefs: 00007FF72A9E1A48
:, xrefs: 00007FF72A9E1A78

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$AddressProc
String ID: %s%s$:$FveGetStatusW$\$\$\\.\$h
API String ID: 3670167018-2296160095
Opcode ID: b703de2a45459cfcdb931b8b61f872809b6955423e7c66de27011e6d1eac1e78
Instruction ID: a7d021a811dad4f35db29069e2aff2616ea75556d47b581e59252e5aba01d0ed
Opcode Fuzzy Hash: b703de2a45459cfcdb931b8b61f872809b6955423e7c66de27011e6d1eac1e78
Instruction Fuzzy Hash: 6A11666270C68246FB25EB66ED50366A391FBA8744FC44171DA8CC6696EF2CD509CF10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D1240, Relevance: 16.6, APIs: 11, Instructions: 111COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D126E
#624.MFC42U ref: 00007FF72A9D12B5
#624.MFC42U ref: 00007FF72A9D12F1
#624.MFC42U ref: 00007FF72A9D132D
#624.MFC42U ref: 00007FF72A9D1369
#624.MFC42U ref: 00007FF72A9D13A5
#624.MFC42U ref: 00007FF72A9D13E1
#624.MFC42U ref: 00007FF72A9D141D
#624.MFC42U ref: 00007FF72A9D1459
#624.MFC42U ref: 00007FF72A9D1496
#624.MFC42U ref: 00007FF72A9D14D0

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624
String ID:
API String ID: 2145510954-0
Opcode ID: 4e28eef68380d30a3f573edad1a2e0067eb53ae8b3d02764adaf53e775c0c790
Instruction ID: bff351f4237614d00e87b4500f9ae9cc75c98e7571955c4173cc793c2f10a6f5
Opcode Fuzzy Hash: 4e28eef68380d30a3f573edad1a2e0067eb53ae8b3d02764adaf53e775c0c790
Instruction Fuzzy Hash: FA71C678A59A428BF700BF22FC44B65B6B4FF68744F9001B9C55C462B0CF7DA49A8F60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D9B20, Relevance: 16.6, APIs: 11, Instructions: 90COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D9B5B
#6886.MFC42U ref: 00007FF72A9D9B76
#6641.MFC42U ref: 00007FF72A9D9B97
#624.MFC42U ref: 00007FF72A9D9BAA
#1040.MFC42U ref: 00007FF72A9D9BC9
#6050.MFC42U ref: 00007FF72A9D9BEE
#1122.MFC42U ref: 00007FF72A9D9BFC
#1040.MFC42U ref: 00007FF72A9D9C07
#1381.MFC42U ref: 00007FF72A9D9C1A
#2629.MFC42U ref: 00007FF72A9D9C2D
#1040.MFC42U ref: 00007FF72A9D9C45

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040$#624$#1122#1381#2629#6050#6641#6886
String ID:
API String ID: 4233580416-0
Opcode ID: dc4275d35b1391d113b64c5340e5a7ba34e8af7775f2d72fe4ea670d9dc9fcdb
Instruction ID: 36871a36ec3070dec7acdb8c4f0ca864c81fb0bca734f0ffd2df54f6f1aa2602
Opcode Fuzzy Hash: dc4275d35b1391d113b64c5340e5a7ba34e8af7775f2d72fe4ea670d9dc9fcdb
Instruction Fuzzy Hash: 5C415B32A15A1289FB10AB62DC445ACB3B0FB54B95F954171CE5E936A8CF3CD889CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9F0550, Relevance: 16.5, APIs: 11, Instructions: 26COMMON

Download Yara Rule

APIs

#1040.MFC42U ref: 00007FF72A9F055B
#1040.MFC42U ref: 00007FF72A9F0568
#1040.MFC42U ref: 00007FF72A9F0575
#1040.MFC42U ref: 00007FF72A9F0582
#1040.MFC42U ref: 00007FF72A9F058F
#1040.MFC42U ref: 00007FF72A9F059C
#1040.MFC42U ref: 00007FF72A9F05A9
#1040.MFC42U ref: 00007FF72A9F05B6
#1040.MFC42U ref: 00007FF72A9F05C3
#1040.MFC42U ref: 00007FF72A9F05D0
#1040.MFC42U ref: 00007FF72A9F05DD

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040
String ID:
API String ID: 2974555078-0
Opcode ID: 92e385a51dbc2056efb9c3939d53f237cc427cebbc124a5acb9ec05838f76548
Instruction ID: 2d9a3f903c0d914e7ff78d6e9950dcf65cb114e2b4d43b63a0eeda819fbe5fc6
Opcode Fuzzy Hash: 92e385a51dbc2056efb9c3939d53f237cc427cebbc124a5acb9ec05838f76548
Instruction Fuzzy Hash: AE11883491980791FB00BB62EC64574BB35FF62745BD140B1C68EC20609E2DE9AACFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9DF480, Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 100COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9DF4D4
#1040.MFC42U ref: 00007FF72A9DF5E2

Strings

Video, xrefs: 00007FF72A9DF4C3
Win32_CODECFile, xrefs: 00007FF72A9DF4EC
EightDotThreeFileName, Manufacturer, Description, Status, Name, Version, FileSize, CreationDate, Group, xrefs: 00007FF72A9DF4DE
Group, xrefs: 00007FF72A9DF526
Audio, xrefs: 00007FF72A9DF4BC

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040#624
String ID: Audio$EightDotThreeFileName, Manufacturer, Description, Status, Name, Version, FileSize, CreationDate, Group$Group$Video$Win32_CODECFile
API String ID: 3692992626-2917065667
Opcode ID: e1f263458b307e5f58797d5d48cf05ea19fb631f1ca12692b23f5657629423eb
Instruction ID: 1c20b8f35b8ad8b69af0f3ee94c3180e3c9a459e0ebcf075cb0c719ff5d62c4a
Opcode Fuzzy Hash: e1f263458b307e5f58797d5d48cf05ea19fb631f1ca12692b23f5657629423eb
Instruction Fuzzy Hash: 3D411766714B0A85FB00AF66DC443A9A760FB88F98F814272CE5D87764DF3CD445C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9EA074, Relevance: 15.1, APIs: 10, Instructions: 111COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF72A9EA0B7
memset.MSVCRT ref: 00007FF72A9EA0C8
LoadStringW.USER32 ref: 00007FF72A9EA0E3
LoadStringW.USER32 ref: 00007FF72A9EA0FE
LoadStringW.USER32 ref: 00007FF72A9EA11B
memset.MSVCRT ref: 00007FF72A9EA170
GetSaveFileNameW.COMDLG32 ref: 00007FF72A9EA1E6
LoadCursorW.USER32 ref: 00007FF72A9EA1F7
SetCursor.USER32 ref: 00007FF72A9EA200
SetCursor.USER32 ref: 00007FF72A9EA219

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: Load$CursorStringmemset$FileNameSave
String ID:
API String ID: 586689672-0
Opcode ID: 118fcde2815f1e93ea35ff371d6536143460eaa6cd48d89c69a4764eb26c7db4
Instruction ID: 514d1e4db58bb346057ca7339b07eba0dc5db2a7808671849d4fad802d92fce9
Opcode Fuzzy Hash: 118fcde2815f1e93ea35ff371d6536143460eaa6cd48d89c69a4764eb26c7db4
Instruction Fuzzy Hash: 47517432B08B9285FB20DF62E8406ADB3A4FB98B44F900536DA8D47B55DF3CD105CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D1A10, Relevance: 15.1, APIs: 10, Instructions: 110COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D1A3A
#624.MFC42U ref: 00007FF72A9D1A87
#624.MFC42U ref: 00007FF72A9D1AC7
#624.MFC42U ref: 00007FF72A9D1B07
#624.MFC42U ref: 00007FF72A9D1B47
#624.MFC42U ref: 00007FF72A9D1B87
#624.MFC42U ref: 00007FF72A9D1BC7
#624.MFC42U ref: 00007FF72A9D1C07
#624.MFC42U ref: 00007FF72A9D1C47
#624.MFC42U ref: 00007FF72A9D1C84

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624
String ID:
API String ID: 2145510954-0
Opcode ID: daf7bf411edb39c36fd47960918c188950f0162e8772c2b51b2e7e7b52e31526
Instruction ID: 5727a34c577a5b13047a43197aa9266eb7fee8a0cf89f6e52212774df3fceaa2
Opcode Fuzzy Hash: daf7bf411edb39c36fd47960918c188950f0162e8772c2b51b2e7e7b52e31526
Instruction Fuzzy Hash: 75716CB09196828BF700BF21FC44B61FAB4FF45755F9101B9C558662A0EF7CA49ACF60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9EA250, Relevance: 15.1, APIs: 10, Instructions: 109fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF72A9EA31A
CloseHandle.KERNEL32 ref: 00007FF72A9EA354

Part of subcall function 00007FF72A9D9278: ResetEvent.KERNEL32 ref: 00007FF72A9D92CC
Part of subcall function 00007FF72A9D9278: ResetEvent.KERNEL32 ref: 00007FF72A9D92D6
Part of subcall function 00007FF72A9D9278: CreateThread.KERNEL32 ref: 00007FF72A9D92FB

Part of subcall function 00007FF72A9D932C: WaitForSingleObject.KERNEL32(?,?,?,00007FF72A9D929C,?,?,?,?,?,00007FF72A9D57F7), ref: 00007FF72A9D933B
Part of subcall function 00007FF72A9D932C: WaitForSingleObject.KERNEL32(?,?,?,00007FF72A9D929C,?,?,?,?,?,00007FF72A9D57F7), ref: 00007FF72A9D9351

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateEventObjectResetSingleWait$CloseFileHandleThread
String ID:
API String ID: 4255429375-0
Opcode ID: b15c547f7e36769094939b62573f06bad10314d635c10719865c076f54769bea
Instruction ID: 18e2273f5d839cef235561528e8f7d14f0c85f32b6be0f4cc0e7210686fe2248
Opcode Fuzzy Hash: b15c547f7e36769094939b62573f06bad10314d635c10719865c076f54769bea
Instruction Fuzzy Hash: AD416325608A8282FB14AB17ED54339A360FB94FD1F944271DE9D83BA5DF3CD4468B50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9E5350, Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 105COMMON

Download Yara Rule

APIs

#626.MFC42U ref: 00007FF72A9E5385
#1040.MFC42U ref: 00007FF72A9E54CB

Strings

Caption, xrefs: 00007FF72A9E5425
Caption, LocalServer32, xrefs: 00007FF72A9E544F
Win32_ClassicCOMClassSetting, xrefs: 00007FF72A9E539F
Caption, LocalServer32, Insertable, Control, xrefs: 00007FF72A9E5394
Insertable, xrefs: 00007FF72A9E53E1
Control, xrefs: 00007FF72A9E53FD

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040#626
String ID: Caption$Caption, LocalServer32$Caption, LocalServer32, Insertable, Control$Control$Insertable$Win32_ClassicCOMClassSetting
API String ID: 839973214-3981714864
Opcode ID: 4c7ed33320fce80e10a8ca69660aa3c1f14fbc3fa93559f78d424bf2cc810773
Instruction ID: 7a41c04982889ca4cccc8478c72bde50b836b516a0b98732ad556b94003ca4bf
Opcode Fuzzy Hash: 4c7ed33320fce80e10a8ca69660aa3c1f14fbc3fa93559f78d424bf2cc810773
Instruction Fuzzy Hash: 86512726B18B4685FB009F6AD8402ACA7B0FB48FA8F944272CE5D837A4DF38D445CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D17D0, Relevance: 13.6, APIs: 9, Instructions: 98COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D1802
#624.MFC42U ref: 00007FF72A9D1848
#624.MFC42U ref: 00007FF72A9D1883
#624.MFC42U ref: 00007FF72A9D18BB
#624.MFC42U ref: 00007FF72A9D18F3
#624.MFC42U ref: 00007FF72A9D192B
#624.MFC42U ref: 00007FF72A9D1963
#624.MFC42U ref: 00007FF72A9D199B
#624.MFC42U ref: 00007FF72A9D19CF

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624
String ID:
API String ID: 2145510954-0
Opcode ID: 9c121d8830cc80dd3a33f9d8c7f35d1df87c13741cbb5262c6bbf9c14238569e
Instruction ID: 9aecc3fcaa3bd0ac16f3e5eb87522c13acf15e10c69110bfc44231afa7f92291
Opcode Fuzzy Hash: 9c121d8830cc80dd3a33f9d8c7f35d1df87c13741cbb5262c6bbf9c14238569e
Instruction Fuzzy Hash: 90519D74908A4287F700AF26FC44B61B6B4FF44B54F9101BAC95DC62A0DF7DB89A8F60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9E0CFC, Relevance: 13.6, APIs: 9, Instructions: 92COMMON

Download Yara Rule

APIs

#626.MFC42U ref: 00007FF72A9E0D32
#2629.MFC42U ref: 00007FF72A9E0D3C
#2629.MFC42U ref: 00007FF72A9E0D4A
#4473.MFC42U ref: 00007FF72A9E0DC0
#1287.MFC42U ref: 00007FF72A9E0DDF
#1284.MFC42U ref: 00007FF72A9E0DEC
#1122.MFC42U ref: 00007FF72A9E0DF8
#1040.MFC42U ref: 00007FF72A9E0E16
#6880.MFC42U ref: 00007FF72A9E0E35

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #2629$#1040#1122#1284#1287#4473#626#6880
String ID:
API String ID: 1833690969-0
Opcode ID: 3c9c4372b493de4e42e02386bcaeacf088762f8f73d583bc1aac379a581b0737
Instruction ID: 0bdd6a4e29781531ffd8a5d744c7732ddf9c9fe34f1e9c1e3634db7079fb38af
Opcode Fuzzy Hash: 3c9c4372b493de4e42e02386bcaeacf088762f8f73d583bc1aac379a581b0737
Instruction Fuzzy Hash: A031FB3154C74286F711AB27DD44079A2A0FB50B50FD05172DD9EC6AA9CE3CE9C6CF10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9E99E0, Relevance: 13.6, APIs: 9, Instructions: 78COMMON

Download Yara Rule

APIs

#1122.MFC42U(?,?,?,?,?,?,?,00000000,?,00007FF72A9E954F), ref: 00007FF72A9E9A0F
#1122.MFC42U(?,?,?,?,?,?,?,00000000,?,00007FF72A9E954F), ref: 00007FF72A9E9A1F
ShowWindow.USER32(?,?,?,?,?,?,?,00000000,?,00007FF72A9E954F), ref: 00007FF72A9E9A40
ShowWindow.USER32(?,?,?,?,?,?,?,00000000,?,00007FF72A9E954F), ref: 00007FF72A9E9A51
GetWindowRect.USER32 ref: 00007FF72A9E9A68
ScreenToClient.USER32 ref: 00007FF72A9E9A98
ScreenToClient.USER32 ref: 00007FF72A9E9AA6
InvalidateRect.USER32(?,?,?,?,?,?,?,00000000,?,00007FF72A9E954F), ref: 00007FF72A9E9AD2
UpdateWindow.USER32 ref: 00007FF72A9E9ADC

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$#1122ClientRectScreenShow$InvalidateUpdate
String ID:
API String ID: 3993175154-0
Opcode ID: 36600c0405ee3fac0a41ccc8142e8b027af8e4b06e6e4fcb19ab09144d0cce4a
Instruction ID: 529c1be7efe6cfa298916903d732399b9e3196e9413c2109c4ee603e1c59be66
Opcode Fuzzy Hash: 36600c0405ee3fac0a41ccc8142e8b027af8e4b06e6e4fcb19ab09144d0cce4a
Instruction Fuzzy Hash: DF31F676F14A128EFB00DB66D9806AC77B1FB48B58F504021CE4D93B18DF3894958B50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9DF138, Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

#626.MFC42U ref: 00007FF72A9DF17A
#626.MFC42U ref: 00007FF72A9DF186
#4473.MFC42U ref: 00007FF72A9DF197
#2846.MFC42U ref: 00007FF72A9DF1AB
GetDeviceCaps.GDI32 ref: 00007FF72A9DF1BE
GetDeviceCaps.GDI32 ref: 00007FF72A9DF1D3
EndPage.GDI32 ref: 00007FF72A9DF216
#1040.MFC42U ref: 00007FF72A9DF225
#1040.MFC42U ref: 00007FF72A9DF231

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040#626CapsDevice$#2846#4473Page
String ID:
API String ID: 904875598-0
Opcode ID: c9b3960332f308e2a9de654478840d70ffe9096859a3e009fb9564b1d13f65f7
Instruction ID: 60c20a82db96071c312f78d8e66939787721e215b4a4ed3081b542eda78fb59a
Opcode Fuzzy Hash: c9b3960332f308e2a9de654478840d70ffe9096859a3e009fb9564b1d13f65f7
Instruction Fuzzy Hash: 16311E36614A4287E750EB26E844129F360F785BA5F604135DB9EC3BA4CF7DE88ACF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D6D00, Relevance: 13.6, APIs: 9, Instructions: 68COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF72A9D6D26
VariantChangeType.OLEAUT32 ref: 00007FF72A9D6D61
_wtoi.MSVCRT ref: 00007FF72A9D6D7D
_wtoi.MSVCRT ref: 00007FF72A9D6D90
_wtoi.MSVCRT ref: 00007FF72A9D6DA3
_wtoi.MSVCRT ref: 00007FF72A9D6DB6
_wtoi.MSVCRT ref: 00007FF72A9D6DC9
_wtoi.MSVCRT ref: 00007FF72A9D6DDB
VariantClear.OLEAUT32 ref: 00007FF72A9D6DF1

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: _wtoi$Variant$ChangeClearInitType
String ID:
API String ID: 1390782790-0
Opcode ID: cd81cb3c60cc7ca1e2ed120ab4a2d7964efcf4778127b412653c1646043163ca
Instruction ID: bd4c8458ddcdfb77588e752cab163fd22a29b1c8704f9493b763a88c1446f8d8
Opcode Fuzzy Hash: cd81cb3c60cc7ca1e2ed120ab4a2d7964efcf4778127b412653c1646043163ca
Instruction Fuzzy Hash: D7316D36614B82D2E704EF12E944169B374FF48B90B858162CF8DC3B60EF38E1A4CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9E88C0, Relevance: 12.1, APIs: 8, Instructions: 90windowCOMMON

Download Yara Rule

APIs

#624.MFC42U(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00007FF72A9E88F5
#620.MFC42U ref: 00007FF72A9E8952
#4521.MFC42U ref: 00007FF72A9E895D
#6704.MFC42U ref: 00007FF72A9E896E
#2845.MFC42U ref: 00007FF72A9E8981
#1040.MFC42U ref: 00007FF72A9E898C
SendMessageW.USER32 ref: 00007FF72A9E89C1
#1040.MFC42U ref: 00007FF72A9E8A08

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040$#2845#4521#620#624#6704MessageSend
String ID:
API String ID: 2342561892-0
Opcode ID: 63d4f24d99a650d61b6e7ce5588456b37b1cdbc30db89a6f0cdbf63e40da612a
Instruction ID: 0e4c517342085033b95a831dcfad88696baa768a8c1b7c3ffffad989183eae5c
Opcode Fuzzy Hash: 63d4f24d99a650d61b6e7ce5588456b37b1cdbc30db89a6f0cdbf63e40da612a
Instruction Fuzzy Hash: C6415D32A04B4699FB10AF66DC503A87360FB44FA8F944272CA6D837E8DF38D559CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D68D0, Relevance: 12.1, APIs: 8, Instructions: 78COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF72A9D68EC
#6545.MFC42U ref: 00007FF72A9D68FB
SafeArrayGetDim.OLEAUT32 ref: 00007FF72A9D6945
SafeArrayGetLBound.OLEAUT32 ref: 00007FF72A9D6960
SafeArrayGetUBound.OLEAUT32 ref: 00007FF72A9D6971
SafeArrayGetElement.OLEAUT32 ref: 00007FF72A9D698B
#6226.MFC42U ref: 00007FF72A9D69A0
VariantClear.OLEAUT32 ref: 00007FF72A9D69BE

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: ArraySafe$BoundVariant$#6226#6545ClearElementInit
String ID:
API String ID: 3309770364-0
Opcode ID: 7ed09a43c4def0fa58c0bc93ced22563acf5bb4c24ddb7b9dbcfa50e8a0c8aef
Instruction ID: 4077793e10a14bc4df2a1645fa5b3acf58bd1198ef329108916ef3f1baca165a
Opcode Fuzzy Hash: 7ed09a43c4def0fa58c0bc93ced22563acf5bb4c24ddb7b9dbcfa50e8a0c8aef
Instruction Fuzzy Hash: 95313076B14A128AF700AF67DC940ACA770FB84B98B844532DB9DD3758DF3CD4858B50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D5814, Relevance: 12.1, APIs: 8, Instructions: 57synchronizationtimeCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF72A9D584A
KillTimer.USER32 ref: 00007FF72A9D585D
EndDialog.USER32 ref: 00007FF72A9D5868
#626.MFC42U ref: 00007FF72A9D5875
EnterCriticalSection.KERNEL32 ref: 00007FF72A9D5888
#1122.MFC42U ref: 00007FF72A9D589A
LeaveCriticalSection.KERNEL32 ref: 00007FF72A9D58A4
#1040.MFC42U(?), ref: 00007FF72A9D58CC

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$#1040#1122#626DialogEnterKillLeaveObjectSingleTimerWait
String ID:
API String ID: 3547688154-0
Opcode ID: b6e25a99aafa3027d06a8feea60e17ac3d0455b25bece6ba74e5934f94afdd3d
Instruction ID: 25f4b3860eb6029cfe92f214ab293f0ed44c6d4e123e6e8a16a6dfe6cf7ee3d7
Opcode Fuzzy Hash: b6e25a99aafa3027d06a8feea60e17ac3d0455b25bece6ba74e5934f94afdd3d
Instruction Fuzzy Hash: 46213E36614A46C2EB10EF16E84406DB370FB84F94BA44172CB9EC37A4DF38D996CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9E7CF4, Relevance: 12.0, APIs: 8, Instructions: 39windowCOMMON

Download Yara Rule

APIs

#626.MFC42U ref: 00007FF72A9E7D15
#626.MFC42U ref: 00007FF72A9E7D21
#1463.MFC42U ref: 00007FF72A9E7D2F
#4473.MFC42U ref: 00007FF72A9E7D43
#4473.MFC42U ref: 00007FF72A9E7D50
MessageBoxW.USER32 ref: 00007FF72A9E7D67
#1040.MFC42U ref: 00007FF72A9E7D73
#1040.MFC42U ref: 00007FF72A9E7D7F

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040#4473#626$#1463Message
String ID:
API String ID: 937591819-0
Opcode ID: 30af22330321746d8da83d8f7fcb983397673bf28ffe0360fb18e40f7624b799
Instruction ID: b739d9a3afc40dd4bca022305256876669fb8ca987ada3e5ba3fe03461316c3f
Opcode Fuzzy Hash: 30af22330321746d8da83d8f7fcb983397673bf28ffe0360fb18e40f7624b799
Instruction Fuzzy Hash: C711EF26608A4292E700AB56FC44069B730FBD9BA1BA50171DBADC37B4DF3CD959CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9EE4CD, Relevance: 12.0, APIs: 8, Instructions: 37windowCOMMON

Download Yara Rule

APIs

#1463.MFC42U ref: 00007FF72A9EE4E2
#626.MFC42U ref: 00007FF72A9EE4F0
#626.MFC42U ref: 00007FF72A9EE4FB
#4473.MFC42U ref: 00007FF72A9EE50B
#4473.MFC42U ref: 00007FF72A9EE51A
MessageBoxW.USER32 ref: 00007FF72A9EE52D
#1040.MFC42U ref: 00007FF72A9EE538
#1040.MFC42U ref: 00007FF72A9EE543

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040#4473#626$#1463Message
String ID:
API String ID: 937591819-0
Opcode ID: 4e1e3c3b5e8fcdb4b0389ee4b7ec71c645f2211a6ef96cf4c8c6d3bb1ef6e521
Instruction ID: 680b56f202dcc764f4b3680899d61e27015db9a0ac847cf7183a356dc0ecba86
Opcode Fuzzy Hash: 4e1e3c3b5e8fcdb4b0389ee4b7ec71c645f2211a6ef96cf4c8c6d3bb1ef6e521
Instruction Fuzzy Hash: F2012D62604A029AF714AF22EC440A87770FB9D75AB961172D68DC2634DF3CD99DCB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9EE989, Relevance: 12.0, APIs: 8, Instructions: 37windowCOMMON

Download Yara Rule

APIs

#1463.MFC42U ref: 00007FF72A9EE99E
#626.MFC42U ref: 00007FF72A9EE9AC
#626.MFC42U ref: 00007FF72A9EE9B7
#4473.MFC42U ref: 00007FF72A9EE9C7
#4473.MFC42U ref: 00007FF72A9EE9D6
MessageBoxW.USER32 ref: 00007FF72A9EE9E9
#1040.MFC42U ref: 00007FF72A9EE9F4
#1040.MFC42U ref: 00007FF72A9EE9FF

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040#4473#626$#1463Message
String ID:
API String ID: 937591819-0
Opcode ID: 09d97230202b92702ceaad2504010469cfbbe42713c2d78459588ed07bb98df1
Instruction ID: 6b6ae75cb5873344e09039aff3d182bd1a93c1e8e8f84ce254f1163521d07863
Opcode Fuzzy Hash: 09d97230202b92702ceaad2504010469cfbbe42713c2d78459588ed07bb98df1
Instruction Fuzzy Hash: 46016D226059029AF710AF22EC440A87730FB9D75AB961071D68EC2634DF3CD98CCB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9EE7EB, Relevance: 12.0, APIs: 8, Instructions: 37windowCOMMON

Download Yara Rule

APIs

#1463.MFC42U ref: 00007FF72A9EE800
#626.MFC42U ref: 00007FF72A9EE80E
#626.MFC42U ref: 00007FF72A9EE819
#4473.MFC42U ref: 00007FF72A9EE829
#4473.MFC42U ref: 00007FF72A9EE838
MessageBoxW.USER32 ref: 00007FF72A9EE84B
#1040.MFC42U ref: 00007FF72A9EE856
#1040.MFC42U ref: 00007FF72A9EE861

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040#4473#626$#1463Message
String ID:
API String ID: 937591819-0
Opcode ID: 036267c8757f99e5ab1763890a2ca00941964de2f05c70056a03bce57c7ea1c5
Instruction ID: d173d513e0c6724a856106ed6c1d9bab2627c0652d0a5e03e60e93af9e378237
Opcode Fuzzy Hash: 036267c8757f99e5ab1763890a2ca00941964de2f05c70056a03bce57c7ea1c5
Instruction Fuzzy Hash: 6E012D22605A029AF714AF22EC444A87730FB9D75ABD61171D68DC2674DF3CD99CCBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9DCCB0, Relevance: 10.8, APIs: 7, Instructions: 277COMMON

Download Yara Rule

APIs

#1122.MFC42U ref: 00007FF72A9DCCF3
#626.MFC42U ref: 00007FF72A9DCDC7
#1122.MFC42U ref: 00007FF72A9DCE5F
#1040.MFC42U ref: 00007FF72A9DCEA6

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1122$#1040#626
String ID:
API String ID: 3102134900-0
Opcode ID: 779125f422a47d785225b218efdf337ee9a4abb587318facfb1937c49484e2c3
Instruction ID: d648f577ca703a28fd198ae7f66cfeaa7fcf2f88f7a12b3b0facaaf922794b92
Opcode Fuzzy Hash: 779125f422a47d785225b218efdf337ee9a4abb587318facfb1937c49484e2c3
Instruction Fuzzy Hash: 0CC17336608B4286FB20EF2AD844269BB60FB85F94F814171CE9EC7764DF39D885CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9EC92C, Relevance: 10.6, APIs: 7, Instructions: 143sleepCOMMON

Download Yara Rule

APIs

GetStartupInfoW.KERNEL32 ref: 00007FF72A9EC954
Sleep.KERNEL32 ref: 00007FF72A9EC98B
_amsg_exit.MSVCRT ref: 00007FF72A9EC9A9
_initterm.MSVCRT ref: 00007FF72A9ECA34
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF72A9ECA61
exit.MSVCRT ref: 00007FF72A9ECB06
_cexit.MSVCRT ref: 00007FF72A9ECB15

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentImageInfoNonwritableSleepStartup_amsg_exit_cexit_inittermexit
String ID:
API String ID: 642454821-0
Opcode ID: c34eeac508ea294c86dc45adcdb50777207f73b3f68eac68298b64ff893e2a62
Instruction ID: 22c4308bb9f4c5bb5455bb6c558274a87de02a10cd1544633d0d0b73fb38c882
Opcode Fuzzy Hash: c34eeac508ea294c86dc45adcdb50777207f73b3f68eac68298b64ff893e2a62
Instruction Fuzzy Hash: E3611C31A0C68382FB61AB16AE50679A2A1FF54740FD400B6D9CED7295DF3CE951CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9DAD10, Relevance: 10.6, APIs: 7, Instructions: 96COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF72A9DAD5C
#624.MFC42U ref: 00007FF72A9DAD69
#2794.MFC42U ref: 00007FF72A9DADAC
#1483.MFC42U ref: 00007FF72A9DADE8
#2783.MFC42U ref: 00007FF72A9DAE0D
#6880.MFC42U ref: 00007FF72A9DAE32
#1040.MFC42U ref: 00007FF72A9DAE3E

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040#1483#2783#2794#624#6880memset
String ID:
API String ID: 22266292-0
Opcode ID: 352ac8dc684810eb87b09704cc4ee6f5aa8c5ba39c7d1eaf76d56c1d90d03b12
Instruction ID: 011a3cc3c1730f9c2d234eb64ee5f4f7afaa9f4fe06cc45d04c2f318224c2224
Opcode Fuzzy Hash: 352ac8dc684810eb87b09704cc4ee6f5aa8c5ba39c7d1eaf76d56c1d90d03b12
Instruction Fuzzy Hash: 8C31D622708A4241FB11BB13ED44279A361EF49FD1F944171DE9D83B94DF3CD496CA20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D1510, Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D153E
#624.MFC42U ref: 00007FF72A9D1585
#624.MFC42U ref: 00007FF72A9D15C1
#624.MFC42U ref: 00007FF72A9D15FE
#624.MFC42U ref: 00007FF72A9D163B
#624.MFC42U ref: 00007FF72A9D1677
#624.MFC42U ref: 00007FF72A9D16B0

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624
String ID:
API String ID: 2145510954-0
Opcode ID: 7dfe72a58d8eeee89421c7023314d51d9e0f1fb6f9137db9f79d530e20fb852c
Instruction ID: 19301da2618f5733ba4d316400d4512bf2c6c3721193c9871071bb3b58461384
Opcode Fuzzy Hash: 7dfe72a58d8eeee89421c7023314d51d9e0f1fb6f9137db9f79d530e20fb852c
Instruction Fuzzy Hash: BF51D374928B4286F704BF22FC48B61B7B4FF40B54F9061B9D95C462A0CF7DA49A8F61

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D6478, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

#6886.MFC42U ref: 00007FF72A9D64A4

Part of subcall function 00007FF72A9D8EBC: #626.MFC42U ref: 00007FF72A9D8F1E
Part of subcall function 00007FF72A9D8EBC: #626.MFC42U ref: 00007FF72A9D8F2C

#626.MFC42U ref: 00007FF72A9D6528
#2846.MFC42U ref: 00007FF72A9D653E
#1284.MFC42U ref: 00007FF72A9D6550
#1040.MFC42U ref: 00007FF72A9D655C

Strings

(%s), xrefs: 00007FF72A9D6532

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #626$#1040#1284#2846#6886
String ID: (%s)
API String ID: 1702355255-440625562
Opcode ID: a95272bfcd5ee8d387ff95c2faeea8d197a6918b2179d28c756b6ad459d550d7
Instruction ID: 76fb69e614ed6b86440f6d8294c11e131261d60d92fc6b49f210a1ab5b6671af
Opcode Fuzzy Hash: a95272bfcd5ee8d387ff95c2faeea8d197a6918b2179d28c756b6ad459d550d7
Instruction Fuzzy Hash: FD315E22618F4282FB00AF56E844368B7A0FB84FA5F954175CB9D877A8DF7CD489CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9E95A0, Relevance: 10.5, APIs: 7, Instructions: 42COMMON

Download Yara Rule

APIs

ReleaseCapture.USER32 ref: 00007FF72A9E95C8
LoadCursorW.USER32 ref: 00007FF72A9E95D9
SetCursor.USER32 ref: 00007FF72A9E95E2
PtInRect.USER32 ref: 00007FF72A9E95F9
SetCapture.USER32 ref: 00007FF72A9E960D
LoadCursorW.USER32 ref: 00007FF72A9E9621
SetCursor.USER32 ref: 00007FF72A9E962A

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: Cursor$CaptureLoad$RectRelease
String ID:
API String ID: 590470721-0
Opcode ID: baee051b967f670554bfa234c4284c5446489537e5485bb668e2c7b88a3df566
Instruction ID: aa64e3da9d9ad901adb191dd560e9bf50822ab9dfa567dffcb28eb9d40e6394d
Opcode Fuzzy Hash: baee051b967f670554bfa234c4284c5446489537e5485bb668e2c7b88a3df566
Instruction Fuzzy Hash: 8711123191869286FB50AF27E84423DB361FB94F55F640076DA8A83699CF3DD885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9EC534, Relevance: 10.5, APIs: 7, Instructions: 21COMMON

Download Yara Rule

APIs

#1040.MFC42U ref: 00007FF72A9EC544
#1040.MFC42U ref: 00007FF72A9EC551
#1040.MFC42U ref: 00007FF72A9EC55E
#1040.MFC42U ref: 00007FF72A9EC56B
#1040.MFC42U ref: 00007FF72A9EC578
#1040.MFC42U ref: 00007FF72A9EC585
#1040.MFC42U ref: 00007FF72A9EC58F

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040
String ID:
API String ID: 2974555078-0
Opcode ID: 0f54c315c1b454be4690908286dfad6a269cefef97dd1b1cf62131dfa0f0b299
Instruction ID: fa4b2157622e4ec3100986e7cc7d982a293f3e74df1005c5588279e586e5d1da
Opcode Fuzzy Hash: 0f54c315c1b454be4690908286dfad6a269cefef97dd1b1cf62131dfa0f0b299
Instruction Fuzzy Hash: CCF06762A1484792FB00AF22DC542B87724FB55B49FD50071CB8EC6064DE2DD5AECBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D2300, Relevance: 9.1, APIs: 6, Instructions: 74COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D232A
#624.MFC42U ref: 00007FF72A9D2374
#624.MFC42U ref: 00007FF72A9D23B2
#624.MFC42U ref: 00007FF72A9D23F0
#624.MFC42U ref: 00007FF72A9D242E
#624.MFC42U ref: 00007FF72A9D2469

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624
String ID:
API String ID: 2145510954-0
Opcode ID: 681afd1a594c4e5d7e9d5ef69367820fb2a1432d6067bd16e22684870bf3ee05
Instruction ID: 1955a4877a0ddb0579f2aa6297f1c27f091b7e00df478f555f956566a112dcfb
Opcode Fuzzy Hash: 681afd1a594c4e5d7e9d5ef69367820fb2a1432d6067bd16e22684870bf3ee05
Instruction Fuzzy Hash: 9E41C27491864287F700BB22FC54B61B6B4FF56766F9041BAC5CC862A0CF7CA45ACF60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D75B0, Relevance: 9.0, APIs: 6, Instructions: 46COMMON

Download Yara Rule

APIs

#1040.MFC42U ref: 00007FF72A9D7608
#1040.MFC42U ref: 00007FF72A9D7613
#1040.MFC42U ref: 00007FF72A9D761E
#1040.MFC42U ref: 00007FF72A9D7633
#1040.MFC42U ref: 00007FF72A9D763E
#1040.MFC42U ref: 00007FF72A9D7649

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040
String ID:
API String ID: 2974555078-0
Opcode ID: fafe7da9f212255364ebf4e773cf8e91076e3d46111564981e7329e58faea67a
Instruction ID: 0bb73f436d8a628f82e07fe50832e8e200e9e6a482818a220b04d56b2f118809
Opcode Fuzzy Hash: fafe7da9f212255364ebf4e773cf8e91076e3d46111564981e7329e58faea67a
Instruction Fuzzy Hash: 3B112C22604E0296EB00AF25DC54378B724FB56F56F910271C65EC22B4DF39D85CCB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9E9AFC, Relevance: 9.0, APIs: 6, Instructions: 43COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9E9B2B
#624.MFC42U ref: 00007FF72A9E9B3E
#1463.MFC42U ref: 00007FF72A9E9B4C
#4473.MFC42U ref: 00007FF72A9E9B61
#1040.MFC42U ref: 00007FF72A9E9B82
#1040.MFC42U ref: 00007FF72A9E9B8E

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040#624$#1463#4473
String ID:
API String ID: 1009252036-0
Opcode ID: 2bcd1bd9d9d0cbbb08001d7a8312a8e543744fcf05e917ea6b1d7c92326fb7ac
Instruction ID: 60570af790eb826953d6711f6ee91843c34c2294b830e341efd7546589de4669
Opcode Fuzzy Hash: 2bcd1bd9d9d0cbbb08001d7a8312a8e543744fcf05e917ea6b1d7c92326fb7ac
Instruction Fuzzy Hash: 61116332A08E4292E710AF16EC40069B770FBD9BA4B954271DAAD837B4CE3CD949CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9E151C, Relevance: 9.0, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

#626.MFC42U ref: 00007FF72A9E1547
#4473.MFC42U ref: 00007FF72A9E1561
#4473.MFC42U ref: 00007FF72A9E156E
#1287.MFC42U ref: 00007FF72A9E158A
#1284.MFC42U ref: 00007FF72A9E1598
#1040.MFC42U ref: 00007FF72A9E15A9

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #4473$#1040#1284#1287#626
String ID:
API String ID: 534389445-0
Opcode ID: 881f46ffaf060b231ac6b8d9f026a4199fddb2b302100bcea2e99229737b7113
Instruction ID: 3ea1e8742a606e1a3945c582cd202492923477da844e31b60d4fbf4d8db2339c
Opcode Fuzzy Hash: 881f46ffaf060b231ac6b8d9f026a4199fddb2b302100bcea2e99229737b7113
Instruction Fuzzy Hash: AB110D35608B4282E700AF06FC40268B760FB95BA0FA44171CBAE877A4DFBCD499CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D82C8, Relevance: 9.0, APIs: 6, Instructions: 39COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D82EC
#1463.MFC42U ref: 00007FF72A9D8308
#4473.MFC42U ref: 00007FF72A9D831E
#1463.MFC42U ref: 00007FF72A9D8341
#4473.MFC42U ref: 00007FF72A9D8357
#620.MFC42U ref: 00007FF72A9D8367

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1463#4473$#620#624
String ID:
API String ID: 3235557885-0
Opcode ID: 39f89bcb6f30ce9308e2091ff7fd9afcc7c2020260c39a6ac0557c8b168cf615
Instruction ID: 9ea3de5d5d83d8ad635a5aee72f87a99ba75609d8426d89806cf977bcb31ba8a
Opcode Fuzzy Hash: 39f89bcb6f30ce9308e2091ff7fd9afcc7c2020260c39a6ac0557c8b168cf615
Instruction Fuzzy Hash: 6D11DD20A08E4781FB04BB16ED44678F3B1EF58B81FE490B1C55D866658E3CE4C9CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D723C, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00007FF72A9D7277
SysAllocString.OLEAUT32 ref: 00007FF72A9D7283
SysFreeString.OLEAUT32 ref: 00007FF72A9D72DE
SysFreeString.OLEAUT32 ref: 00007FF72A9D72EC

Strings

WQL, xrefs: 00007FF72A9D7270

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: String$AllocFree
String ID: WQL
API String ID: 344208780-1249411209
Opcode ID: 8624ffc81aae07a74ea5044d053f16dee66c87dac843d177adbe8250b702feb5
Instruction ID: d0287db2318d9b423d5de6c8c2ce10bf972e79cf2b187e41f96f3eb792114c52
Opcode Fuzzy Hash: 8624ffc81aae07a74ea5044d053f16dee66c87dac843d177adbe8250b702feb5
Instruction Fuzzy Hash: B7214C25A09B8281FB10EB57E948229E360FB48FD0F9841B1DE8D87B68DF7ED445CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9E7B90, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF72A9E87F0: SendMessageW.USER32 ref: 00007FF72A9E8827
Part of subcall function 00007FF72A9E87F0: SendMessageW.USER32 ref: 00007FF72A9E8864
Part of subcall function 00007FF72A9E87F0: SendMessageW.USER32 ref: 00007FF72A9E887C
Part of subcall function 00007FF72A9E87F0: SendMessageW.USER32 ref: 00007FF72A9E8891
Part of subcall function 00007FF72A9E87F0: SendMessageW.USER32 ref: 00007FF72A9E88A9

#6050.MFC42U(?,?,?,00007FF72A9E738A), ref: 00007FF72A9E7BB5
_wcsicmp.MSVCRT ref: 00007FF72A9E7BC5
#1040.MFC42U(?,?,?,00007FF72A9E738A), ref: 00007FF72A9E7BD2
#30.ATL(?,?,?,00007FF72A9E738A), ref: 00007FF72A9E7BE8

Strings

.xml, xrefs: 00007FF72A9E7BBB

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$#1040#6050_wcsicmp
String ID: .xml
API String ID: 2241846543-2937849440
Opcode ID: 16d9be2212e8067e7f333a94f587e0d9f01b5db2ffeadfbfeef1efcc2f34cc95
Instruction ID: 9b5f49c45b33f0600d702839aef6a4e1eb49706c992b280b372c4a0cf0762cad
Opcode Fuzzy Hash: 16d9be2212e8067e7f333a94f587e0d9f01b5db2ffeadfbfeef1efcc2f34cc95
Instruction Fuzzy Hash: 39113062718A42D2FF50AB17D980239A320FB94F84F905072CB4E87765DF7DD4A9CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9DBDC0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

#626.MFC42U ref: 00007FF72A9DBDDE
#2846.MFC42U ref: 00007FF72A9DBDF4
#620.MFC42U ref: 00007FF72A9DBE04
#1040.MFC42U ref: 00007FF72A9DBE26

Strings

%ld, xrefs: 00007FF72A9DBDE8

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040#2846#620#626
String ID: %ld
API String ID: 3470000698-1112595699
Opcode ID: eb7e41643d3eef4f01c31712990a043ed4ad61e8b576a55c57197cc856ba68f1
Instruction ID: 99f559175dbe80d942d58cad77b2d898d9e88c0ec8f7c9852aaedaf1f1b8083d
Opcode Fuzzy Hash: eb7e41643d3eef4f01c31712990a043ed4ad61e8b576a55c57197cc856ba68f1
Instruction Fuzzy Hash: 3FF03621618A4292EB009B1AFC54069F330FB86BE5BA00271DBADC36B8DF3DD559CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9EABE8, Relevance: 7.6, APIs: 5, Instructions: 116COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF72A9E8EA8: SendMessageW.USER32(?,?,?,?,?,?,?,?,?,?,?,00007FF72A9E9C36), ref: 00007FF72A9E8EC1
Part of subcall function 00007FF72A9E8EA8: SendMessageW.USER32 ref: 00007FF72A9E8EEA

memset.MSVCRT ref: 00007FF72A9EAC69
PrintDlgExW.COMDLG32 ref: 00007FF72A9EAC93
memset.MSVCRT ref: 00007FF72A9EAD14
GetComputerNameW.KERNEL32 ref: 00007FF72A9EAD3C
wcsncpy_s.MSVCRT ref: 00007FF72A9EAD4A

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSendmemset$ComputerNamePrintwcsncpy_s
String ID:
API String ID: 474826802-0
Opcode ID: 24343ef2631fd2d4d1ce50d7f747ab19fc4553784a26e7029f5ecb620b5b3e8f
Instruction ID: 2ed20ed644f535df9eaafeca0147669959a5d2c223290e5c28f78754862978e3
Opcode Fuzzy Hash: 24343ef2631fd2d4d1ce50d7f747ab19fc4553784a26e7029f5ecb620b5b3e8f
Instruction Fuzzy Hash: 3041BF32B18B8686FB04AB27DD40269B7A0FB58B91F804176DE9D83BA5DF3CD445CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9E9D40, Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF72A9E9D7D
LoadStringW.USER32 ref: 00007FF72A9E9D98
LoadStringW.USER32 ref: 00007FF72A9E9DB3
memset.MSVCRT ref: 00007FF72A9E9E09
GetOpenFileNameW.COMDLG32 ref: 00007FF72A9E9E6F

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: LoadStringmemset$FileNameOpen
String ID:
API String ID: 1733674691-0
Opcode ID: 2504a3d4d09153e20592403426cbe8891f3fe7fab1668c2be538e3a4bd92d1c2
Instruction ID: 7b22134f540c53aaeaceb7430dd93c3106ed6e81e912b0a5539cd1ffd5d77139
Opcode Fuzzy Hash: 2504a3d4d09153e20592403426cbe8891f3fe7fab1668c2be538e3a4bd92d1c2
Instruction Fuzzy Hash: 9B418132A18A9289F7209B65E8407AEB3A4FB98744F940136DB8D83B59DF3CD145CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D8458, Relevance: 7.6, APIs: 5, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8d5a747ae0f6bc770413399ffb621cc2b55fa91297c9f4e6931e181446625aa
Instruction ID: 81b122f2957a2eb93176ca638473651f03a0aff1b1772eabc9ba2128f10031d7
Opcode Fuzzy Hash: b8d5a747ae0f6bc770413399ffb621cc2b55fa91297c9f4e6931e181446625aa
Instruction Fuzzy Hash: BC21C221614B8281FB20BF669C84139A6A4FF58FD4BA48475CF8D8B756EE3DE4818B10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D2190, Relevance: 7.6, APIs: 5, Instructions: 65COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D21BA
#624.MFC42U ref: 00007FF72A9D2204
#624.MFC42U ref: 00007FF72A9D2242
#624.MFC42U ref: 00007FF72A9D2280
#624.MFC42U ref: 00007FF72A9D22BB

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624
String ID:
API String ID: 2145510954-0
Opcode ID: 3791d41c0f0705f3f2905c526ad5434f6030f74400b0b5bba8da1ac08d52154e
Instruction ID: a93139289be516a2d41c5d4d18f1370e4ffb47acc39cb5f18d5e3cd65cd556ec
Opcode Fuzzy Hash: 3791d41c0f0705f3f2905c526ad5434f6030f74400b0b5bba8da1ac08d52154e
Instruction Fuzzy Hash: 5241CF7181C64287F700AB21EC44B61B2B4FF44725F9001B9C59D86AA1CF7CA09ACF68

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D1E00, Relevance: 7.6, APIs: 5, Instructions: 65COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D1E2A
#624.MFC42U ref: 00007FF72A9D1E74
#624.MFC42U ref: 00007FF72A9D1EB2
#624.MFC42U ref: 00007FF72A9D1EF0
#624.MFC42U ref: 00007FF72A9D1F2A

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624
String ID:
API String ID: 2145510954-0
Opcode ID: 69708501f2cdf4ee0c6da802822033309ed33cb0eae9d713e00e3cd4f92ac844
Instruction ID: c1ff8185c912dbf1dfbf21f7540bb5d55cb0e7ec8216e69c90d34ad734311faa
Opcode Fuzzy Hash: 69708501f2cdf4ee0c6da802822033309ed33cb0eae9d713e00e3cd4f92ac844
Instruction Fuzzy Hash: 8F41B47191868287F700BB25EC44B72B6F4FF55755F900ABAC5AC862A0CF7CA05E8F60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D58EC, Relevance: 7.6, APIs: 5, Instructions: 50windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF72A9D5916
SendMessageW.USER32(?,?,00007FF72A9D58C6,?), ref: 00007FF72A9D5948
SendMessageW.USER32(?,?,00007FF72A9D58C6,?), ref: 00007FF72A9D595C
GetDlgItem.USER32 ref: 00007FF72A9D5973
SetWindowTextW.USER32(?,?,00007FF72A9D58C6,?), ref: 00007FF72A9D5984

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: ItemMessageSend$TextWindow
String ID:
API String ID: 708702904-0
Opcode ID: 6d258ba6d70f56f48684128e5c3ff49f96a56d193dd234aaff480acbb9dabc7a
Instruction ID: adc1a961142987209548b800a8ba86a01945db1707ef0420ebb977a0887ecc8e
Opcode Fuzzy Hash: 6d258ba6d70f56f48684128e5c3ff49f96a56d193dd234aaff480acbb9dabc7a
Instruction Fuzzy Hash: BD116022704B4186FB109F57A884729A7A1FB88F80F488071CF8E93754DF3DD4828B50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9E87F0, Relevance: 7.5, APIs: 5, Instructions: 49windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF72A9E8827

Part of subcall function 00007FF72A9E88C0: #624.MFC42U(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00007FF72A9E88F5
Part of subcall function 00007FF72A9E88C0: #620.MFC42U ref: 00007FF72A9E8952
Part of subcall function 00007FF72A9E88C0: #4521.MFC42U ref: 00007FF72A9E895D
Part of subcall function 00007FF72A9E88C0: #6704.MFC42U ref: 00007FF72A9E896E
Part of subcall function 00007FF72A9E88C0: #2845.MFC42U ref: 00007FF72A9E8981
Part of subcall function 00007FF72A9E88C0: #1040.MFC42U ref: 00007FF72A9E898C
Part of subcall function 00007FF72A9E88C0: SendMessageW.USER32 ref: 00007FF72A9E89C1
Part of subcall function 00007FF72A9E88C0: #1040.MFC42U ref: 00007FF72A9E8A08

SendMessageW.USER32 ref: 00007FF72A9E8864
SendMessageW.USER32 ref: 00007FF72A9E887C
SendMessageW.USER32 ref: 00007FF72A9E8891
SendMessageW.USER32 ref: 00007FF72A9E88A9

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$#1040$#2845#4521#620#624#6704
String ID:
API String ID: 1674383402-0
Opcode ID: 6e5b02b6615e204702e769acdaec40bc9e8360fbe274af283057e0b5bd4b17d8
Instruction ID: 4334978de1e4647f975da28ad994b1214a7cba1d8fcc4c22a22ea08cb9e62b9e
Opcode Fuzzy Hash: 6e5b02b6615e204702e769acdaec40bc9e8360fbe274af283057e0b5bd4b17d8
Instruction Fuzzy Hash: 8D112276B14A0242FB106B63DC50769A361FF8CF94F544230CD6D8B7D9EE2DC4418B50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D9278, Relevance: 7.5, APIs: 5, Instructions: 39threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF72A9D932C: WaitForSingleObject.KERNEL32(?,?,?,00007FF72A9D929C,?,?,?,?,?,00007FF72A9D57F7), ref: 00007FF72A9D933B
Part of subcall function 00007FF72A9D932C: WaitForSingleObject.KERNEL32(?,?,?,00007FF72A9D929C,?,?,?,?,?,00007FF72A9D57F7), ref: 00007FF72A9D9351

ResetEvent.KERNEL32 ref: 00007FF72A9D92CC
ResetEvent.KERNEL32 ref: 00007FF72A9D92D6
CreateThread.KERNEL32 ref: 00007FF72A9D92FB
ResetEvent.KERNEL32 ref: 00007FF72A9D930A
SetEvent.KERNEL32 ref: 00007FF72A9D9314

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: Event$Reset$ObjectSingleWait$CreateThread
String ID:
API String ID: 1060328053-0
Opcode ID: f00c1ba5a4c986214e59667dbc79920a854e0ae283d8d530f38b2c3ed9592c69
Instruction ID: 982211a451549bdafa009271e144cada9998b5988c205ebd8ade282b6dfab77b
Opcode Fuzzy Hash: f00c1ba5a4c986214e59667dbc79920a854e0ae283d8d530f38b2c3ed9592c69
Instruction Fuzzy Hash: 5311C932904B4287E720AF22E84435AF760FB44794F904175DBDA86B54CF7DE1998B50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9DF2BC, Relevance: 7.5, APIs: 5, Instructions: 36COMMON

Download Yara Rule

APIs

#626.MFC42U ref: 00007FF72A9DF2D3
#4473.MFC42U ref: 00007FF72A9DF2E4
GetTextExtentPoint32W.GDI32 ref: 00007FF72A9DF300
GetDeviceCaps.GDI32 ref: 00007FF72A9DF313
#1040.MFC42U ref: 00007FF72A9DF34C

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040#4473#626CapsDeviceExtentPoint32Text
String ID:
API String ID: 1389660501-0
Opcode ID: 25a04294ae227b1d1bcc31edebcaa78db875a3d606de0bb6497883ef6dd4621a
Instruction ID: 1bbf750b28125987d23703a139b8e07a2b6c1dbaa357191721f30aad4c56be84
Opcode Fuzzy Hash: 25a04294ae227b1d1bcc31edebcaa78db875a3d606de0bb6497883ef6dd4621a
Instruction Fuzzy Hash: FC11FE76614A4182EB04DF66E85446DB720F785BA4F504221DFAE837A8CF79C499CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D83C0, Relevance: 7.5, APIs: 5, Instructions: 24COMMON

Download Yara Rule

APIs

#1040.MFC42U ref: 00007FF72A9D83DD
#1040.MFC42U ref: 00007FF72A9D83E7
#1040.MFC42U ref: 00007FF72A9D83F1
#1040.MFC42U ref: 00007FF72A9D83FB
#6887.MFC42U ref: 00007FF72A9D8409

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040$#6887
String ID:
API String ID: 1046188398-0
Opcode ID: fb5731fda65cf6318b13bfa032c2f7ef8c49d203a96634b54ebccdd2b02ecd59
Instruction ID: f2138c09590c2a3cfd835086b68a9f6da8744292df040fe5718e4a8c361d24dd
Opcode Fuzzy Hash: fb5731fda65cf6318b13bfa032c2f7ef8c49d203a96634b54ebccdd2b02ecd59
Instruction Fuzzy Hash: B5F01D21A0890392EB04AB12ED94178B724FB44B80B954071CB8DC36A0DF2DD4E98B50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D4410, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D442A

Part of subcall function 00007FF72A9D89B8: #626.MFC42U ref: 00007FF72A9D8A6A
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8A7B
Part of subcall function 00007FF72A9D89B8: GetVersionExW.KERNEL32 ref: 00007FF72A9D8AE1
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8B3B
Part of subcall function 00007FF72A9D89B8: #620.MFC42U ref: 00007FF72A9D8B4C

#1040.MFC42U ref: 00007FF72A9D4497

Strings

ComponentsPrinting, xrefs: 00007FF72A9D4476
msinfo_printing.htm, xrefs: 00007FF72A9D441F

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624$#1040#620#626Version
String ID: ComponentsPrinting$msinfo_printing.htm
API String ID: 3113763436-1351591748
Opcode ID: 9db17c43ef2262715ebf877a45889acf7bb10fd51828dd7df24f9e97c5801d93
Instruction ID: fef5c1626ab8fbf1cbf5e8146a6fa84f3e95599adefdb126f9fa7bfd00e83ef6
Opcode Fuzzy Hash: 9db17c43ef2262715ebf877a45889acf7bb10fd51828dd7df24f9e97c5801d93
Instruction Fuzzy Hash: 7D112A31919A8691F710EB25EC442A5B3A4FB94360FD002B2D6DDC27A5DF3CD29ACF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D4B80, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D4B9A

Part of subcall function 00007FF72A9D89B8: #626.MFC42U ref: 00007FF72A9D8A6A
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8A7B
Part of subcall function 00007FF72A9D89B8: GetVersionExW.KERNEL32 ref: 00007FF72A9D8AE1
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8B3B
Part of subcall function 00007FF72A9D89B8: #620.MFC42U ref: 00007FF72A9D8B4C

#1040.MFC42U ref: 00007FF72A9D4C07

Strings

msinfo_startup_programs.htm, xrefs: 00007FF72A9D4B8F
SWEnvStartupPrograms, xrefs: 00007FF72A9D4BE6

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624$#1040#620#626Version
String ID: SWEnvStartupPrograms$msinfo_startup_programs.htm
API String ID: 3113763436-3266466983
Opcode ID: 0836f0b25c56526b097b5e947ac3022a8ac3ecf7919f3d8138a8687af1bc3a8d
Instruction ID: 36bc6d5d0683c63ce65c5dc6d35b47f1732b49451747b1913dbb0b6d97e5c986
Opcode Fuzzy Hash: 0836f0b25c56526b097b5e947ac3022a8ac3ecf7919f3d8138a8687af1bc3a8d
Instruction Fuzzy Hash: B8112A35918B8692F710EB21EC442A5B3A4FB95324FD002B2D6ADC27A0EF3CD55ACF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D3390, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D33AA

Part of subcall function 00007FF72A9D89B8: #626.MFC42U ref: 00007FF72A9D8A6A
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8A7B
Part of subcall function 00007FF72A9D89B8: GetVersionExW.KERNEL32 ref: 00007FF72A9D8AE1
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8B3B
Part of subcall function 00007FF72A9D89B8: #620.MFC42U ref: 00007FF72A9D8B4C

#1040.MFC42U ref: 00007FF72A9D3417

Strings

ResourcesIO, xrefs: 00007FF72A9D33F6
msinfo_IO.htm, xrefs: 00007FF72A9D339F

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624$#1040#620#626Version
String ID: ResourcesIO$msinfo_IO.htm
API String ID: 3113763436-550436458
Opcode ID: 0861dad27ec1fde6012628cdbcba9d9160c0fb9e3df3242984982d4262a8df44
Instruction ID: c25df4c05ada53b8611781b8a11f7e2e441856458bd923915bb4dc53779a16e1
Opcode Fuzzy Hash: 0861dad27ec1fde6012628cdbcba9d9160c0fb9e3df3242984982d4262a8df44
Instruction Fuzzy Hash: 3E111821A19B4791F710AB21EC842A5B3A4FB94360FD04272D69DC27A4DF3CD19ACB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D4CC0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D4CDA

Part of subcall function 00007FF72A9D89B8: #626.MFC42U ref: 00007FF72A9D8A6A
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8A7B
Part of subcall function 00007FF72A9D89B8: GetVersionExW.KERNEL32 ref: 00007FF72A9D8AE1
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8B3B
Part of subcall function 00007FF72A9D89B8: #620.MFC42U ref: 00007FF72A9D8B4C

#1040.MFC42U ref: 00007FF72A9D4D44

Strings

msinfo_error_reporting.htm, xrefs: 00007FF72A9D4CCF
SWEnvWindowsError, xrefs: 00007FF72A9D4D23

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624$#1040#620#626Version
String ID: SWEnvWindowsError$msinfo_error_reporting.htm
API String ID: 3113763436-108011508
Opcode ID: 862593c6ff24416c104062b79b4b47eba28d1a637c8c8971fb95c881e502b124
Instruction ID: b89ccb6d3074e80841bc3566ada5b233ad01c1f8ff1abef98ee174e5c10e19dd
Opcode Fuzzy Hash: 862593c6ff24416c104062b79b4b47eba28d1a637c8c8971fb95c881e502b124
Instruction Fuzzy Hash: 43111C21918A4791F710AB15EC442A5B3A4FB95325FD04272D19DC26A0EF3CD55ACF60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D3CC0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D3CDA

Part of subcall function 00007FF72A9D89B8: #626.MFC42U ref: 00007FF72A9D8A6A
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8A7B
Part of subcall function 00007FF72A9D89B8: GetVersionExW.KERNEL32 ref: 00007FF72A9D8AE1
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8B3B
Part of subcall function 00007FF72A9D89B8: #620.MFC42U ref: 00007FF72A9D8B4C

#1040.MFC42U ref: 00007FF72A9D3D39

Strings

ComponentsNetwork, xrefs: 00007FF72A9D3D18
msinfo_network.htm, xrefs: 00007FF72A9D3CCF

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624$#1040#620#626Version
String ID: ComponentsNetwork$msinfo_network.htm
API String ID: 3113763436-50747263
Opcode ID: 6a9ed87b657d58bfae387b5f6c7c2c6dfa7c3e3250814daa93a67d3b64c6878f
Instruction ID: 07ccaa9e444c3ce9a35fd0e4efedcc41930070f26ab5e25c914dc58b7c2acc70
Opcode Fuzzy Hash: 6a9ed87b657d58bfae387b5f6c7c2c6dfa7c3e3250814daa93a67d3b64c6878f
Instruction Fuzzy Hash: B9015E31A09B4691EB10AB25EC841AAB364FB98350FD04376D2EDC27A0DF3CD55ACF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D34D0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D34EA

Part of subcall function 00007FF72A9D89B8: #626.MFC42U ref: 00007FF72A9D8A6A
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8A7B
Part of subcall function 00007FF72A9D89B8: GetVersionExW.KERNEL32 ref: 00007FF72A9D8AE1
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8B3B
Part of subcall function 00007FF72A9D89B8: #620.MFC42U ref: 00007FF72A9D8B4C

#1040.MFC42U ref: 00007FF72A9D3557

Strings

ResourcesMemory, xrefs: 00007FF72A9D3536
msinfo_memory.htm, xrefs: 00007FF72A9D34DF

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624$#1040#620#626Version
String ID: ResourcesMemory$msinfo_memory.htm
API String ID: 3113763436-2488161103
Opcode ID: 7e23dfe0a6e67920c72c2d3a44fb74613aa51048d870be2eb3b21b1fa193af7d
Instruction ID: 4a896afa8ba598555ef6543876e13d788cbc2caf5dc5d0eb74e16667f966ec92
Opcode Fuzzy Hash: 7e23dfe0a6e67920c72c2d3a44fb74613aa51048d870be2eb3b21b1fa193af7d
Instruction Fuzzy Hash: BC111C21919F4791F710AB21EC842A5B3A4FB94360FD04272D2DDC27A4DF3CD15ACB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D44B0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D44CA

Part of subcall function 00007FF72A9D89B8: #626.MFC42U ref: 00007FF72A9D8A6A
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8A7B
Part of subcall function 00007FF72A9D89B8: GetVersionExW.KERNEL32 ref: 00007FF72A9D8AE1
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8B3B
Part of subcall function 00007FF72A9D89B8: #620.MFC42U ref: 00007FF72A9D8B4C

#1040.MFC42U ref: 00007FF72A9D4534

Strings

ComponentsProblemDevices, xrefs: 00007FF72A9D4513
msinfo_problem_devices.htm, xrefs: 00007FF72A9D44BF

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624$#1040#620#626Version
String ID: ComponentsProblemDevices$msinfo_problem_devices.htm
API String ID: 3113763436-156978419
Opcode ID: b8eb41a53dd32943dcbd93fa9c81f0c3c8722a4777f7bf32a8b2bad60a90127b
Instruction ID: ed9116020c4ce57d5d1d4d8c21a575ae4abf69a3deea26ca09b92ebd6714f004
Opcode Fuzzy Hash: b8eb41a53dd32943dcbd93fa9c81f0c3c8722a4777f7bf32a8b2bad60a90127b
Instruction Fuzzy Hash: F8115A21919A4792F710EB25EC442A9B3A4FB95364FD00272D2DD823A0DF3CD24ACF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D3C20, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D3C3A

Part of subcall function 00007FF72A9D89B8: #626.MFC42U ref: 00007FF72A9D8A6A
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8A7B
Part of subcall function 00007FF72A9D89B8: GetVersionExW.KERNEL32 ref: 00007FF72A9D8AE1
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8B3B
Part of subcall function 00007FF72A9D89B8: #620.MFC42U ref: 00007FF72A9D8B4C

#1040.MFC42U ref: 00007FF72A9D3CA7

Strings

ComponentsModem, xrefs: 00007FF72A9D3C86
msinfo_modem.htm, xrefs: 00007FF72A9D3C2F

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624$#1040#620#626Version
String ID: ComponentsModem$msinfo_modem.htm
API String ID: 3113763436-3582759923
Opcode ID: a106257fe939a6f2ac399db8b43b8e1ff530bde3e585e1050b56b7b0005f233a
Instruction ID: fbfc2df0293475e41adcb3011611bf1078b32c26c0e21f29778cc674ae4e7fc1
Opcode Fuzzy Hash: a106257fe939a6f2ac399db8b43b8e1ff530bde3e585e1050b56b7b0005f233a
Instruction Fuzzy Hash: 4B112E21A19B8691F710EB21EC842A5B364FB95360FD00272D1DDC27A5DF3CD15ACF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D4C20, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D4C3A

Part of subcall function 00007FF72A9D89B8: #626.MFC42U ref: 00007FF72A9D8A6A
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8A7B
Part of subcall function 00007FF72A9D89B8: GetVersionExW.KERNEL32 ref: 00007FF72A9D8AE1
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8B3B
Part of subcall function 00007FF72A9D89B8: #620.MFC42U ref: 00007FF72A9D8B4C

#1040.MFC42U ref: 00007FF72A9D4CA4

Strings

SWEnvOLEReg, xrefs: 00007FF72A9D4C83
msinfo_ole_registration.htm, xrefs: 00007FF72A9D4C2F

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624$#1040#620#626Version
String ID: SWEnvOLEReg$msinfo_ole_registration.htm
API String ID: 3113763436-2639313784
Opcode ID: adf71395ea020c07b2db31ef12991fa6a8882e572f12ac4765ec73bc5093f83c
Instruction ID: 8b15d34b8b0b5f958c67edcf66e2fd47cb062497bed34bb5d7c158095f0bb610
Opcode Fuzzy Hash: adf71395ea020c07b2db31ef12991fa6a8882e572f12ac4765ec73bc5093f83c
Instruction Fuzzy Hash: 15114C25918A4791F710EB21EC442A5B3A4FB94320FD00272D29DC26A0EF3CD14ACF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D3430, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D344A

Part of subcall function 00007FF72A9D89B8: #626.MFC42U ref: 00007FF72A9D8A6A
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8A7B
Part of subcall function 00007FF72A9D89B8: GetVersionExW.KERNEL32 ref: 00007FF72A9D8AE1
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8B3B
Part of subcall function 00007FF72A9D89B8: #620.MFC42U ref: 00007FF72A9D8B4C

#1040.MFC42U ref: 00007FF72A9D34B7

Strings

ResourcesIRQs, xrefs: 00007FF72A9D3496
msinfo_irqs.htm, xrefs: 00007FF72A9D343F

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624$#1040#620#626Version
String ID: ResourcesIRQs$msinfo_irqs.htm
API String ID: 3113763436-2238440478
Opcode ID: 0d498ba34ba3493256d07d3803e2d73bb442ce36d486417bf4e00e3eac36341f
Instruction ID: 3cbc2dbc18b5fb9da6749de271a848e2a5c1d763a19e6c833b629055dbc68280
Opcode Fuzzy Hash: 0d498ba34ba3493256d07d3803e2d73bb442ce36d486417bf4e00e3eac36341f
Instruction Fuzzy Hash: 66111C21918A4795F710AB21EC442A9B3A4FB94360FD04272D69D827A4DF3CE19ACF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D49A0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D49BA

Part of subcall function 00007FF72A9D89B8: #626.MFC42U ref: 00007FF72A9D8A6A
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8A7B
Part of subcall function 00007FF72A9D89B8: GetVersionExW.KERNEL32 ref: 00007FF72A9D8AE1
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8B3B
Part of subcall function 00007FF72A9D89B8: #620.MFC42U ref: 00007FF72A9D8B4C

#1040.MFC42U ref: 00007FF72A9D4A24

Strings

msinfo_loaded_modules.htm, xrefs: 00007FF72A9D49AF
SWEnvLoadedModules, xrefs: 00007FF72A9D4A03

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624$#1040#620#626Version
String ID: SWEnvLoadedModules$msinfo_loaded_modules.htm
API String ID: 3113763436-3482029843
Opcode ID: 3f04942e790157bfa63685c2fbb6958b2a21824c2865233f420b2e532bf3ff83
Instruction ID: 44050149771171ca1f745705ac8b6502e2a307087ce4761766b6fa91403308d7
Opcode Fuzzy Hash: 3f04942e790157bfa63685c2fbb6958b2a21824c2865233f420b2e532bf3ff83
Instruction Fuzzy Hash: 37112E35A18A8792F710EB11EC442A5B3A4FB95321FD04272D19D827A5DF3CD55ACF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D39B0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D39CA

Part of subcall function 00007FF72A9D89B8: #626.MFC42U ref: 00007FF72A9D8A6A
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8A7B
Part of subcall function 00007FF72A9D89B8: GetVersionExW.KERNEL32 ref: 00007FF72A9D8AE1
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8B3B
Part of subcall function 00007FF72A9D89B8: #620.MFC42U ref: 00007FF72A9D8B4C

#1040.MFC42U ref: 00007FF72A9D3A37

Strings

msinfo_infrared.htm, xrefs: 00007FF72A9D39BF
ComponentsInfrared, xrefs: 00007FF72A9D3A16

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624$#1040#620#626Version
String ID: ComponentsInfrared$msinfo_infrared.htm
API String ID: 3113763436-1362278931
Opcode ID: 228eec9ae2b537ea8b46b7bd0788e9a8590874f2809ac0942506a7192b051313
Instruction ID: a3ae1ccaed2d382a04bc146cd61cd490a51e52ef4709a88d4f5bf6ecd5b93a01
Opcode Fuzzy Hash: 228eec9ae2b537ea8b46b7bd0788e9a8590874f2809ac0942506a7192b051313
Instruction Fuzzy Hash: F8112A21918B8691F710EB21EC842A9B364FB95360FD042B2D6EDC27A5DF3CD25ACF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D4AE0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D4AFA

Part of subcall function 00007FF72A9D89B8: #626.MFC42U ref: 00007FF72A9D8A6A
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8A7B
Part of subcall function 00007FF72A9D89B8: GetVersionExW.KERNEL32 ref: 00007FF72A9D8AE1
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8B3B
Part of subcall function 00007FF72A9D89B8: #620.MFC42U ref: 00007FF72A9D8B4C

#1040.MFC42U ref: 00007FF72A9D4B67

Strings

SWEnvProgramGroup, xrefs: 00007FF72A9D4B46
msinfo_program_groups.htm, xrefs: 00007FF72A9D4AEF

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624$#1040#620#626Version
String ID: SWEnvProgramGroup$msinfo_program_groups.htm
API String ID: 3113763436-2393388079
Opcode ID: 29ba5412607a4857f24da055d3d6f283ee2bca1fc0b595a4e98e685bcd6dd8e9
Instruction ID: e00a595f33c1b38c91f01761dde2f51028cec5ddceea2a45ec0451e9c45b9675
Opcode Fuzzy Hash: 29ba5412607a4857f24da055d3d6f283ee2bca1fc0b595a4e98e685bcd6dd8e9
Instruction Fuzzy Hash: A2112A35918B86A1F710EB21EC442A5B3A4FB95324FD042B2D69DC27A4DF3CD65ACF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D32F0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D330A

Part of subcall function 00007FF72A9D89B8: #626.MFC42U ref: 00007FF72A9D8A6A
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8A7B
Part of subcall function 00007FF72A9D89B8: GetVersionExW.KERNEL32 ref: 00007FF72A9D8AE1
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8B3B
Part of subcall function 00007FF72A9D89B8: #620.MFC42U ref: 00007FF72A9D8B4C

#1040.MFC42U ref: 00007FF72A9D3377

Strings

ResourcesForcedHardware, xrefs: 00007FF72A9D3356
msinfo_forced_hardware.htm, xrefs: 00007FF72A9D32FF

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624$#1040#620#626Version
String ID: ResourcesForcedHardware$msinfo_forced_hardware.htm
API String ID: 3113763436-2367175672
Opcode ID: 3eb2456dfff43e77ee33c84b2e4a9559ad164c581f2e18f507017376f91172a9
Instruction ID: fa9af750a534e7aa4c8b94fa15cf3ee0b821a7edc8e1ec19bf81ee8dd62dd64e
Opcode Fuzzy Hash: 3eb2456dfff43e77ee33c84b2e4a9559ad164c581f2e18f507017376f91172a9
Instruction Fuzzy Hash: E911E821A19E4791F710EB21EC842A5B3A4FB94360FD04272D69DC27A4DF3CE55ACFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D4A40, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D4A5A

Part of subcall function 00007FF72A9D89B8: #626.MFC42U ref: 00007FF72A9D8A6A
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8A7B
Part of subcall function 00007FF72A9D89B8: GetVersionExW.KERNEL32 ref: 00007FF72A9D8AE1
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8B3B
Part of subcall function 00007FF72A9D89B8: #620.MFC42U ref: 00007FF72A9D8B4C

#1040.MFC42U ref: 00007FF72A9D4ACA

Strings

SWEnvServices, xrefs: 00007FF72A9D4AA9
msinfo_services.htm, xrefs: 00007FF72A9D4A4F

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624$#1040#620#626Version
String ID: SWEnvServices$msinfo_services.htm
API String ID: 3113763436-1872070080
Opcode ID: 61e2bffd6ba053a971806f6b9746c7c775db589e80368ab42c9a878e23fc69b6
Instruction ID: 6acdc73b65aab50386214bf6a1749a2d0f0470dcab6ff1c7f2db94a0a29a21e3
Opcode Fuzzy Hash: 61e2bffd6ba053a971806f6b9746c7c775db589e80368ab42c9a878e23fc69b6
Instruction Fuzzy Hash: 9A112E31908A46A5F710EB21EC442A5B3A4FB94310FD04272D19DC27A1DF3CD55ACF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D3250, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D326A

Part of subcall function 00007FF72A9D89B8: #626.MFC42U ref: 00007FF72A9D8A6A
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8A7B
Part of subcall function 00007FF72A9D89B8: GetVersionExW.KERNEL32 ref: 00007FF72A9D8AE1
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8B3B
Part of subcall function 00007FF72A9D89B8: #620.MFC42U ref: 00007FF72A9D8B4C

#1040.MFC42U ref: 00007FF72A9D32D4

Strings

ResourcesDMA, xrefs: 00007FF72A9D32B3
msinfo_DMA.htm, xrefs: 00007FF72A9D325F

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624$#1040#620#626Version
String ID: ResourcesDMA$msinfo_DMA.htm
API String ID: 3113763436-1133483911
Opcode ID: f75bccb0c0d64445df67e3ed35481e5183a5fff5d139d73e177685a1b877242a
Instruction ID: 5db3b69ebfef5c3ab8a52c2605c27baef72075ce6db2549b2e8b4bcbbe1cba69
Opcode Fuzzy Hash: f75bccb0c0d64445df67e3ed35481e5183a5fff5d139d73e177685a1b877242a
Instruction Fuzzy Hash: F0110621A18A8791E710AB21EC842A5B364FB95360FD04276D29D826A4EF3CE15ACB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D3A50, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D3A6A

Part of subcall function 00007FF72A9D89B8: #626.MFC42U ref: 00007FF72A9D8A6A
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8A7B
Part of subcall function 00007FF72A9D89B8: GetVersionExW.KERNEL32 ref: 00007FF72A9D8AE1
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8B3B
Part of subcall function 00007FF72A9D89B8: #620.MFC42U ref: 00007FF72A9D8B4C

#1040.MFC42U ref: 00007FF72A9D3AC9

Strings

msinfo_input.htm, xrefs: 00007FF72A9D3A5F
ComponentsInput, xrefs: 00007FF72A9D3AA8

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624$#1040#620#626Version
String ID: ComponentsInput$msinfo_input.htm
API String ID: 3113763436-298820297
Opcode ID: f03886f49fe5304147e03f16a8007225ceaf62eaaaf9d3a47b06b2d3b9d9133c
Instruction ID: 347820103b9f834dd570307113f03344b533c297b94ff64d8b98264d8775b25a
Opcode Fuzzy Hash: f03886f49fe5304147e03f16a8007225ceaf62eaaaf9d3a47b06b2d3b9d9133c
Instruction Fuzzy Hash: 8B015B31A09B8691E710AB25EC805A9B3A4FB98350FD00376D2EDC27A4DF3CD559CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D47C0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D47DA

Part of subcall function 00007FF72A9D89B8: #626.MFC42U ref: 00007FF72A9D8A6A
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8A7B
Part of subcall function 00007FF72A9D89B8: GetVersionExW.KERNEL32 ref: 00007FF72A9D8AE1
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8B3B
Part of subcall function 00007FF72A9D89B8: #620.MFC42U ref: 00007FF72A9D8B4C

#1040.MFC42U ref: 00007FF72A9D4847

Strings

msinfo_print_jobs.htm, xrefs: 00007FF72A9D47CF
SWEnvPrint, xrefs: 00007FF72A9D4826

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624$#1040#620#626Version
String ID: SWEnvPrint$msinfo_print_jobs.htm
API String ID: 3113763436-2847348657
Opcode ID: b4b84413e238e01bc8540e4f66800899e6478fa0100bde19040d1dbdc824b50b
Instruction ID: a3d45c5cf1eb4ee817977c31affc3a3070ae2d31af430fc4147a71b9af791495
Opcode Fuzzy Hash: b4b84413e238e01bc8540e4f66800899e6478fa0100bde19040d1dbdc824b50b
Instruction Fuzzy Hash: ED112E31918B4691F710EB21EC442A9B364FB95760FD00272D59D827A4DF3CD69ACF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D37D0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D37EA

Part of subcall function 00007FF72A9D89B8: #626.MFC42U ref: 00007FF72A9D8A6A
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8A7B
Part of subcall function 00007FF72A9D89B8: GetVersionExW.KERNEL32 ref: 00007FF72A9D8AE1
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8B3B
Part of subcall function 00007FF72A9D89B8: #620.MFC42U ref: 00007FF72A9D8B4C

#1040.MFC42U ref: 00007FF72A9D3857

Strings

ComponentsMultimediaCDROM, xrefs: 00007FF72A9D3836
msinfo_cdrom.htm, xrefs: 00007FF72A9D37DF

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624$#1040#620#626Version
String ID: ComponentsMultimediaCDROM$msinfo_cdrom.htm
API String ID: 3113763436-455134030
Opcode ID: 0065a659c40bfcef65ded382d2d39e45896fee1f2b47d264f46b03379fb7d7f7
Instruction ID: 5c76d13bd631adc4b402655ed0c49ad413dbd407bfcbcaa8db5ca39df78d4b92
Opcode Fuzzy Hash: 0065a659c40bfcef65ded382d2d39e45896fee1f2b47d264f46b03379fb7d7f7
Instruction Fuzzy Hash: DE112E21919A4691F710EB11EC842A5B364FB94360FD00272D19DC27A5DF3CD19ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D4720, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D473A

Part of subcall function 00007FF72A9D89B8: #626.MFC42U ref: 00007FF72A9D8A6A
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8A7B
Part of subcall function 00007FF72A9D89B8: GetVersionExW.KERNEL32 ref: 00007FF72A9D8AE1
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8B3B
Part of subcall function 00007FF72A9D89B8: #620.MFC42U ref: 00007FF72A9D8B4C

#1040.MFC42U ref: 00007FF72A9D47A7

Strings

SWEnvEnvVars, xrefs: 00007FF72A9D4786
msinfo_environment_variables.htm, xrefs: 00007FF72A9D472F

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624$#1040#620#626Version
String ID: SWEnvEnvVars$msinfo_environment_variables.htm
API String ID: 3113763436-3888252899
Opcode ID: b5bbb0f4911a9e19839f8f60593fe3f48b95c5c9589851b7d6126d48f7703749
Instruction ID: 986ec715408814456481082938e6a6c44e9f4789fc213457e74cc03bc22c3d9b
Opcode Fuzzy Hash: b5bbb0f4911a9e19839f8f60593fe3f48b95c5c9589851b7d6126d48f7703749
Instruction Fuzzy Hash: 6C115A21918B8791F710EB21EC442A9B364FB94320FD002B2D29DC27A4EF3CD65ACF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D3F30, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D3F4A

Part of subcall function 00007FF72A9D89B8: #626.MFC42U ref: 00007FF72A9D8A6A
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8A7B
Part of subcall function 00007FF72A9D89B8: GetVersionExW.KERNEL32 ref: 00007FF72A9D8AE1
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8B3B
Part of subcall function 00007FF72A9D89B8: #620.MFC42U ref: 00007FF72A9D8B4C

#1040.MFC42U ref: 00007FF72A9D3FA9

Strings

ComponentsPorts, xrefs: 00007FF72A9D3F88
msinfo_ports.htm, xrefs: 00007FF72A9D3F3F

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624$#1040#620#626Version
String ID: ComponentsPorts$msinfo_ports.htm
API String ID: 3113763436-1470185294
Opcode ID: 52a9ac6a4016256717f7eebcb043f1350dbd52b08d0a935aa7fc74ba236fbf15
Instruction ID: 6c28e03e26f4876e4f17b793c2779867ca9f6e2dc247c3cb49b28e296a1a2f81
Opcode Fuzzy Hash: 52a9ac6a4016256717f7eebcb043f1350dbd52b08d0a935aa7fc74ba236fbf15
Instruction Fuzzy Hash: 3C015B31A08B8692E710AB21EC802A9B364FB94350FD00376D6EDC27A4DF3CD65ACF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D4900, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D491A

Part of subcall function 00007FF72A9D89B8: #626.MFC42U ref: 00007FF72A9D8A6A
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8A7B
Part of subcall function 00007FF72A9D89B8: GetVersionExW.KERNEL32 ref: 00007FF72A9D8AE1
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8B3B
Part of subcall function 00007FF72A9D89B8: #620.MFC42U ref: 00007FF72A9D8B4C

#1040.MFC42U ref: 00007FF72A9D4984

Strings

SWEnvRunningTasks, xrefs: 00007FF72A9D4963
msinfo_running_tasks.htm, xrefs: 00007FF72A9D490F

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624$#1040#620#626Version
String ID: SWEnvRunningTasks$msinfo_running_tasks.htm
API String ID: 3113763436-176160638
Opcode ID: 64b96f5c5519cd3688901e66b122a739b155f45c9eee8b9f5f20ab74d7713ad1
Instruction ID: ec752959d9173f9b1662b58d3f865de1925a7c541a541270c2a960ade1fee43b
Opcode Fuzzy Hash: 64b96f5c5519cd3688901e66b122a739b155f45c9eee8b9f5f20ab74d7713ad1
Instruction Fuzzy Hash: A9111835918A8791F710EB21EC452A5B3A4FBA9321FD00272D29D827A4EF3CD65ACF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D4100, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D411A

Part of subcall function 00007FF72A9D89B8: #626.MFC42U ref: 00007FF72A9D8A6A
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8A7B
Part of subcall function 00007FF72A9D89B8: GetVersionExW.KERNEL32 ref: 00007FF72A9D8AE1
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8B3B
Part of subcall function 00007FF72A9D89B8: #620.MFC42U ref: 00007FF72A9D8B4C

#1040.MFC42U ref: 00007FF72A9D4179

Strings

ComponentsStorage, xrefs: 00007FF72A9D4158
msinfo_storage.htm, xrefs: 00007FF72A9D410F

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624$#1040#620#626Version
String ID: ComponentsStorage$msinfo_storage.htm
API String ID: 3113763436-3252503190
Opcode ID: 9da5028f4c9af974510329e63a89004649700a16bb71153343d717afa6171b06
Instruction ID: e201147dce268776e429f06a2e268b085ed26cb73e1ac1518cc8eec56fab86f9
Opcode Fuzzy Hash: 9da5028f4c9af974510329e63a89004649700a16bb71153343d717afa6171b06
Instruction Fuzzy Hash: 62013C31A08B4692E710AB21EC401A9B364FB94360FD00276D69DC27A4DF3CD559CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D3910, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D392A

Part of subcall function 00007FF72A9D89B8: #626.MFC42U ref: 00007FF72A9D8A6A
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8A7B
Part of subcall function 00007FF72A9D89B8: GetVersionExW.KERNEL32 ref: 00007FF72A9D8AE1
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8B3B
Part of subcall function 00007FF72A9D89B8: #620.MFC42U ref: 00007FF72A9D8B4C

#1040.MFC42U ref: 00007FF72A9D3997

Strings

msinfo_display.htm, xrefs: 00007FF72A9D391F
ComponentsDisplay, xrefs: 00007FF72A9D3976

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624$#1040#620#626Version
String ID: ComponentsDisplay$msinfo_display.htm
API String ID: 3113763436-3360019791
Opcode ID: 3ee0c0a1f1bbf4be0973be05a6ad3b9807c65185039cf5ce5a383ce2da73c99c
Instruction ID: d47e64e5b8951822e71eff4ae35da509c3d8fea3cc3e6d8603e5418a97982a6c
Opcode Fuzzy Hash: 3ee0c0a1f1bbf4be0973be05a6ad3b9807c65185039cf5ce5a383ce2da73c99c
Instruction Fuzzy Hash: F4112A21919E8691F710EB21EC842A5B364FB98360FD002B2D2DDC27A5DF3CD55ACF60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D4860, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D487A

Part of subcall function 00007FF72A9D89B8: #626.MFC42U ref: 00007FF72A9D8A6A
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8A7B
Part of subcall function 00007FF72A9D89B8: GetVersionExW.KERNEL32 ref: 00007FF72A9D8AE1
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8B3B
Part of subcall function 00007FF72A9D89B8: #620.MFC42U ref: 00007FF72A9D8B4C

#1040.MFC42U ref: 00007FF72A9D48E7

Strings

SWEnvNetConn, xrefs: 00007FF72A9D48C6
msinfo_network_connections.htm, xrefs: 00007FF72A9D486F

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624$#1040#620#626Version
String ID: SWEnvNetConn$msinfo_network_connections.htm
API String ID: 3113763436-1406126755
Opcode ID: 65b881236c7dfb85f5b4313e1400ffbf0180960773f0b2816d9da1b518f99c40
Instruction ID: 9a088d5248765e54f89ddec09809a207cd3048fbcbb5222b4387cdaa242d2837
Opcode Fuzzy Hash: 65b881236c7dfb85f5b4313e1400ffbf0180960773f0b2816d9da1b518f99c40
Instruction Fuzzy Hash: D7111831918A8792FB10EB21EC442A5B364FB94360FD042B2D69E827A5DF3CD65ACF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D3870, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D388A

Part of subcall function 00007FF72A9D89B8: #626.MFC42U ref: 00007FF72A9D8A6A
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8A7B
Part of subcall function 00007FF72A9D89B8: GetVersionExW.KERNEL32 ref: 00007FF72A9D8AE1
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8B3B
Part of subcall function 00007FF72A9D89B8: #620.MFC42U ref: 00007FF72A9D8B4C

#1040.MFC42U ref: 00007FF72A9D38F7

Strings

ComponentsMultimediaSound, xrefs: 00007FF72A9D38D6
msinfo_sound_device.htm, xrefs: 00007FF72A9D387F

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624$#1040#620#626Version
String ID: ComponentsMultimediaSound$msinfo_sound_device.htm
API String ID: 3113763436-701293193
Opcode ID: 825c6d6178ff0e4750e4a21b7d0753d2a6efdc1cd1afd4d29dafb5e0f8d589f7
Instruction ID: bafc4c603263827c220fe3d9c215695fe8f975a4557456964732acb281764ac8
Opcode Fuzzy Hash: 825c6d6178ff0e4750e4a21b7d0753d2a6efdc1cd1afd4d29dafb5e0f8d589f7
Instruction Fuzzy Hash: F6112A21A19B8791F710EB21EC842A9B364FB94360FD00272D69DC27A5DF3CD55ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D45F0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D460A

Part of subcall function 00007FF72A9D89B8: #626.MFC42U ref: 00007FF72A9D8A6A
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8A7B
Part of subcall function 00007FF72A9D89B8: GetVersionExW.KERNEL32 ref: 00007FF72A9D8AE1
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8B3B
Part of subcall function 00007FF72A9D89B8: #620.MFC42U ref: 00007FF72A9D8B4C

#1040.MFC42U ref: 00007FF72A9D4669

Strings

msinfo_software_environment.htm, xrefs: 00007FF72A9D45FF
SWEnv, xrefs: 00007FF72A9D4648

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624$#1040#620#626Version
String ID: SWEnv$msinfo_software_environment.htm
API String ID: 3113763436-2561389742
Opcode ID: f6e6aeb1033a21f108614eb6c8f2a724860edbdd532e5cb8ea27a34d01a8267f
Instruction ID: 291847081fcda1e2f2e8f0cfae7bb0c35164c7dd91780609ff480c597f2a2854
Opcode Fuzzy Hash: f6e6aeb1033a21f108614eb6c8f2a724860edbdd532e5cb8ea27a34d01a8267f
Instruction Fuzzy Hash: 89015E31A08B8691E710AB25EC441A9B364FB94310FD00276D6DDC27A4DF3CD559CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D4550, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D456A

Part of subcall function 00007FF72A9D89B8: #626.MFC42U ref: 00007FF72A9D8A6A
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8A7B
Part of subcall function 00007FF72A9D89B8: GetVersionExW.KERNEL32 ref: 00007FF72A9D8AE1
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8B3B
Part of subcall function 00007FF72A9D89B8: #620.MFC42U ref: 00007FF72A9D8B4C

#1040.MFC42U ref: 00007FF72A9D45D4

Strings

ComponentsUSB, xrefs: 00007FF72A9D45B3
msinfo_usb.htm, xrefs: 00007FF72A9D455F

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624$#1040#620#626Version
String ID: ComponentsUSB$msinfo_usb.htm
API String ID: 3113763436-1728775757
Opcode ID: a09072fee41e32c7b395ccbdad269d9b1dd80c221aef5b1ca355e08dd48179b1
Instruction ID: 26f35e4c1e6960ad6eb8274b171cd584673ff2e344149fe930d76aca5aa19637
Opcode Fuzzy Hash: a09072fee41e32c7b395ccbdad269d9b1dd80c221aef5b1ca355e08dd48179b1
Instruction Fuzzy Hash: 29112A21A18A8792F710EB21EC442A5B3A4FB95365FD04272D6DD827A0DF3CD25ACF60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D31B0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D31CA

Part of subcall function 00007FF72A9D89B8: #626.MFC42U ref: 00007FF72A9D8A6A
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8A7B
Part of subcall function 00007FF72A9D89B8: GetVersionExW.KERNEL32 ref: 00007FF72A9D8AE1
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8B3B
Part of subcall function 00007FF72A9D89B8: #620.MFC42U ref: 00007FF72A9D8B4C

#1040.MFC42U ref: 00007FF72A9D3231

Strings

ResourcesConflicts, xrefs: 00007FF72A9D3210
msinfo_conflicts_sharing.htm, xrefs: 00007FF72A9D31BF

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624$#1040#620#626Version
String ID: ResourcesConflicts$msinfo_conflicts_sharing.htm
API String ID: 3113763436-2309445730
Opcode ID: 5ad61e626ab40f0a3576b6294db87e677f692516deda71fa30b00862e78c5b80
Instruction ID: dc4827c4372659ef7b94c23be80e41c3ad2d47c14ec636a7dd398a3a2e7067ef
Opcode Fuzzy Hash: 5ad61e626ab40f0a3576b6294db87e677f692516deda71fa30b00862e78c5b80
Instruction Fuzzy Hash: B8012A21918A8791F710EB21EC443A5B364FB94324FD04372D29DC26A4DF3CE59ACB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D3120, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D313A

Part of subcall function 00007FF72A9D89B8: #626.MFC42U ref: 00007FF72A9D8A6A
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8A7B
Part of subcall function 00007FF72A9D89B8: GetVersionExW.KERNEL32 ref: 00007FF72A9D8AE1
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8B3B
Part of subcall function 00007FF72A9D89B8: #620.MFC42U ref: 00007FF72A9D8B4C

#1040.MFC42U ref: 00007FF72A9D3192

Strings

Resources, xrefs: 00007FF72A9D3171
msinfo_hardware_resources.htm, xrefs: 00007FF72A9D312F

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624$#1040#620#626Version
String ID: Resources$msinfo_hardware_resources.htm
API String ID: 3113763436-62863284
Opcode ID: eb216d796de5aed7ac58d0a9aa0a1979fa9ad22feee7b70f1b2e90f2afb0c937
Instruction ID: fec8954a39e7e5906fe60b57bdd527ae9fa08ec838887ae0698032f33dde2b44
Opcode Fuzzy Hash: eb216d796de5aed7ac58d0a9aa0a1979fa9ad22feee7b70f1b2e90f2afb0c937
Instruction Fuzzy Hash: E1014031A08A8791E710AB25EC402A9B364FB99320FD00376D6DDC27A4DF3CD559CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D3090, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D30AA

Part of subcall function 00007FF72A9D89B8: #626.MFC42U ref: 00007FF72A9D8A6A
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8A7B
Part of subcall function 00007FF72A9D89B8: GetVersionExW.KERNEL32 ref: 00007FF72A9D8AE1
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8B3B
Part of subcall function 00007FF72A9D89B8: #620.MFC42U ref: 00007FF72A9D8B4C

#1040.MFC42U ref: 00007FF72A9D3106

Strings

msinfo_system_summary.htm, xrefs: 00007FF72A9D309F
SystemSummary, xrefs: 00007FF72A9D30E5

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624$#1040#620#626Version
String ID: SystemSummary$msinfo_system_summary.htm
API String ID: 3113763436-3146089175
Opcode ID: 4a6d512e551f66c607d7b2c2ec1656ed6dff6ce18ed952e9a853f8883cf7d122
Instruction ID: 96efd4fb4b751206184aedff10637e8ba58e2df179dba0731a7f6b463cb62618
Opcode Fuzzy Hash: 4a6d512e551f66c607d7b2c2ec1656ed6dff6ce18ed952e9a853f8883cf7d122
Instruction Fuzzy Hash: 68012171908A8792E710AB51EC401A9B364FB95310FD00276D6EDC27A4DF3CD55ACF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9EC064, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35commemoryCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32 ref: 00007FF72A9EC091
SysAllocString.OLEAUT32 ref: 00007FF72A9EC0A2
SysFreeString.OLEAUT32 ref: 00007FF72A9EC0C8

Strings

mshelp://windows/?id=6b1b15e7-6e2f-4c62-be2f-687038699173, xrefs: 00007FF72A9EC09B

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: String$AllocCreateFreeInstance
String ID: mshelp://windows/?id=6b1b15e7-6e2f-4c62-be2f-687038699173
API String ID: 391255401-3358082359
Opcode ID: 00c73806860af63220f31bda64ca4ba3c11688208ade90f69d819f22cf8d763d
Instruction ID: b72891bf2e86cda168225fa728c58e9fcd2f37d6fb11f3bbf9f09bba8a2b8a69
Opcode Fuzzy Hash: 00c73806860af63220f31bda64ca4ba3c11688208ade90f69d819f22cf8d763d
Instruction Fuzzy Hash: 9A011765A18A4681FF04AF12DC44668A364FF48F85F948071CE9DC3324DF7EE888CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D3600, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D361A

Part of subcall function 00007FF72A9D89B8: #626.MFC42U ref: 00007FF72A9D8A6A
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8A7B
Part of subcall function 00007FF72A9D89B8: GetVersionExW.KERNEL32 ref: 00007FF72A9D8AE1
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8B3B
Part of subcall function 00007FF72A9D89B8: #620.MFC42U ref: 00007FF72A9D8B4C

#1040.MFC42U ref: 00007FF72A9D3672

Strings

msinfo_multimedia.htm, xrefs: 00007FF72A9D360F
ComponentsMultimedia, xrefs: 00007FF72A9D3651

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624$#1040#620#626Version
String ID: ComponentsMultimedia$msinfo_multimedia.htm
API String ID: 3113763436-4202785823
Opcode ID: 8a030760a289f9a51bc6f6b08bb512ec231fa46ae6c19bd54189d006beffa947
Instruction ID: 10e94650a0dc09a9007f96d0d71bf6c158e21c51a1cd0afa15dcd37ba7e68c18
Opcode Fuzzy Hash: 8a030760a289f9a51bc6f6b08bb512ec231fa46ae6c19bd54189d006beffa947
Instruction Fuzzy Hash: 4B016D31A08A8791EB10AB21EC402A9B364FB98350FE00276D2DDC2BA4DF3CD55ACF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9ECBC0, Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00007FF72A9ECE53
RtlLookupFunctionEntry.NTDLL ref: 00007FF72A9ECE72
RtlVirtualUnwind.NTDLL ref: 00007FF72A9ECEBF
__raise_securityfailure.LIBCMT ref: 00007FF72A9ECFA4

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: 3066d1dffd7f24fac5fc7d1f61cb1d696d434a81e132593193d4840851d4eeb2
Instruction ID: 8748bd17a3be40bef235410af2bd5a8217fdaaf417a69a2128000c3e976b85c0
Opcode Fuzzy Hash: 3066d1dffd7f24fac5fc7d1f61cb1d696d434a81e132593193d4840851d4eeb2
Instruction Fuzzy Hash: 0541C235A09F46C1FB50AB29EC80766A3B4FF88744F9440B6DA8D82764DF7CE446CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9E7C28, Relevance: 6.1, APIs: 4, Instructions: 62librarywindowCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 00007FF72A9E7C4A
FormatMessageW.KERNEL32 ref: 00007FF72A9E7CB9
GetLastError.KERNEL32 ref: 00007FF72A9E7CC7
FreeLibrary.KERNEL32 ref: 00007FF72A9E7CE3

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: Library$ErrorFormatFreeLastLoadMessage
String ID:
API String ID: 129117173-0
Opcode ID: 12c4f9b46c768389b4baec00242633484e12bff96f0fffe952a673f74617e4f6
Instruction ID: cb85dc7391c42fd324cce39611f74bade251ef9d6af224cf8277396fbee2e966
Opcode Fuzzy Hash: 12c4f9b46c768389b4baec00242633484e12bff96f0fffe952a673f74617e4f6
Instruction Fuzzy Hash: 7F117B62709B8685FB605B27AE84379F2D5EB45BD0F904234DF8DC3744DE2DC8498B50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D1CD0, Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D1CF2
#624.MFC42U ref: 00007FF72A9D1D40
#624.MFC42U ref: 00007FF72A9D1D82
#624.MFC42U ref: 00007FF72A9D1DC1

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624
String ID:
API String ID: 2145510954-0
Opcode ID: 254919a226ae1e9cdf37a7bbffc4c9b3e2eef23f676f88256bd72861c08dc908
Instruction ID: ed4475b774e602ed4533508e5f0bf018ff9a9634afc8b273d1e8bc513f3a45de
Opcode Fuzzy Hash: 254919a226ae1e9cdf37a7bbffc4c9b3e2eef23f676f88256bd72861c08dc908
Instruction Fuzzy Hash: C231B47091868387F700BB25ED44B71BAB4FF15726FD146B5C4AC862A1DF7C609A8FA0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D27B0, Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D27D2
#624.MFC42U ref: 00007FF72A9D2820
#624.MFC42U ref: 00007FF72A9D2862
#624.MFC42U ref: 00007FF72A9D28A1

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624
String ID:
API String ID: 2145510954-0
Opcode ID: 1a72b3525e3b76376aed26e884e0abc7f1c56887f13b640b0478ef7013916668
Instruction ID: fc4d0f01e51581700d9616de2ad2a7815fc9d6d1ecd91e47a74f4fc2509c272c
Opcode Fuzzy Hash: 1a72b3525e3b76376aed26e884e0abc7f1c56887f13b640b0478ef7013916668
Instruction Fuzzy Hash: B231B17191864387F700BB26EC44BA4B7B1FF54326FD441B6C56C862A0DFBDA09A8F64

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D2F60, Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D2F82
#624.MFC42U ref: 00007FF72A9D2FD0
#624.MFC42U ref: 00007FF72A9D3012
#624.MFC42U ref: 00007FF72A9D3051

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624
String ID:
API String ID: 2145510954-0
Opcode ID: ee3b6e644379f1342910055a1797d177b50e51bd6fcb22dcd8e78cbdbbca93ac
Instruction ID: b7810de0ca1cf92979e6e69e77f767ac90407c80e38aa7f614c02c6183d66412
Opcode Fuzzy Hash: ee3b6e644379f1342910055a1797d177b50e51bd6fcb22dcd8e78cbdbbca93ac
Instruction Fuzzy Hash: DE31B1709186078AF700AB25EC48B75B7B4FF58325FD082B5C49C862B1CF7CA08A8F60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D1030, Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D1052
#624.MFC42U ref: 00007FF72A9D10A1
#624.MFC42U ref: 00007FF72A9D10E3
#624.MFC42U ref: 00007FF72A9D1122

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624
String ID:
API String ID: 2145510954-0
Opcode ID: c394a7ec867233c9dc22fe5ae9876baea94fc5ea9f0201750051c5450dd08b2f
Instruction ID: 6744dd1142df002a2f7888ccc73b5e41ea5fd4d00577f363601bd27e38d27278
Opcode Fuzzy Hash: c394a7ec867233c9dc22fe5ae9876baea94fc5ea9f0201750051c5450dd08b2f
Instruction Fuzzy Hash: 3F319D71D18A4287F740AF25EC44B65B7B0FF54326FD141B6C59C962A0CF7CA19A8F60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D2060, Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D2082
#624.MFC42U ref: 00007FF72A9D20D0
#624.MFC42U ref: 00007FF72A9D2112
#624.MFC42U ref: 00007FF72A9D2151

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624
String ID:
API String ID: 2145510954-0
Opcode ID: 860b2001dc450a6bec1acfc97b6c045688cd48a42ba68c84d9f274b1bdfcd398
Instruction ID: 56c8633d15746d2578be6cdb98f93cb5de7fcbbb525ecf3798d8d6303f518fb2
Opcode Fuzzy Hash: 860b2001dc450a6bec1acfc97b6c045688cd48a42ba68c84d9f274b1bdfcd398
Instruction Fuzzy Hash: 0531A07191964387F700EB26EC44B71B6B0FF543A5FD082B5C19C862A1CF7EA19A8F60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9ECFB4, Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00007FF72A9ECFBF
RtlLookupFunctionEntry.NTDLL ref: 00007FF72A9ECFDE
RtlVirtualUnwind.NTDLL ref: 00007FF72A9ED02B
__raise_securityfailure.LIBCMT ref: 00007FF72A9ED0A1

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: a57100d6c42a6ad0fc84cf7e060fc3e74a60087a4fb35fd1dc2ffb123496b559
Instruction ID: 3a50df5bb077b31ef47a3b84260601de679b280d4a3b57bea331a54db960aae2
Opcode Fuzzy Hash: a57100d6c42a6ad0fc84cf7e060fc3e74a60087a4fb35fd1dc2ffb123496b559
Instruction Fuzzy Hash: 8721AE76909F46C1F740AB15EC80769A7B4FB88B44F9000B6DA8D82764DFBDE446CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9E03AC, Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

#626.MFC42U ref: 00007FF72A9E03C8
#3581.MFC42U ref: 00007FF72A9E03FE
#5916.MFC42U ref: 00007FF72A9E042C
#1040.MFC42U ref: 00007FF72A9E0438

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040#3581#5916#626
String ID:
API String ID: 2616423498-0
Opcode ID: a9272e0ca404ddbf2319a4e056fc80bb9b3dacf82efd32497685948f663bf87a
Instruction ID: a239601213cffaa61d386a6edd3082730818f91e7d39412340328bfd95bf6b13
Opcode Fuzzy Hash: a9272e0ca404ddbf2319a4e056fc80bb9b3dacf82efd32497685948f663bf87a
Instruction Fuzzy Hash: C5113332608A8682EB109F55E944369F370FB85B64FA44232DB9D866A8DF7DC489CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9EC4A4, Relevance: 6.0, APIs: 4, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

HeapSetInformation.KERNEL32 ref: 00007FF72A9EC4C0
RegisterApplicationRestart.KERNEL32 ref: 00007FF72A9EC4D1
CoInitialize.OLE32 ref: 00007FF72A9EC4D9
CoInitializeSecurity.OLE32 ref: 00007FF72A9EC50A

Part of subcall function 00007FF72A9EC2C0: GetCommandLineW.KERNEL32 ref: 00007FF72A9EC2DF
Part of subcall function 00007FF72A9EC2C0: CommandLineToArgvW.SHELL32 ref: 00007FF72A9EC2ED
Part of subcall function 00007FF72A9EC2C0: _wcsicmp.MSVCRT ref: 00007FF72A9EC345
Part of subcall function 00007FF72A9EC2C0: _wcsicmp.MSVCRT ref: 00007FF72A9EC35D
Part of subcall function 00007FF72A9EC2C0: _wcsicmp.MSVCRT ref: 00007FF72A9EC381
Part of subcall function 00007FF72A9EC2C0: #1126.MFC42U ref: 00007FF72A9EC39D
Part of subcall function 00007FF72A9EC2C0: WinSqmAddToStream.NTDLL ref: 00007FF72A9EC486

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: _wcsicmp$CommandInitializeLine$#1126ApplicationArgvHeapInformationRegisterRestartSecurityStream
String ID:
API String ID: 3643453623-0
Opcode ID: 99c90c9b097eeb0030bb57af5fc77ad1b1fc86381537ead9e1d2cda0e85d3ced
Instruction ID: 7272e4e5d0774141a117a0e56c31a156b4f9215b4a15673b0107b1ba858289ac
Opcode Fuzzy Hash: 99c90c9b097eeb0030bb57af5fc77ad1b1fc86381537ead9e1d2cda0e85d3ced
Instruction Fuzzy Hash: 0601C432A0C68283F7646F72A94162AF2A1FF54750F94417AD6CA81D55CF3DE0048E50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D5DA0, Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

#1122.MFC42U ref: 00007FF72A9D5DD2
LoadStringW.USER32 ref: 00007FF72A9D5DFD
#1126.MFC42U ref: 00007FF72A9D5E0B
#1122.MFC42U ref: 00007FF72A9D5E1B

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1122$#1126LoadString
String ID:
API String ID: 2301458288-0
Opcode ID: 88da898d41a93c60faf00df7a8699412c14678ec5eee613404acd904b5c42ced
Instruction ID: c54b312c676d713faf8d173bb1db014cd709dab535f83f071065327845a5b8b6
Opcode Fuzzy Hash: 88da898d41a93c60faf00df7a8699412c14678ec5eee613404acd904b5c42ced
Instruction Fuzzy Hash: E5018461B04A4642FB10AB17E8547B9A360FF44BD5F944071CE8D87654DF2CD58ACF60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9EADA4, Relevance: 6.0, APIs: 4, Instructions: 37windowCOMMON

Download Yara Rule

APIs

SetFocus.USER32 ref: 00007FF72A9EADD2

Part of subcall function 00007FF72A9E7108: #1463.MFC42U ref: 00007FF72A9E712F
Part of subcall function 00007FF72A9E7108: ShowWindow.USER32 ref: 00007FF72A9E714D
Part of subcall function 00007FF72A9E7108: ShowWindow.USER32 ref: 00007FF72A9E7169
Part of subcall function 00007FF72A9E7108: ShowWindow.USER32 ref: 00007FF72A9E7183
Part of subcall function 00007FF72A9E7108: ShowWindow.USER32 ref: 00007FF72A9E719F
Part of subcall function 00007FF72A9E7108: EnableWindow.USER32 ref: 00007FF72A9E71B7
Part of subcall function 00007FF72A9E7108: EnableWindow.USER32 ref: 00007FF72A9E71DB
Part of subcall function 00007FF72A9E7108: EnableWindow.USER32 ref: 00007FF72A9E7208
Part of subcall function 00007FF72A9E7108: EnableWindow.USER32 ref: 00007FF72A9E7235
Part of subcall function 00007FF72A9E7108: EnableWindow.USER32 ref: 00007FF72A9E724D
Part of subcall function 00007FF72A9E7108: EnableWindow.USER32 ref: 00007FF72A9E7265
Part of subcall function 00007FF72A9E7108: EnableWindow.USER32 ref: 00007FF72A9E727D
Part of subcall function 00007FF72A9E7108: EnableWindow.USER32 ref: 00007FF72A9E7296

LoadCursorW.USER32 ref: 00007FF72A9EAE08
SetCursor.USER32 ref: 00007FF72A9EAE11
SetCursor.USER32 ref: 00007FF72A9EAE2D

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Enable$Show$Cursor$#1463FocusLoad
String ID:
API String ID: 595207899-0
Opcode ID: 08b46f0fbe849562f668e7d18b34444fe815dc6282fbcc4c287c9f8eef05ae85
Instruction ID: a8d1169692ca568993bdbe60b5d3ac9e80185fb83fc0043a2e73d75e79ead4ba
Opcode Fuzzy Hash: 08b46f0fbe849562f668e7d18b34444fe815dc6282fbcc4c287c9f8eef05ae85
Instruction Fuzzy Hash: A9015B22A0964382FB04AB27E948738A360FB44F85F544076CE5E87761CF7DD49A8B50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D8560, Relevance: 6.0, APIs: 4, Instructions: 35COMMON

Download Yara Rule

APIs

#626.MFC42U ref: 00007FF72A9D8585
#620.MFC42U ref: 00007FF72A9D85B0
#624.MFC42U ref: 00007FF72A9D85BF
#1040.MFC42U ref: 00007FF72A9D85CB

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040#620#624#626
String ID:
API String ID: 1857537095-0
Opcode ID: adf8a04659eef57cc2cf001faca46879efbca4dbd04014f1947c01821ac442f1
Instruction ID: ac79865c8ffa1233600592756817bdc440fae38584836a46ba580bbfc317d015
Opcode Fuzzy Hash: adf8a04659eef57cc2cf001faca46879efbca4dbd04014f1947c01821ac442f1
Instruction Fuzzy Hash: A1011E25608B4281FB00AB17EC44069F720FB85FE0B9542B2DBAD837A4DF3CD985CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9DF0C4, Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

#626.MFC42U ref: 00007FF72A9DF0E3
#4473.MFC42U ref: 00007FF72A9DF0F4
wcstod.MSVCRT ref: 00007FF72A9DF101
#1040.MFC42U ref: 00007FF72A9DF122

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040#4473#626wcstod
String ID:
API String ID: 318727230-0
Opcode ID: 77dcaf26f3dafe2b594089a5ffbd938f9428744acbed0577c5b1f24e86c42ee0
Instruction ID: 0ed35d0cdea6cb49b16be8ab1ae460e7adc2d2819ca1b80b3503fb21c6a04757
Opcode Fuzzy Hash: 77dcaf26f3dafe2b594089a5ffbd938f9428744acbed0577c5b1f24e86c42ee0
Instruction Fuzzy Hash: 4AF04431614A4182E701DB25E945019F374FBD5BE4BA04331D7AD83AE5DF38D969CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9DF254, Relevance: 6.0, APIs: 4, Instructions: 24COMMON

Download Yara Rule

APIs

#626.MFC42U ref: 00007FF72A9DF26B
#4473.MFC42U ref: 00007FF72A9DF27C
GetTextExtentPoint32W.GDI32 ref: 00007FF72A9DF298
#1040.MFC42U ref: 00007FF72A9DF2AC

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #1040#4473#626ExtentPoint32Text
String ID:
API String ID: 3361750380-0
Opcode ID: 9c776478ba1355e86917ccfdbe2ebd23cd9609fd14ae40fe8c2ab889f0c849a2
Instruction ID: 5eaa3769e5d878a9646135802d416b5f8b55311c28f332411d224ad02868f00a
Opcode Fuzzy Hash: 9c776478ba1355e86917ccfdbe2ebd23cd9609fd14ae40fe8c2ab889f0c849a2
Instruction Fuzzy Hash: 43F0D066618A4282EB10DB16E844069B330F789B71BA40621DFBD83AE4CF3DD999CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D7140, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

swprintf_s.MSVCRT ref: 00007FF72A9D7204
free.MSVCRT ref: 00007FF72A9D721A

Strings

SELECT %s FROM %s, xrefs: 00007FF72A9D71F7

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: freeswprintf_s
String ID: SELECT %s FROM %s
API String ID: 3853837082-573136908
Opcode ID: 9cdc780d141846cab76276428ddfbd340aacf43f7403a1fd24c97c0a59318ca6
Instruction ID: a10027fad3e41e6994134f1c2d51b828bf89e3c65034fe893c0a042dab6a84e1
Opcode Fuzzy Hash: 9cdc780d141846cab76276428ddfbd340aacf43f7403a1fd24c97c0a59318ca6
Instruction Fuzzy Hash: C921B115B09B46D1FB10BF06E944128E3A0EB44BE0B844675DEAD877E0EE3DE4D2C650

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D3B80, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D3B9A

Part of subcall function 00007FF72A9D89B8: #626.MFC42U ref: 00007FF72A9D8A6A
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8A7B
Part of subcall function 00007FF72A9D89B8: GetVersionExW.KERNEL32 ref: 00007FF72A9D8AE1
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8B3B
Part of subcall function 00007FF72A9D89B8: #620.MFC42U ref: 00007FF72A9D8B4C

#1040.MFC42U ref: 00007FF72A9D3C07

Strings

ComponentsPointDev, xrefs: 00007FF72A9D3BE6

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624$#1040#620#626Version
String ID: ComponentsPointDev
API String ID: 3113763436-228623179
Opcode ID: a160a665d706685b6621f2f6ab1c4493364725f999bc12440c90da852262272c
Instruction ID: 4f2a05d0e87ea1e44357785c4689a95a23c984c406cd33a5ffad485e1bfba95f
Opcode Fuzzy Hash: a160a665d706685b6621f2f6ab1c4493364725f999bc12440c90da852262272c
Instruction Fuzzy Hash: 82111C21918A4791F710EB21EC442A5B364FB95320FD00272D69DC27A5DF3CD15ACB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D4370, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D438A

Part of subcall function 00007FF72A9D89B8: #626.MFC42U ref: 00007FF72A9D8A6A
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8A7B
Part of subcall function 00007FF72A9D89B8: GetVersionExW.KERNEL32 ref: 00007FF72A9D8AE1
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8B3B
Part of subcall function 00007FF72A9D89B8: #620.MFC42U ref: 00007FF72A9D8B4C

#1040.MFC42U ref: 00007FF72A9D43F7

Strings

ComponentsStorageIDE, xrefs: 00007FF72A9D43D6

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624$#1040#620#626Version
String ID: ComponentsStorageIDE
API String ID: 3113763436-3988297942
Opcode ID: 5a9056e00b5b3cfcf47e0c04dffcba9f5d465bdd8f36e6be6dec655970a8f559
Instruction ID: 63ee6ab5f59171da14e5712de863c34dde61f982564c14cd68ddaf049b83b553
Opcode Fuzzy Hash: 5a9056e00b5b3cfcf47e0c04dffcba9f5d465bdd8f36e6be6dec655970a8f559
Instruction Fuzzy Hash: 6C112E31918A4691F710EB21EC442A5B364FB95320FD00272D6DDC27A0DF3CD29ACF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D4190, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D41AA

Part of subcall function 00007FF72A9D89B8: #626.MFC42U ref: 00007FF72A9D8A6A
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8A7B
Part of subcall function 00007FF72A9D89B8: GetVersionExW.KERNEL32 ref: 00007FF72A9D8AE1
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8B3B
Part of subcall function 00007FF72A9D89B8: #620.MFC42U ref: 00007FF72A9D8B4C

#1040.MFC42U ref: 00007FF72A9D420D

Strings

ComponentsStorageDrives, xrefs: 00007FF72A9D41EC

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624$#1040#620#626Version
String ID: ComponentsStorageDrives
API String ID: 3113763436-4085665321
Opcode ID: e250cfc265736034d7993de7afb3fb9c1adadd22ce4d4ed2e9e9e90b8e52f3c1
Instruction ID: 3ab5faae6a4afbcf4966758968aa7f04ac212bf7aa09c82cc88f280869fbcc87
Opcode Fuzzy Hash: e250cfc265736034d7993de7afb3fb9c1adadd22ce4d4ed2e9e9e90b8e52f3c1
Instruction Fuzzy Hash: EB010C31A18A4791EB10AB21EC441A9B364FB95310FD00276D6EDC27A4DF3CD599CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D42D0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D42EA

Part of subcall function 00007FF72A9D89B8: #626.MFC42U ref: 00007FF72A9D8A6A
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8A7B
Part of subcall function 00007FF72A9D89B8: GetVersionExW.KERNEL32 ref: 00007FF72A9D8AE1
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8B3B
Part of subcall function 00007FF72A9D89B8: #620.MFC42U ref: 00007FF72A9D8B4C

#1040.MFC42U ref: 00007FF72A9D4357

Strings

ComponentsStorageSCSI, xrefs: 00007FF72A9D4336

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624$#1040#620#626Version
String ID: ComponentsStorageSCSI
API String ID: 3113763436-2485964137
Opcode ID: 623b630496d79fc77daa9b4b7aecf5e4afc71553631ef71258af8c1d7f977a96
Instruction ID: 62de1f7d7912bf7dc9ec49ac62647323cf1f3195e48fd06ff390b1996d99e9b5
Opcode Fuzzy Hash: 623b630496d79fc77daa9b4b7aecf5e4afc71553631ef71258af8c1d7f977a96
Instruction Fuzzy Hash: 71112A31918A8692F710EB21EC442A5B3A4FBA5320FD04272D6DD827A5DF3CD29ACF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D4230, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D424A

Part of subcall function 00007FF72A9D89B8: #626.MFC42U ref: 00007FF72A9D8A6A
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8A7B
Part of subcall function 00007FF72A9D89B8: GetVersionExW.KERNEL32 ref: 00007FF72A9D8AE1
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8B3B
Part of subcall function 00007FF72A9D89B8: #620.MFC42U ref: 00007FF72A9D8B4C

#1040.MFC42U ref: 00007FF72A9D42B4

Strings

ComponentsStorageDisks, xrefs: 00007FF72A9D4293

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624$#1040#620#626Version
String ID: ComponentsStorageDisks
API String ID: 3113763436-2906930738
Opcode ID: 087971ffdc3de63055b462a4679359632f7a4490b0702b4d8b3c7ebc0cd2f388
Instruction ID: ef369869798e4d85ea0d4684a8ccbcea0088a0e0f745fec6bff9fe48c6aded8a
Opcode Fuzzy Hash: 087971ffdc3de63055b462a4679359632f7a4490b0702b4d8b3c7ebc0cd2f388
Instruction Fuzzy Hash: 14112A21919A4792F710EB21EC442A5B3A4FB95325FD04272D69D827B4EF3CD25ACF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D3730, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D374A

Part of subcall function 00007FF72A9D89B8: #626.MFC42U ref: 00007FF72A9D8A6A
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8A7B
Part of subcall function 00007FF72A9D89B8: GetVersionExW.KERNEL32 ref: 00007FF72A9D8AE1
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8B3B
Part of subcall function 00007FF72A9D89B8: #620.MFC42U ref: 00007FF72A9D8B4C

#1040.MFC42U ref: 00007FF72A9D37B7

Strings

ComponentsMultimediaVideo, xrefs: 00007FF72A9D3796

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624$#1040#620#626Version
String ID: ComponentsMultimediaVideo
API String ID: 3113763436-2029396614
Opcode ID: f96733d4ff72503fd00f0c242d0a1448de5b7e855c283300f7d95366025511de
Instruction ID: 4fac244280b3a66a0ffbbff6bbfa7e0f76c62cc5989752294fc9dec4acdadbf1
Opcode Fuzzy Hash: f96733d4ff72503fd00f0c242d0a1448de5b7e855c283300f7d95366025511de
Instruction Fuzzy Hash: 47111831918E4692F710EB21EC842A9B364FB99364FD04272D69D827A4DF3CD59ACB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D4060, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D407A

Part of subcall function 00007FF72A9D89B8: #626.MFC42U ref: 00007FF72A9D8A6A
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8A7B
Part of subcall function 00007FF72A9D89B8: GetVersionExW.KERNEL32 ref: 00007FF72A9D8AE1
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8B3B
Part of subcall function 00007FF72A9D89B8: #620.MFC42U ref: 00007FF72A9D8B4C

#1040.MFC42U ref: 00007FF72A9D40E7

Strings

ComponentsParallelPorts, xrefs: 00007FF72A9D40C6

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624$#1040#620#626Version
String ID: ComponentsParallelPorts
API String ID: 3113763436-4268547842
Opcode ID: 9148f9e0b0ebf6df43d110c8a05e5c3ab65043e6569ea5a19fcbe1a01c132cfd
Instruction ID: 926539d74551e16225a7c0695f73731247ec3fddb68fb59349f78ef9a250f543
Opcode Fuzzy Hash: 9148f9e0b0ebf6df43d110c8a05e5c3ab65043e6569ea5a19fcbe1a01c132cfd
Instruction Fuzzy Hash: B2112E21918A4691F710EB21EC442A5B364FB95360FD04272D5ADC27A1DF3CD19ACF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D3DF0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D3E0A

Part of subcall function 00007FF72A9D89B8: #626.MFC42U ref: 00007FF72A9D8A6A
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8A7B
Part of subcall function 00007FF72A9D89B8: GetVersionExW.KERNEL32 ref: 00007FF72A9D8AE1
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8B3B
Part of subcall function 00007FF72A9D89B8: #620.MFC42U ref: 00007FF72A9D8B4C

#1040.MFC42U ref: 00007FF72A9D3E77

Strings

ComponentsNetworkProtocol, xrefs: 00007FF72A9D3E56

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624$#1040#620#626Version
String ID: ComponentsNetworkProtocol
API String ID: 3113763436-3336986798
Opcode ID: 80d3ee83656b23ec8898850fd33f5a8012a1143da1095eaed4672929c21464bb
Instruction ID: c5237c4dfc3cc996e4df907f284d2e071e0efb8daaf8f12457ccf426067e116d
Opcode Fuzzy Hash: 80d3ee83656b23ec8898850fd33f5a8012a1143da1095eaed4672929c21464bb
Instruction Fuzzy Hash: 1B112A21A18B8691F710EB21EC842A9B364FB95360FD04272D6DDC27A1DF3CD29ACF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D3AE0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D3AFA

Part of subcall function 00007FF72A9D89B8: #626.MFC42U ref: 00007FF72A9D8A6A
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8A7B
Part of subcall function 00007FF72A9D89B8: GetVersionExW.KERNEL32 ref: 00007FF72A9D8AE1
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8B3B
Part of subcall function 00007FF72A9D89B8: #620.MFC42U ref: 00007FF72A9D8B4C

#1040.MFC42U ref: 00007FF72A9D3B61

Strings

ComponentsKeyboard, xrefs: 00007FF72A9D3B40

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624$#1040#620#626Version
String ID: ComponentsKeyboard
API String ID: 3113763436-25411497
Opcode ID: d0912b907b55c24f44819fc3025d99d61c01fb0ab1b75d9cdb1a21b4e84e3238
Instruction ID: bf25e5fcb3fa8812c242b113d0648c892f5606c052efff3b958f4c8efb8dd077
Opcode Fuzzy Hash: d0912b907b55c24f44819fc3025d99d61c01fb0ab1b75d9cdb1a21b4e84e3238
Instruction Fuzzy Hash: B8015E21918A8792F710EB21EC443A9B364FB95324FD04272D2DDC26A5DF3CD15ACF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D3FC0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D3FDA

Part of subcall function 00007FF72A9D89B8: #626.MFC42U ref: 00007FF72A9D8A6A
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8A7B
Part of subcall function 00007FF72A9D89B8: GetVersionExW.KERNEL32 ref: 00007FF72A9D8AE1
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8B3B
Part of subcall function 00007FF72A9D89B8: #620.MFC42U ref: 00007FF72A9D8B4C

#1040.MFC42U ref: 00007FF72A9D4041

Strings

ComponentsSerialPorts, xrefs: 00007FF72A9D4020

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624$#1040#620#626Version
String ID: ComponentsSerialPorts
API String ID: 3113763436-2693123000
Opcode ID: 25d102d459f005001a13f6804a24ab29bb481415f2597635077595f31e4ef9bb
Instruction ID: a4f202b39ea691a9cb544011e640679bce9ffa76dcbf72ec28d8efd687c4f460
Opcode Fuzzy Hash: 25d102d459f005001a13f6804a24ab29bb481415f2597635077595f31e4ef9bb
Instruction Fuzzy Hash: FC015E21918A8792F710EB21EC443A5B364FB95324FD04272D6EDC26A5DF3CD15ACF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72A9D3D50, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

#624.MFC42U ref: 00007FF72A9D3D6A

Part of subcall function 00007FF72A9D89B8: #626.MFC42U ref: 00007FF72A9D8A6A
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8A7B
Part of subcall function 00007FF72A9D89B8: GetVersionExW.KERNEL32 ref: 00007FF72A9D8AE1
Part of subcall function 00007FF72A9D89B8: #624.MFC42U ref: 00007FF72A9D8B3B
Part of subcall function 00007FF72A9D89B8: #620.MFC42U ref: 00007FF72A9D8B4C

#1040.MFC42U ref: 00007FF72A9D3DD1

Strings

ComponentsNetAdapter, xrefs: 00007FF72A9D3DB0

Memory Dump Source

Source File: 00000020.00000002.349082318.00007FF72A9D1000.00000020.00020000.sdmp, Offset: 00007FF72A9D0000, based on PE: true

Associated: 00000020.00000002.349068185.00007FF72A9D0000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349118402.00007FF72A9F1000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.349158849.00007FF72AA04000.00000008.00020000.sdmp Download File
Associated: 00000020.00000002.349172509.00007FF72AA05000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.349184462.00007FF72AA0B000.00000002.00020000.sdmp Download File

Similarity

API ID: #624$#1040#620#626Version
String ID: ComponentsNetAdapter
API String ID: 3113763436-2631029663
Opcode ID: 9928e52dea49ae3777f164f6605070c9b08c47a5f0a568bf2d030572fe7e6b85
Instruction ID: 0f08274d53c99667c1b33f871a6eb8a4d18877662d55f284ef5418f8d81eaf84
Opcode Fuzzy Hash: 9928e52dea49ae3777f164f6605070c9b08c47a5f0a568bf2d030572fe7e6b85
Instruction Fuzzy Hash: 6D013C21918A8796F710EB21EC843A5B364FB95724FD04272D2ADC26A1DF3CD59ACF60

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report 1ZDvfs8V0D

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Memory Dumps

Sigma Overview

Jbx Signature Overview

AV Detection:

Exploits:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior