Windows Analysis Report
IMqJSR2NIi

Overview

General Information

Sample Name: IMqJSR2NIi (renamed file extension from none to dll)
Analysis ID: 595302
MD5: 26c6fe63e7b7ddbbe73a97520ea5d93c
SHA1: 8787e8c20838eea270f4a1e11cf0da706ff610ad
SHA256: 9303d54f40b9c7f56d95a0aa39078f0878cab85d0b63e6f4b727749253013d8d
Tags: Dridexexe
Infos:

Detection

Dridex
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected Dridex unpacked file
Multi AV Scanner detection for submitted file
Benign windows process drops PE files
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Changes memory attributes in foreign processes to executable or writable
Machine Learning detection for sample
Queues an APC in another process (thread injection)
Sigma detected: Suspicious Call by Ordinal
Machine Learning detection for dropped file
Contains functionality to prevent local Windows debugging
Uses Atom Bombing / ProGate to inject into other processes
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query locales information (e.g. system language)
May sleep (evasive loops) to hinder dynamic analysis
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
PE file contains sections with non-standard names
Queries device information via Setup API
Queries the installation date of Windows
Detected potential crypto function
Found potential string decryption / allocating functions
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to call native functions
Contains functionality to communicate with device drivers
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to dynamically determine API calls
Found dropped PE file which has not been started or loaded
Uses the system / local time for branch decision (may execute only at specific dates)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Drops files with a non-matching file extension (content does not match file extension)
Sample file is different than original file name gathered from version info
Extensive use of GetProcAddress (often used to hide API calls)
PE file contains strange resources
Drops PE files
Tries to load missing DLLs
Found evasive API chain checking for process token information
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Binary contains a suspicious time stamp
Contains functionality to read device registry values (via SetupAPI)
PE file contains more sections than normal
Found large amount of non-executed APIs
Uses Microsoft's Enhanced Cryptographic Provider
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality for read data from the clipboard

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: IMqJSR2NIi.dll Virustotal: Detection: 68% Perma Link
Source: IMqJSR2NIi.dll Metadefender: Detection: 62% Perma Link
Source: IMqJSR2NIi.dll ReversingLabs: Detection: 85%
Antivirus / Scanner detection for submitted sample
Source: IMqJSR2NIi.dll Avira: detected
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\XNPtE2qti\VERSION.dll Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\f3fc\appwiz.cpl Avira: detection malicious, Label: TR/Crypt.XPACK.Gen7
Source: C:\Users\user\AppData\Local\p9w993CR\UxTheme.dll Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\TQg3bhA\ReAgent.dll Avira: detection malicious, Label: TR/Crypt.XPACK.Gen7
Source: C:\Users\user\AppData\Local\ED1MV6ND\NETPLWIZ.dll Avira: detection malicious, Label: TR/Crypt.XPACK.Gen7
Source: C:\Users\user\AppData\Local\jOnYG\MFPlat.DLL Avira: detection malicious, Label: TR/Crypt.XPACK.Gen7
Source: C:\Users\user\AppData\Local\OiZS\SLC.dll Avira: detection malicious, Label: TR/Crypt.XPACK.Gen7
Source: C:\Users\user\AppData\Local\ED1MV6ND\NETPLWIZ.dll Avira: detection malicious, Label: TR/Crypt.XPACK.Gen7
Source: C:\Users\user\AppData\Local\SxxDNr\XmlLite.dll Avira: detection malicious, Label: TR/Crypt.XPACK.Gen7
Source: C:\Users\user\AppData\Local\CdAVuX3\MFC42u.dll Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Machine Learning detection for sample
Source: IMqJSR2NIi.dll Joe Sandbox ML: detected
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\XNPtE2qti\VERSION.dll Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\f3fc\appwiz.cpl Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\p9w993CR\UxTheme.dll Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\TQg3bhA\ReAgent.dll Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\ED1MV6ND\NETPLWIZ.dll Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\jOnYG\MFPlat.DLL Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\OiZS\SLC.dll Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\ED1MV6ND\NETPLWIZ.dll Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\SxxDNr\XmlLite.dll Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\CdAVuX3\MFC42u.dll Joe Sandbox ML: detected
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443F9D90 CryptReleaseContext,CryptAcquireContextW,GetLastError,CryptAcquireContextW,GetLastError, 19_2_00007FF7443F9D90
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443E0D50 memset,CoInitialize,SysFreeString,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,SysStringByteLen,SysAllocStringByteLen,SysStringLen,towupper,SysStringLen,SysFreeString,SysAllocString,_time64,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,SysFreeString,SysAllocString,SysStringByteLen,GetProcessHeap,HeapAlloc,memcpy,CryptDecrypt,SysAllocStringByteLen,memset,memcpy,GetProcessHeap,HeapFree,PostMessageW,SysFreeString,SysFreeString,SysFreeString,SysFreeString,SysFreeString,SysFreeString,CoUninitialize, 19_2_00007FF7443E0D50
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443E1DB4 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CompareStringW,SysAllocString,SysAllocString,??_V@YAXPEAX@Z,CryptReleaseContext, 19_2_00007FF7443E1DB4
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443F9E94 memset,SysStringLen,SysStringLen,SysStringLen,memcpy,CryptEncrypt,GetLastError, 19_2_00007FF7443F9E94
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443FAE40 CryptGetUserKey,CryptExportKey,GetProcessHeap,HeapAlloc,CryptExportKey,CryptBinaryToStringW,GetProcessHeap,HeapAlloc,CryptBinaryToStringW,SysAllocString,CryptDestroyKey,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree, 19_2_00007FF7443FAE40
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF744406EDC CryptGenRandom, 19_2_00007FF744406EDC
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF744406F74 CryptAcquireContextW,time,srand,CryptGenRandom,CryptGenRandom,CryptGenRandom,CryptGenRandom,CryptGenRandom,CryptReleaseContext, 19_2_00007FF744406F74
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443E2808 memset,CoInitialize,CryptReleaseContext,SysFreeString,_wtoi,SysStringByteLen,SysFreeString,SysAllocStringByteLen,SysAllocStringByteLen,SysStringByteLen,GetProcessHeap,HeapAlloc,memcpy,CryptDecrypt,SysAllocStringByteLen,memset,memcpy,GetProcessHeap,HeapFree,SysFreeString,SysFreeString,SysFreeString,SysFreeString,SysFreeString,CoUninitialize, 19_2_00007FF7443E2808
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443FA024 SysStringLen,SysStringLen,CryptEncrypt,GetLastError,memset,memcpy,CryptEncrypt,GetLastError,??_V@YAXPEAX@Z, 19_2_00007FF7443FA024
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443FA8F4 CryptGetUserKey,CryptStringToBinaryW,GetProcessHeap,HeapAlloc,CryptStringToBinaryW,CryptImportKey,GetProcessHeap,HeapFree,CryptDestroyKey, 19_2_00007FF7443FA8F4
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443E21F4 memset,SysAllocString,CryptEncrypt,memcpy,??_V@YAXPEAX@Z,memset,memcpy,??_V@YAXPEAX@Z,memcpy,CryptEncrypt,SysAllocStringByteLen,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,SysStringByteLen,SysStringByteLen,SysAllocStringByteLen,memcpy,memcpy,SysFreeString,SysFreeString,SysFreeString,SysFreeString,SysFreeString, 19_2_00007FF7443E21F4
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443FA1C8 SysStringLen,SysStringLen,SysFreeString,SysAllocString,CryptDecrypt,SysAllocStringByteLen,memset,memcpy,free, 19_2_00007FF7443FA1C8
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443F9AB0 CryptDestroyHash,CryptDestroyKey,CryptReleaseContext,CryptDestroyHash,CryptDestroyKey,CryptReleaseContext, 19_2_00007FF7443F9AB0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443FAAC4 CryptStringToBinaryW,GetProcessHeap,HeapAlloc,CryptStringToBinaryW,CryptImportKey,CryptDestroyKey,CryptGenKey,CryptExportKey,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,CryptExportKey,CryptBinaryToStringW,GetProcessHeap,HeapAlloc,CryptBinaryToStringW,SysAllocString,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,CryptDestroyKey, 19_2_00007FF7443FAAC4
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443DBAC8 memset,#261,CreateFileW,GetLastError,GetLastError,GetFileSizeEx,GetProcessHeap,HeapAlloc,ReadFile,CryptBinaryToStringW,GetProcessHeap,HeapAlloc,CryptBinaryToStringW,GetProcessHeap,HeapAlloc,GetComputerNameW,GetProcessHeap,HeapAlloc,GetUserNameExW,GetUserNameW,SysAllocString,CloseHandle,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree, 19_2_00007FF7443DBAC8
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443F9B3C CryptReleaseContext,CryptAcquireContextW,GetLastError,CryptAcquireContextW,GetLastError, 19_2_00007FF7443F9B3C
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443F9BCC CryptDestroyHash,CryptDestroyKey,CryptCreateHash,SysStringByteLen,CryptHashData,CryptDeriveKey,GetLastError, 19_2_00007FF7443F9BCC
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443FA43C CryptGenRandom, 19_2_00007FF7443FA43C
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443FA508 memset,memcpy,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptDestroyHash,memcpy,CryptDestroyHash, 19_2_00007FF7443FA508
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443F9CA4 CryptDestroyHash,CryptDestroyKey,CryptCreateHash,SysStringByteLen,CryptHashData,CryptDeriveKey,CryptSetKeyParam,GetLastError, 19_2_00007FF7443F9CA4
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443E04C8 memset,memset,_time64,SysAllocString,SysFreeString,CryptEncrypt,memcpy,??_V@YAXPEAX@Z,memset,memcpy,??_V@YAXPEAX@Z,memcpy,CryptEncrypt,SysAllocStringByteLen,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,SysAllocString,SysFreeString,GetProcessHeap,HeapFree,SysFreeString,SysFreeString,SysFreeString,SysFreeString,SysFreeString, 19_2_00007FF7443E04C8
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21F43E0 CryptImportKey,CryptSetKeyParam,CryptSetKeyParam,CryptGetKeyParam,CryptEncrypt,CryptDecrypt,GetLastError,CryptDestroyKey,GetProcessHeap,HeapFree, 29_2_00007FF7F21F43E0
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21F84E4 CryptImportKey,GetLastError,CryptImportKey,CryptExportKey,GetProcessHeap,HeapAlloc,CryptExportKey,GetProcessHeap,HeapAlloc,memmove,GetProcessHeap,HeapFree,CryptDestroyKey,CryptDestroyKey,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,CryptReleaseContext, 29_2_00007FF7F21F84E4
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21FA198 CryptExportKey,GetLastError,GetProcessHeap,HeapAlloc,CryptExportKey,GetProcessHeap,HeapFree,CryptDestroyKey, 29_2_00007FF7F21FA198
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21F82F0 CryptGenKey,GetLastError,CryptDestroyKey,GetProcessHeap,HeapAlloc,CryptDestroyKey,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree, 29_2_00007FF7F21F82F0
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21F87EC UuidCreate,UuidToStringW,CryptAcquireContextW,GetLastError,GetProcessHeap,HeapFree,RpcStringFreeW, 29_2_00007FF7F21F87EC
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21FAC28 CryptGetUserKey,GetLastError,CryptDestroyKey, 29_2_00007FF7F21FAC28
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21F998C GetProcessHeap,HeapFree,CryptReleaseContext,GetProcessHeap,HeapFree, 29_2_00007FF7F21F998C
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21F9A24 CryptExportKey,GetLastError,GetProcessHeap,HeapAlloc,CryptExportKey,GetProcessHeap,HeapFree,CryptDestroyKey, 29_2_00007FF7F21F9A24
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21F4064 GetProcessHeap,HeapAlloc,memmove,CryptImportKey,GetLastError,CryptImportKey,GetLastError,CryptImportKey,GetLastError,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,CryptDestroyKey,CryptDestroyKey, 29_2_00007FF7F21F4064
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21FA0C4 CryptReleaseContext,CryptAcquireContextW,GetLastError,GetProcessHeap,HeapFree, 29_2_00007FF7F21FA0C4
Source: IMqJSR2NIi.dll Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Source: Binary string: MSRA.pdb source: msra.exe, 00000013.00000000.367253133.00007FF74440C000.00000002.00000001.01000000.0000000A.sdmp, msra.exe, 00000013.00000002.391229137.00007FF74440C000.00000002.00000001.01000000.0000000A.sdmp, msra.exe.5.dr
Source: Binary string: RecoveryDrive.pdbGCTL source: RecoveryDrive.exe, 0000001D.00000000.459453459.00007FF7F224C000.00000002.00000001.01000000.00000011.sdmp, RecoveryDrive.exe, 0000001D.00000002.483695697.00007FF7F224C000.00000002.00000001.01000000.00000011.sdmp, RecoveryDrive.exe.5.dr
Source: Binary string: msinfo32.pdb source: msinfo32.exe.5.dr
Source: Binary string: wscript.pdbGCTL source: wscript.exe, 00000028.00000000.584120682.00007FF775F85000.00000002.00000001.01000000.0000001A.sdmp, wscript.exe, 00000028.00000002.611169672.00007FF775F85000.00000002.00000001.01000000.0000001A.sdmp, wscript.exe.5.dr
Source: Binary string: MFPMP.pdb source: mfpmp.exe, 00000016.00000000.402543032.00007FF7243D7000.00000002.00000001.01000000.0000000C.sdmp, mfpmp.exe, 00000016.00000002.426009184.00007FF7243D7000.00000002.00000001.01000000.0000000C.sdmp, mfpmp.exe.5.dr
Source: Binary string: netplwiz.pdb source: Netplwiz.exe, 0000001A.00000000.430649778.00007FF6D63E4000.00000002.00000001.01000000.0000000F.sdmp, Netplwiz.exe, 0000001A.00000002.454430360.00007FF6D63E4000.00000002.00000001.01000000.0000000F.sdmp, Netplwiz.exe, 00000021.00000000.525832806.00007FF618294000.00000002.00000001.01000000.00000015.sdmp, Netplwiz.exe, 00000021.00000002.548659085.00007FF618294000.00000002.00000001.01000000.00000015.sdmp, Netplwiz.exe.5.dr, Netplwiz.exe0.5.dr
Source: Binary string: MusNotificationUx.pdb source: MusNotificationUx.exe, 00000025.00000000.554704894.00007FF7E997E000.00000002.00000001.01000000.00000017.sdmp, MusNotificationUx.exe, 00000025.00000002.579596179.00007FF7E997E000.00000002.00000001.01000000.00000017.sdmp, MusNotificationUx.exe.5.dr
Source: Binary string: netplwiz.pdbGCTL source: Netplwiz.exe, 0000001A.00000000.430649778.00007FF6D63E4000.00000002.00000001.01000000.0000000F.sdmp, Netplwiz.exe, 0000001A.00000002.454430360.00007FF6D63E4000.00000002.00000001.01000000.0000000F.sdmp, Netplwiz.exe, 00000021.00000000.525832806.00007FF618294000.00000002.00000001.01000000.00000015.sdmp, Netplwiz.exe, 00000021.00000002.548659085.00007FF618294000.00000002.00000001.01000000.00000015.sdmp, Netplwiz.exe.5.dr, Netplwiz.exe0.5.dr
Source: Binary string: OptionalFeatures.pdb source: OptionalFeatures.exe, 0000001F.00000000.489565264.00007FF7638D4000.00000002.00000001.01000000.00000013.sdmp, OptionalFeatures.exe, 0000001F.00000002.512402334.00007FF7638D4000.00000002.00000001.01000000.00000013.sdmp, OptionalFeatures.exe.5.dr
Source: Binary string: MusNotificationUx.pdbGCTL source: MusNotificationUx.exe, 00000025.00000000.554704894.00007FF7E997E000.00000002.00000001.01000000.00000017.sdmp, MusNotificationUx.exe, 00000025.00000002.579596179.00007FF7E997E000.00000002.00000001.01000000.00000017.sdmp, MusNotificationUx.exe.5.dr
Source: Binary string: MFPMP.pdbUGP source: mfpmp.exe, 00000016.00000000.402543032.00007FF7243D7000.00000002.00000001.01000000.0000000C.sdmp, mfpmp.exe, 00000016.00000002.426009184.00007FF7243D7000.00000002.00000001.01000000.0000000C.sdmp, mfpmp.exe.5.dr
Source: Binary string: wscript.pdb source: wscript.exe, 00000028.00000000.584120682.00007FF775F85000.00000002.00000001.01000000.0000001A.sdmp, wscript.exe, 00000028.00000002.611169672.00007FF775F85000.00000002.00000001.01000000.0000001A.sdmp, wscript.exe.5.dr
Source: Binary string: RecoveryDrive.pdb source: RecoveryDrive.exe, 0000001D.00000000.459453459.00007FF7F224C000.00000002.00000001.01000000.00000011.sdmp, RecoveryDrive.exe, 0000001D.00000002.483695697.00007FF7F224C000.00000002.00000001.01000000.00000011.sdmp, RecoveryDrive.exe.5.dr
Source: Binary string: DevicePairingWizard.pdb source: DevicePairingWizard.exe.5.dr
Source: Binary string: msinfo32.pdbGCTL source: msinfo32.exe.5.dr
Source: Binary string: OptionalFeatures.pdbGCTL source: OptionalFeatures.exe, 0000001F.00000000.489565264.00007FF7638D4000.00000002.00000001.01000000.00000013.sdmp, OptionalFeatures.exe, 0000001F.00000002.512402334.00007FF7638D4000.00000002.00000001.01000000.00000013.sdmp, OptionalFeatures.exe.5.dr
Source: Binary string: DevicePairingWizard.pdbGCTL source: DevicePairingWizard.exe.5.dr
Source: Binary string: MSRA.pdbGCTL source: msra.exe, 00000013.00000000.367253133.00007FF74440C000.00000002.00000001.01000000.0000000A.sdmp, msra.exe, 00000013.00000002.391229137.00007FF74440C000.00000002.00000001.01000000.0000000A.sdmp, msra.exe.5.dr
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24FED10 FindFirstFileExW, 0_2_00007FFFE24FED10
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443DE800 memset,FindFirstFileW,FindClose, 19_2_00007FF7443DE800
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9AED10 FindFirstFileExW, 19_2_00007FFFEF9AED10
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D2ED10 FindFirstFileExW, 22_2_00007FFFF6D2ED10
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F2205458 memset,memset,memset,memset,FindFirstFileW,CompareStringW,CompareStringW,memset,FindNextFileW,FindClose,CoTaskMemFree,GetProcessHeap,HeapFree, 29_2_00007FF7F2205458
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21D21CC GetProcessHeap,HeapFree,GetFileAttributesW,GetLastError,GetProcessHeap,HeapFree,_wcsicmp,GetProcessHeap,HeapFree,FindClose,FindFirstFileW,FindClose,GetLastError,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,FindNextFileW,memmove,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,FindClose,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree, 29_2_00007FF7F21D21CC
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21E6718 WIMCreateFile,GetLastError,FindClose,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,WIMCloseHandle,WIMCloseHandle,memset,WIMGetAttributes,GetLastError,memset,GetFullPathNameW,GetLastError,memset,FindFirstFileW,GetLastError,GetProcessHeap,HeapFree,WIMCreateFile,WIMCloseHandle,memset,WIMGetAttributes,FindNextFileW,GetLastError,GetLastError,GetLastError, 29_2_00007FF7F21E6718
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21E57FC memset,GetSystemWindowsDirectoryW,GetLastError,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetFileAttributesW,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetFileAttributesW,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetVolumeInformationW,memset,FindFirstFileW,GetLastError,CompareStringW,CompareStringW,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,FindNextFileW,GetLastError,GetLastError,GetProcessHeap,HeapFree,GetFileAttributesW,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetFileAttributesW,GetProcessHeap,HeapFree,FindClose,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree, 29_2_00007FF7F21E57FC
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F2200638 memset,SetLastError,SetLastError,HeapAlloc,GetLastError,FindFirstFileW,memset,memset,wcsrchr,SetLastError,CompareStringW,CompareStringW,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,memset,FindNextFileW,GetLastError,GetLastError,GetLastError,FindClose,GetLastError,RtlFreeHeap,GetLastError,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,SetLastError,SetLastError, 29_2_00007FF7F2200638
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21FE958 free,memset,FindFirstFileW,GetLastError,GetLastError,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,FindClose, 29_2_00007FF7F21FE958
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F220B964 memset,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,FindFirstFileW,GetLastError,GetLastError,_wcsicmp,_wcsicmp,GetLastError,GetCurrentThread,NtQueryInformationThread,FindNextFileW,GetLastError,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,FindClose,SetLastError, 29_2_00007FF7F220B964
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21E4E28 GetFileAttributesW,GetLastError,memset,FindFirstFileW,GetLastError,FindClose,GetProcessHeap,CompareStringW,CompareStringW,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,FindNextFileW,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,CreateFileW,GetLastError,CloseHandle,GetFileSizeEx,GetLastError,CloseHandle,CloseHandle,GetProcessHeap,HeapFree,CloseHandle,GetProcessHeap,CloseHandle,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree, 29_2_00007FF7F21E4E28
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FFFF0E1ED10 FindFirstFileExW, 29_2_00007FFFF0E1ED10
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21CB29C memset,GetSystemWindowsDirectoryW,GetLastError,memset,GetLogicalDriveStringsW,GetLastError,GetProcessHeap,HeapFree,memset,GetVolumeInformationW,LoadStringW,GetProcessHeap,HeapFree, 29_2_00007FF7F21CB29C
Contains functionality for read data from the clipboard
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443DA658 CreateStreamOnHGlobal,GetWindowTextW,OpenClipboard,EmptyClipboard,GetHGlobalFromStream,SetClipboardData,CloseClipboard,??_V@YAXPEAX@Z, 19_2_00007FF7443DA658

E-Banking Fraud
barindex
Yara detected Dridex unpacked file
Source: Yara match File source: 26.2.Netplwiz.exe.7ffff6cd0000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.2.RecoveryDrive.exe.7ffff0dc0000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 37.2.MusNotificationUx.exe.7fffe3390000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.2.Netplwiz.exe.7ffff6cd0000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.msra.exe.7fffef950000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.2.wscript.exe.7fffe3390000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.loaddll64.exe.7fffe24a0000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.rundll32.exe.7fffe24a0000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.7fffe24a0000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 31.2.OptionalFeatures.exe.7ffff6cd0000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.7fffe24a0000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.mfpmp.exe.7ffff6cd0000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.rundll32.exe.7fffe24a0000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000016.00000002.426087810.00007FFFF6CD1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match File source: 00000028.00000002.611239452.00007FFFE3391000.00000020.00000001.01000000.0000001B.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.269553653.00007FFFE24A1000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.483809310.00007FFFF0DC1000.00000020.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.254908404.00007FFFE24A1000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.579652462.00007FFFE3391000.00000020.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.262721560.00007FFFE24A1000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.548716546.00007FFFF6CD1000.00000020.00000001.01000000.00000016.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.512496586.00007FFFF6CD1000.00000020.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.391467819.00007FFFEF951000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.357465812.00007FFFE24A1000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.248280628.00007FFFE24A1000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.454470944.00007FFFF6CD1000.00000020.00000001.01000000.00000010.sdmp, type: MEMORY
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443FA8F4 CryptGetUserKey,CryptStringToBinaryW,GetProcessHeap,HeapAlloc,CryptStringToBinaryW,CryptImportKey,GetProcessHeap,HeapFree,CryptDestroyKey, 19_2_00007FF7443FA8F4
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443FAAC4 CryptStringToBinaryW,GetProcessHeap,HeapAlloc,CryptStringToBinaryW,CryptImportKey,CryptDestroyKey,CryptGenKey,CryptExportKey,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,CryptExportKey,CryptBinaryToStringW,GetProcessHeap,HeapAlloc,CryptBinaryToStringW,SysAllocString,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,CryptDestroyKey, 19_2_00007FF7443FAAC4
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21F43E0 CryptImportKey,CryptSetKeyParam,CryptSetKeyParam,CryptGetKeyParam,CryptEncrypt,CryptDecrypt,GetLastError,CryptDestroyKey,GetProcessHeap,HeapFree, 29_2_00007FF7F21F43E0
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21F84E4 CryptImportKey,GetLastError,CryptImportKey,CryptExportKey,GetProcessHeap,HeapAlloc,CryptExportKey,GetProcessHeap,HeapAlloc,memmove,GetProcessHeap,HeapFree,CryptDestroyKey,CryptDestroyKey,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,CryptReleaseContext, 29_2_00007FF7F21F84E4
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21F4064 GetProcessHeap,HeapAlloc,memmove,CryptImportKey,GetLastError,CryptImportKey,GetLastError,CryptImportKey,GetLastError,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,CryptDestroyKey,CryptDestroyKey, 29_2_00007FF7F21F4064
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F2245C64 NtShutdownSystem,InitiateSystemShutdownExW,GetLastError, 29_2_00007FF7F2245C64
Detected potential crypto function
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24DAA70 0_2_00007FFFE24DAA70
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24ECA50 0_2_00007FFFE24ECA50
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24EA2C0 0_2_00007FFFE24EA2C0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24C7880 0_2_00007FFFE24C7880
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24D5020 0_2_00007FFFE24D5020
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24F3150 0_2_00007FFFE24F3150
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24D59F0 0_2_00007FFFE24D59F0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE2507650 0_2_00007FFFE2507650
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24E97D0 0_2_00007FFFE24E97D0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE250D520 0_2_00007FFFE250D520
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24FDDC0 0_2_00007FFFE24FDDC0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE250B260 0_2_00007FFFE250B260
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24DB250 0_2_00007FFFE24DB250
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24A7A40 0_2_00007FFFE24A7A40
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE2507AF0 0_2_00007FFFE2507AF0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24DBAE0 0_2_00007FFFE24DBAE0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24C82E0 0_2_00007FFFE24C82E0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE2502AE0 0_2_00007FFFE2502AE0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24CA310 0_2_00007FFFE24CA310
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24D0300 0_2_00007FFFE24D0300
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24CDAA0 0_2_00007FFFE24CDAA0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE25082A0 0_2_00007FFFE25082A0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE250AAA0 0_2_00007FFFE250AAA0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24C92C0 0_2_00007FFFE24C92C0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24FF2C0 0_2_00007FFFE24FF2C0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24D4360 0_2_00007FFFE24D4360
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE2504390 0_2_00007FFFE2504390
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24D1B30 0_2_00007FFFE24D1B30
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24ABB20 0_2_00007FFFE24ABB20
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24A5350 0_2_00007FFFE24A5350
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE2505B50 0_2_00007FFFE2505B50
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24C3340 0_2_00007FFFE24C3340
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24B8340 0_2_00007FFFE24B8340
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE250E400 0_2_00007FFFE250E400
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24B23F0 0_2_00007FFFE24B23F0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE2509410 0_2_00007FFFE2509410
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24B7410 0_2_00007FFFE24B7410
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24F4BC0 0_2_00007FFFE24F4BC0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24DF870 0_2_00007FFFE24DF870
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24EF870 0_2_00007FFFE24EF870
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24BD890 0_2_00007FFFE24BD890
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24CC030 0_2_00007FFFE24CC030
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24D0020 0_2_00007FFFE24D0020
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24C5050 0_2_00007FFFE24C5050
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24F5840 0_2_00007FFFE24F5840
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24BE110 0_2_00007FFFE24BE110
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24C3910 0_2_00007FFFE24C3910
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24AB100 0_2_00007FFFE24AB100
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24B08B0 0_2_00007FFFE24B08B0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24A18D0 0_2_00007FFFE24A18D0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE250B960 0_2_00007FFFE250B960
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24D9990 0_2_00007FFFE24D9990
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24A2980 0_2_00007FFFE24A2980
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24D6130 0_2_00007FFFE24D6130
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE2506950 0_2_00007FFFE2506950
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24C4140 0_2_00007FFFE24C4140
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24D91F0 0_2_00007FFFE24D91F0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24D89F0 0_2_00007FFFE24D89F0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24CF1F0 0_2_00007FFFE24CF1F0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24BE9B0 0_2_00007FFFE24BE9B0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24C11B0 0_2_00007FFFE24C11B0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24CE9A0 0_2_00007FFFE24CE9A0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24D21D0 0_2_00007FFFE24D21D0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24C69C0 0_2_00007FFFE24C69C0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24B8670 0_2_00007FFFE24B8670
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24A6E90 0_2_00007FFFE24A6E90
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24A7E80 0_2_00007FFFE24A7E80
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24A1620 0_2_00007FFFE24A1620
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24ADE20 0_2_00007FFFE24ADE20
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24F0650 0_2_00007FFFE24F0650
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24CF6B0 0_2_00007FFFE24CF6B0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24D06A0 0_2_00007FFFE24D06A0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE250A6B0 0_2_00007FFFE250A6B0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE2507EC0 0_2_00007FFFE2507EC0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE251EF80 0_2_00007FFFE251EF80
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE250C780 0_2_00007FFFE250C780
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24BE770 0_2_00007FFFE24BE770
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE2500770 0_2_00007FFFE2500770
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE2505760 0_2_00007FFFE2505760
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24A6790 0_2_00007FFFE24A6790
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE2500F30 0_2_00007FFFE2500F30
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24C872B 0_2_00007FFFE24C872B
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24C2F50 0_2_00007FFFE24C2F50
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24C6FE0 0_2_00007FFFE24C6FE0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24A1010 0_2_00007FFFE24A1010
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE2514FF0 0_2_00007FFFE2514FF0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24C4800 0_2_00007FFFE24C4800
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24CE7B0 0_2_00007FFFE24CE7B0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE251B7A0 0_2_00007FFFE251B7A0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24BA7D0 0_2_00007FFFE24BA7D0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24B8FC0 0_2_00007FFFE24B8FC0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE250E48B 0_2_00007FFFE250E48B
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE250A490 0_2_00007FFFE250A490
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE250E494 0_2_00007FFFE250E494
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE250E49D 0_2_00007FFFE250E49D
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24CAC80 0_2_00007FFFE24CAC80
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24A5C20 0_2_00007FFFE24A5C20
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24B5420 0_2_00007FFFE24B5420
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24D3CF0 0_2_00007FFFE24D3CF0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24D0D10 0_2_00007FFFE24D0D10
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE2502CA0 0_2_00007FFFE2502CA0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE250E4A6 0_2_00007FFFE250E4A6
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24B3CD0 0_2_00007FFFE24B3CD0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24D5CD0 0_2_00007FFFE24D5CD0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE250E4AD 0_2_00007FFFE250E4AD
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE250E4B6 0_2_00007FFFE250E4B6
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24B9D70 0_2_00007FFFE24B9D70
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24D1D30 0_2_00007FFFE24D1D30
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24C3D50 0_2_00007FFFE24C3D50
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24CD550 0_2_00007FFFE24CD550
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24B65E0 0_2_00007FFFE24B65E0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24C3610 0_2_00007FFFE24C3610
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24D2E10 0_2_00007FFFE24D2E10
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24AC5A0 0_2_00007FFFE24AC5A0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24B95C0 0_2_00007FFFE24B95C0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24D25C0 0_2_00007FFFE24D25C0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443DCD5C 19_2_00007FF7443DCD5C
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443E7D8C 19_2_00007FF7443E7D8C
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443E0D50 19_2_00007FF7443E0D50
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443D1DDC 19_2_00007FF7443D1DDC
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443C2614 19_2_00007FF7443C2614
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443D560C 19_2_00007FF7443D560C
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443D75A8 19_2_00007FF7443D75A8
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF744400DC4 19_2_00007FF744400DC4
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443F3DD0 19_2_00007FF7443F3DD0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443D7E24 19_2_00007FF7443D7E24
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443FAE40 19_2_00007FF7443FAE40
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF744401654 19_2_00007FF744401654
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF744404F10 19_2_00007FF744404F10
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443E66A4 19_2_00007FF7443E66A4
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443E472C 19_2_00007FF7443E472C
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443E2808 19_2_00007FF7443E2808
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443D97AC 19_2_00007FF7443D97AC
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443DE870 19_2_00007FF7443DE870
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443DE06C 19_2_00007FF7443DE06C
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443DA880 19_2_00007FF7443DA880
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443F4880 19_2_00007FF7443F4880
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443F3834 19_2_00007FF7443F3834
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443C4840 19_2_00007FF7443C4840
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443C6958 19_2_00007FF7443C6958
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF744405990 19_2_00007FF744405990
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443E99DC 19_2_00007FF7443E99DC
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443E89D8 19_2_00007FF7443E89D8
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443E21F4 19_2_00007FF7443E21F4
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF744401210 19_2_00007FF744401210
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443D19A0 19_2_00007FF7443D19A0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443E5AB0 19_2_00007FF7443E5AB0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443FAAC4 19_2_00007FF7443FAAC4
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443D72D4 19_2_00007FF7443D72D4
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443DBAC8 19_2_00007FF7443DBAC8
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443C731C 19_2_00007FF7443C731C
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443C2B34 19_2_00007FF7443C2B34
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443E53F0 19_2_00007FF7443E53F0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443EC3F0 19_2_00007FF7443EC3F0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443D7C04 19_2_00007FF7443D7C04
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443D0398 19_2_00007FF7443D0398
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443D5BD4 19_2_00007FF7443D5BD4
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443C13CC 19_2_00007FF7443C13CC
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443CA470 19_2_00007FF7443CA470
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443C9C80 19_2_00007FF7443C9C80
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443E4490 19_2_00007FF7443E4490
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443FBC18 19_2_00007FF7443FBC18
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443C54E0 19_2_00007FF7443C54E0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443F1514 19_2_00007FF7443F1514
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443C7CA4 19_2_00007FF7443C7CA4
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443D44C0 19_2_00007FF7443D44C0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443E04C8 19_2_00007FF7443E04C8
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9997D0 19_2_00007FFFEF9997D0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9B7650 19_2_00007FFFEF9B7650
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9ADDC0 19_2_00007FFFEF9ADDC0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9BD520 19_2_00007FFFEF9BD520
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF985CD0 19_2_00007FFFEF985CD0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF99A2C0 19_2_00007FFFEF99A2C0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF98BAE0 19_2_00007FFFEF98BAE0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF99CA50 19_2_00007FFFEF99CA50
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF98AA70 19_2_00007FFFEF98AA70
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9859F0 19_2_00007FFFEF9859F0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9A3150 19_2_00007FFFEF9A3150
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF985020 19_2_00007FFFEF985020
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF977880 19_2_00007FFFEF977880
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF968FC0 19_2_00007FFFEF968FC0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF96A7D0 19_2_00007FFFEF96A7D0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9CB7A0 19_2_00007FFFEF9CB7A0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF97E7B0 19_2_00007FFFEF97E7B0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF974800 19_2_00007FFFEF974800
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF951010 19_2_00007FFFEF951010
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF976FE0 19_2_00007FFFEF976FE0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9C4FF0 19_2_00007FFFEF9C4FF0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF972F50 19_2_00007FFFEF972F50
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF97872B 19_2_00007FFFEF97872B
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9B0F30 19_2_00007FFFEF9B0F30
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9BC780 19_2_00007FFFEF9BC780
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9CEF80 19_2_00007FFFEF9CEF80
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF956790 19_2_00007FFFEF956790
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9B5760 19_2_00007FFFEF9B5760
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF96E770 19_2_00007FFFEF96E770
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9B0770 19_2_00007FFFEF9B0770
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9CBF6F 19_2_00007FFFEF9CBF6F
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9B7EC0 19_2_00007FFFEF9B7EC0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9806A0 19_2_00007FFFEF9806A0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF97F6B0 19_2_00007FFFEF97F6B0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9BA6B0 19_2_00007FFFEF9BA6B0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9A0650 19_2_00007FFFEF9A0650
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF95DE20 19_2_00007FFFEF95DE20
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF951620 19_2_00007FFFEF951620
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF957E80 19_2_00007FFFEF957E80
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF956E90 19_2_00007FFFEF956E90
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF968670 19_2_00007FFFEF968670
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9825C0 19_2_00007FFFEF9825C0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9695C0 19_2_00007FFFEF9695C0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF95C5A0 19_2_00007FFFEF95C5A0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF982E10 19_2_00007FFFEF982E10
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF973610 19_2_00007FFFEF973610
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9665E0 19_2_00007FFFEF9665E0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF97D550 19_2_00007FFFEF97D550
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF973D50 19_2_00007FFFEF973D50
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9A8D20 19_2_00007FFFEF9A8D20
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF981D30 19_2_00007FFFEF981D30
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9CC590 19_2_00007FFFEF9CC590
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF969D70 19_2_00007FFFEF969D70
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF963CD0 19_2_00007FFFEF963CD0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9BE4AD 19_2_00007FFFEF9BE4AD
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9B2CA0 19_2_00007FFFEF9B2CA0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9BE4A6 19_2_00007FFFEF9BE4A6
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9BE4B6 19_2_00007FFFEF9BE4B6
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF980D10 19_2_00007FFFEF980D10
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF983CF0 19_2_00007FFFEF983CF0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF965420 19_2_00007FFFEF965420
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF955C20 19_2_00007FFFEF955C20
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF97AC80 19_2_00007FFFEF97AC80
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9BE48B 19_2_00007FFFEF9BE48B
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9BE49D 19_2_00007FFFEF9BE49D
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9BA490 19_2_00007FFFEF9BA490
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9BE494 19_2_00007FFFEF9BE494
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9A4BC0 19_2_00007FFFEF9A4BC0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9BE400 19_2_00007FFFEF9BE400
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9CFC00 19_2_00007FFFEF9CFC00
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF967410 19_2_00007FFFEF967410
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9B9410 19_2_00007FFFEF9B9410
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9623F0 19_2_00007FFFEF9623F0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF973340 19_2_00007FFFEF973340
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF968340 19_2_00007FFFEF968340
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF955350 19_2_00007FFFEF955350
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9B5B50 19_2_00007FFFEF9B5B50
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF95BB20 19_2_00007FFFEF95BB20
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF981B30 19_2_00007FFFEF981B30
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9B4390 19_2_00007FFFEF9B4390
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF984360 19_2_00007FFFEF984360
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9792C0 19_2_00007FFFEF9792C0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9A22C0 19_2_00007FFFEF9A22C0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9AF2C0 19_2_00007FFFEF9AF2C0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF97DAA0 19_2_00007FFFEF97DAA0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9B82A0 19_2_00007FFFEF9B82A0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9BAAA0 19_2_00007FFFEF9BAAA0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF980300 19_2_00007FFFEF980300
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF97A310 19_2_00007FFFEF97A310
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9782E0 19_2_00007FFFEF9782E0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9B2AE0 19_2_00007FFFEF9B2AE0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9B7AF0 19_2_00007FFFEF9B7AF0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF957A40 19_2_00007FFFEF957A40
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF98B250 19_2_00007FFFEF98B250
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9BB260 19_2_00007FFFEF9BB260
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9769C0 19_2_00007FFFEF9769C0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9821D0 19_2_00007FFFEF9821D0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF97E9A0 19_2_00007FFFEF97E9A0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF96E9B0 19_2_00007FFFEF96E9B0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9711B0 19_2_00007FFFEF9711B0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D37650 22_2_00007FFFF6D37650
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D197D0 22_2_00007FFFF6D197D0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D05CD0 22_2_00007FFFF6D05CD0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D2DDC0 22_2_00007FFFF6D2DDC0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D3D520 22_2_00007FFFF6D3D520
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D0BAE0 22_2_00007FFFF6D0BAE0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D1A2C0 22_2_00007FFFF6D1A2C0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D0AA70 22_2_00007FFFF6D0AA70
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D1CA50 22_2_00007FFFF6D1CA50
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CF7880 22_2_00007FFFF6CF7880
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D05020 22_2_00007FFFF6D05020
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D059F0 22_2_00007FFFF6D059F0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D23150 22_2_00007FFFF6D23150
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D37EC0 22_2_00007FFFF6D37EC0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CFF6B0 22_2_00007FFFF6CFF6B0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D006A0 22_2_00007FFFF6D006A0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D3A6B0 22_2_00007FFFF6D3A6B0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CE8670 22_2_00007FFFF6CE8670
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CD6E90 22_2_00007FFFF6CD6E90
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CD7E80 22_2_00007FFFF6CD7E80
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D20650 22_2_00007FFFF6D20650
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CDDE20 22_2_00007FFFF6CDDE20
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CD1620 22_2_00007FFFF6CD1620
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CF6FE0 22_2_00007FFFF6CF6FE0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CD1010 22_2_00007FFFF6CD1010
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D44FF0 22_2_00007FFFF6D44FF0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CF4800 22_2_00007FFFF6CF4800
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CFE7B0 22_2_00007FFFF6CFE7B0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D4B7A0 22_2_00007FFFF6D4B7A0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CEA7D0 22_2_00007FFFF6CEA7D0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CE8FC0 22_2_00007FFFF6CE8FC0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D3C780 22_2_00007FFFF6D3C780
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D4EF80 22_2_00007FFFF6D4EF80
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CEE770 22_2_00007FFFF6CEE770
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D35760 22_2_00007FFFF6D35760
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CD6790 22_2_00007FFFF6CD6790
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D30770 22_2_00007FFFF6D30770
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D4BF6F 22_2_00007FFFF6D4BF6F
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CF872B 22_2_00007FFFF6CF872B
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CF2F50 22_2_00007FFFF6CF2F50
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D30F30 22_2_00007FFFF6D30F30
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D03CF0 22_2_00007FFFF6D03CF0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D00D10 22_2_00007FFFF6D00D10
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D32CA0 22_2_00007FFFF6D32CA0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D3E4A6 22_2_00007FFFF6D3E4A6
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CE3CD0 22_2_00007FFFF6CE3CD0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D3E4AD 22_2_00007FFFF6D3E4AD
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D3E4B6 22_2_00007FFFF6D3E4B6
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D3E48B 22_2_00007FFFF6D3E48B
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D3A490 22_2_00007FFFF6D3A490
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D3E494 22_2_00007FFFF6D3E494
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D3E49D 22_2_00007FFFF6D3E49D
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CFAC80 22_2_00007FFFF6CFAC80
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CE5420 22_2_00007FFFF6CE5420
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CD5C20 22_2_00007FFFF6CD5C20
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CE65E0 22_2_00007FFFF6CE65E0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D02E10 22_2_00007FFFF6D02E10
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CF3610 22_2_00007FFFF6CF3610
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CDC5A0 22_2_00007FFFF6CDC5A0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D025C0 22_2_00007FFFF6D025C0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CE95C0 22_2_00007FFFF6CE95C0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CE9D70 22_2_00007FFFF6CE9D70
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D4C590 22_2_00007FFFF6D4C590
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D01D30 22_2_00007FFFF6D01D30
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D28D20 22_2_00007FFFF6D28D20
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CFD550 22_2_00007FFFF6CFD550
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CF3D50 22_2_00007FFFF6CF3D50
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CF82E0 22_2_00007FFFF6CF82E0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D32AE0 22_2_00007FFFF6D32AE0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CFA310 22_2_00007FFFF6CFA310
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D37AF0 22_2_00007FFFF6D37AF0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D00300 22_2_00007FFFF6D00300
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D222C0 22_2_00007FFFF6D222C0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D2F2C0 22_2_00007FFFF6D2F2C0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CFDAA0 22_2_00007FFFF6CFDAA0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D382A0 22_2_00007FFFF6D382A0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D3AAA0 22_2_00007FFFF6D3AAA0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CF92C0 22_2_00007FFFF6CF92C0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D3B260 22_2_00007FFFF6D3B260
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D0B250 22_2_00007FFFF6D0B250
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CD7A40 22_2_00007FFFF6CD7A40
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D3E400 22_2_00007FFFF6D3E400
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D4FC00 22_2_00007FFFF6D4FC00
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CE23F0 22_2_00007FFFF6CE23F0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D39410 22_2_00007FFFF6D39410
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CE7410 22_2_00007FFFF6CE7410
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D24BC0 22_2_00007FFFF6D24BC0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D34390 22_2_00007FFFF6D34390
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D04360 22_2_00007FFFF6D04360
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D01B30 22_2_00007FFFF6D01B30
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D35B50 22_2_00007FFFF6D35B50
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CDBB20 22_2_00007FFFF6CDBB20
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CD5350 22_2_00007FFFF6CD5350
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CF3340 22_2_00007FFFF6CF3340
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CE8340 22_2_00007FFFF6CE8340
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D4C0EB 22_2_00007FFFF6D4C0EB
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CEE110 22_2_00007FFFF6CEE110
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CF3910 22_2_00007FFFF6CF3910
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CDB100 22_2_00007FFFF6CDB100
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CE08B0 22_2_00007FFFF6CE08B0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CD18D0 22_2_00007FFFF6CD18D0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D4C8B1 22_2_00007FFFF6D4C8B1
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CED890 22_2_00007FFFF6CED890
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D1F870 22_2_00007FFFF6D1F870
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D0F870 22_2_00007FFFF6D0F870
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D25840 22_2_00007FFFF6D25840
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CFC030 22_2_00007FFFF6CFC030
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D00020 22_2_00007FFFF6D00020
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D50820 22_2_00007FFFF6D50820
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CF5050 22_2_00007FFFF6CF5050
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CFF1F0 22_2_00007FFFF6CFF1F0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D091F0 22_2_00007FFFF6D091F0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D089F0 22_2_00007FFFF6D089F0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CEE9B0 22_2_00007FFFF6CEE9B0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CF11B0 22_2_00007FFFF6CF11B0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CFE9A0 22_2_00007FFFF6CFE9A0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D021D0 22_2_00007FFFF6D021D0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CF69C0 22_2_00007FFFF6CF69C0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D09990 22_2_00007FFFF6D09990
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D3B960 22_2_00007FFFF6D3B960
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CD2980 22_2_00007FFFF6CD2980
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D06130 22_2_00007FFFF6D06130
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D36950 22_2_00007FFFF6D36950
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CF4140 22_2_00007FFFF6CF4140
Source: C:\Users\user\AppData\Local\ED1MV6ND\Netplwiz.exe Code function: 26_2_00007FF6D63E2B04 26_2_00007FF6D63E2B04
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F2202350 29_2_00007FF7F2202350
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F2211320 29_2_00007FF7F2211320
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21CF378 29_2_00007FF7F21CF378
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F223340C 29_2_00007FF7F223340C
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F223E3E0 29_2_00007FF7F223E3E0
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21F343C 29_2_00007FF7F21F343C
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21E4454 29_2_00007FF7F21E4454
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21CC430 29_2_00007FF7F21CC430
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F22284A4 29_2_00007FF7F22284A4
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F222B510 29_2_00007FF7F222B510
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21F84E4 29_2_00007FF7F21F84E4
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F221A4E0 29_2_00007FF7F221A4E0
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F221E4E0 29_2_00007FF7F221E4E0
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21D1130 29_2_00007FF7F21D1130
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F220012C 29_2_00007FF7F220012C
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F223517C 29_2_00007FF7F223517C
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F2229170 29_2_00007FF7F2229170
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F2247160 29_2_00007FF7F2247160
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F22391D0 29_2_00007FF7F22391D0
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21D21CC 29_2_00007FF7F21D21CC
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F2226200 29_2_00007FF7F2226200
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21D720C 29_2_00007FF7F21D720C
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21FE1D8 29_2_00007FF7F21FE1D8
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21E224C 29_2_00007FF7F21E224C
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21DD290 29_2_00007FF7F21DD290
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21F9264 29_2_00007FF7F21F9264
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F2203270 29_2_00007FF7F2203270
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F22342D4 29_2_00007FF7F22342D4
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21CB29C 29_2_00007FF7F21CB29C
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F2224298 29_2_00007FF7F2224298
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21C52AC 29_2_00007FF7F21C52AC
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21CD2E0 29_2_00007FF7F21CD2E0
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F22182F0 29_2_00007FF7F22182F0
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21F12EC 29_2_00007FF7F21F12EC
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F221474C 29_2_00007FF7F221474C
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21F1740 29_2_00007FF7F21F1740
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21C273C 29_2_00007FF7F21C273C
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21E6718 29_2_00007FF7F21E6718
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F221F790 29_2_00007FF7F221F790
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21FB77C 29_2_00007FF7F21FB77C
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21C8790 29_2_00007FF7F21C8790
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F223F780 29_2_00007FF7F223F780
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F222F780 29_2_00007FF7F222F780
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21EB76C 29_2_00007FF7F21EB76C
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21CA7C0 29_2_00007FF7F21CA7C0
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F22127A0 29_2_00007FF7F22127A0
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F2237808 29_2_00007FF7F2237808
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21E57FC 29_2_00007FF7F21E57FC
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F223A810 29_2_00007FF7F223A810
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F221089C 29_2_00007FF7F221089C
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F22298E0 29_2_00007FF7F22298E0
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21D3530 29_2_00007FF7F21D3530
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F2222590 29_2_00007FF7F2222590
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F2231578 29_2_00007FF7F2231578
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21C8590 29_2_00007FF7F21C8590
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F2221608 29_2_00007FF7F2221608
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F2204610 29_2_00007FF7F2204610
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21D85EC 29_2_00007FF7F21D85EC
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F2200638 29_2_00007FF7F2200638
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21E7684 29_2_00007FF7F21E7684
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21C568C 29_2_00007FF7F21C568C
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F222566C 29_2_00007FF7F222566C
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21EA6F4 29_2_00007FF7F21EA6F4
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21E9B24 29_2_00007FF7F21E9B24
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21FFB18 29_2_00007FF7F21FFB18
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F2209B58 29_2_00007FF7F2209B58
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21FBB70 29_2_00007FF7F21FBB70
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F223DBA0 29_2_00007FF7F223DBA0
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F2223C08 29_2_00007FF7F2223C08
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21C6BDC 29_2_00007FF7F21C6BDC
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21DFC40 29_2_00007FF7F21DFC40
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21F8C80 29_2_00007FF7F21F8C80
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F2220C90 29_2_00007FF7F2220C90
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F2219C70 29_2_00007FF7F2219C70
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21EBC58 29_2_00007FF7F21EBC58
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21D1CAC 29_2_00007FF7F21D1CAC
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21CBCE0 29_2_00007FF7F21CBCE0
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21EFCF0 29_2_00007FF7F21EFCF0
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21E8980 29_2_00007FF7F21E8980
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F2213980 29_2_00007FF7F2213980
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F220B964 29_2_00007FF7F220B964
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21F09C4 29_2_00007FF7F21F09C4
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21D19A0 29_2_00007FF7F21D19A0
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F22309B0 29_2_00007FF7F22309B0
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21C7A00 29_2_00007FF7F21C7A00
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21EE9FC 29_2_00007FF7F21EE9FC
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21CCA0C 29_2_00007FF7F21CCA0C
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F2217A00 29_2_00007FF7F2217A00
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21D89F0 29_2_00007FF7F21D89F0
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21EF9F0 29_2_00007FF7F21EF9F0
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F221DA40 29_2_00007FF7F221DA40
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21E3A1C 29_2_00007FF7F21E3A1C
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F2203A30 29_2_00007FF7F2203A30
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F2228A90 29_2_00007FF7F2228A90
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21C9AB4 29_2_00007FF7F21C9AB4
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F223FA9C 29_2_00007FF7F223FA9C
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F2221B10 29_2_00007FF7F2221B10
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F2227B10 29_2_00007FF7F2227B10
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F2224B14 29_2_00007FF7F2224B14
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F220AAFC 29_2_00007FF7F220AAFC
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21D9AE0 29_2_00007FF7F21D9AE0
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21DCAF0 29_2_00007FF7F21DCAF0
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F221EF40 29_2_00007FF7F221EF40
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F2220F40 29_2_00007FF7F2220F40
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F222EF24 29_2_00007FF7F222EF24
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21D0F74 29_2_00007FF7F21D0F74
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21E6FC4 29_2_00007FF7F21E6FC4
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21F7FD4 29_2_00007FF7F21F7FD4
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: String function: 00007FF7443EAEF4 appears 392 times
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: String function: 00007FF7F21FD0A8 appears 57 times
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: String function: 00007FF7F21CE9C4 appears 36 times
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: String function: 00007FF7F21C3B08 appears 48 times
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: String function: 00007FF7F220CA8C appears 41 times
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: String function: 00007FF7F21C3D44 appears 916 times
Contains functionality to call native functions
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24E7770 NtClose, 0_2_00007FFFE24E7770
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE250D520 NtQuerySystemInformation,RtlAllocateHeap, 0_2_00007FFFE250D520
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF744407AFC NtQueryInformationToken,NtQueryInformationToken, 19_2_00007FF744407AFC
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF744407B90 NtOpenThreadToken,NtOpenProcessToken,NtQueryInformationToken,NtClose, 19_2_00007FF744407B90
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF975F40 NtCreateSection,NtMapViewOfSection,NtUnmapViewOfSection,NtDuplicateObject,NtDuplicateObject, 19_2_00007FFFEF975F40
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF997770 NtClose, 19_2_00007FFFEF997770
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF98CE20 NtDuplicateObject,NtClose, 19_2_00007FFFEF98CE20
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9BD520 NtQuerySystemInformation,RtlAllocateHeap, 19_2_00007FFFEF9BD520
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF985CD0 RtlAddVectoredContinueHandler,VirtualProtect,VirtualProtect,RtlCreateUserThread,NtClose, 19_2_00007FFFEF985CD0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF98C4D0 CreateFileMappingW,VirtualAlloc,NtMapViewOfSection,NtUnmapViewOfSection,NtDuplicateObject,NtDuplicateObject, 19_2_00007FFFEF98C4D0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF98BAE0 NtReadVirtualMemory,RtlQueueApcWow64Thread, 19_2_00007FFFEF98BAE0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF98AA70 VirtualAlloc,NtDuplicateObject,RtlQueueApcWow64Thread, 19_2_00007FFFEF98AA70
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF99F150 NtDelayExecution, 19_2_00007FFFEF99F150
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF988060 NtReadVirtualMemory, 19_2_00007FFFEF988060
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D0CE20 NtDuplicateObject,NtClose, 22_2_00007FFFF6D0CE20
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D17770 NtClose, 22_2_00007FFFF6D17770
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6CF5F40 NtCreateSection,NtMapViewOfSection,NtUnmapViewOfSection,NtDuplicateObject,NtDuplicateObject, 22_2_00007FFFF6CF5F40
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D0C4D0 CreateFileMappingW,VirtualAlloc,NtMapViewOfSection,NtUnmapViewOfSection,NtDuplicateObject,NtDuplicateObject, 22_2_00007FFFF6D0C4D0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D05CD0 RtlAddVectoredContinueHandler,VirtualProtect,VirtualProtect,RtlCreateUserThread,NtClose, 22_2_00007FFFF6D05CD0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D3D520 NtQuerySystemInformation,RtlAllocateHeap, 22_2_00007FFFF6D3D520
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D0BAE0 NtReadVirtualMemory,RtlQueueApcWow64Thread, 22_2_00007FFFF6D0BAE0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D0AA70 VirtualAlloc,NtDuplicateObject,RtlQueueApcWow64Thread, 22_2_00007FFFF6D0AA70
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D08060 NtReadVirtualMemory, 22_2_00007FFFF6D08060
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D1F150 NtDelayExecution, 22_2_00007FFFF6D1F150
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F2202350 memset,memset,NtQuerySystemInformation,GetProcessHeap,HeapFree,GetLastError,SetLastError,memset,CoTaskMemFree,CoTaskMemFree,CoTaskMemFree,CoTaskMemFree,CoTaskMemFree,memset,CoTaskMemFree,CoTaskMemFree,CoTaskMemFree,CoTaskMemFree,CoTaskMemFree,memset,UuidCreate,CoTaskMemFree,CoTaskMemFree,CoTaskMemFree,CoTaskMemFree,CoTaskMemFree,CoTaskMemFree,CoTaskMemFree, 29_2_00007FF7F2202350
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F220A38C GetCurrentThread,NtQueryInformationThread,GetCurrentThread,NtSetInformationThread, 29_2_00007FF7F220A38C
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F223E3E0 memset,RtlGetVersion,GetCurrentProcess,SetPriorityClass,GetLastError,NtSetInformationProcess,NtSetInformationThread,NtSetInformationProcess,NtSetInformationThread, 29_2_00007FF7F223E3E0
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21C273C memset,memset,GetFileAttributesW,GetProcessHeap,HeapFree,GetFileAttributesW,memset,GetSystemWindowsDirectoryW,GetLastError,GetProcessHeap,HeapFree,GetFileAttributesW,GetFileAttributesW,GetProcessHeap,HeapFree,GetFileAttributesW,GetProcessHeap,HeapFree,GetFileAttributesW,GetFileAttributesW,GetProcessHeap,HeapFree,GetFileAttributesW,memset,GetSystemWindowsDirectoryW,GetLastError,GetProcessHeap,HeapAlloc,GetFileAttributesW,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,SetEvent,NtPowerInformation,PowerCreateRequest,PowerSetRequest,PowerSetRequest,SetThreadExecutionState,memset,GetSystemWindowsDirectoryW,GetLastError,SetThreadExecutionState,PowerClearRequest,CloseHandle,SetEvent,GetProcessHeap,HeapFree, 29_2_00007FF7F21C273C
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F220C56C NtQuerySystemInformation, 29_2_00007FF7F220C56C
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F2209B58 memset,NtWriteFile,NtReadFile,NtWriteFile,NtWriteFile,NtWriteFile, 29_2_00007FF7F2209B58
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F2245C64 NtShutdownSystem,InitiateSystemShutdownExW,GetLastError, 29_2_00007FF7F2245C64
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F220A984 NtReadFile, 29_2_00007FF7F220A984
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F220B964 memset,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,FindFirstFileW,GetLastError,GetLastError,_wcsicmp,_wcsicmp,GetLastError,GetCurrentThread,NtQueryInformationThread,FindNextFileW,GetLastError,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,FindClose,SetLastError, 29_2_00007FF7F220B964
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F220A9C8 memset,CreateFileW,NtClose, 29_2_00007FF7F220A9C8
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F220AAFC GetLastError,GetLastError,GetLastError,GetLastError,GetProcessHeap,HeapFree,GetLastError,GetLastError,RtlImageNtHeader,GetLastError,GetLastError,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetLastError,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,CreateFileW,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetProcessHeap,HeapAlloc,memset,WriteFile,GetLastError,GetProcessHeap,HeapFree,NtClose,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,SetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,FlushFileBuffers,GetLastError,CloseHandle,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,SetLastError, 29_2_00007FF7F220AAFC
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21CFFE8 GetFileAttributesW,SetFileAttributesW,CreateFileW,GetFileInformationByHandle,GetModuleHandleW,GetProcAddress,GetProcAddress,memset,GetFullPathNameW,HeapAlloc,RtlFreeHeap,_wcsicmp,FindClose,GetProcessHeap,HeapFree,GetLastError,GetLastError,NtSetInformationFile,RtlNtStatusToDosError,CloseHandle,SetFileAttributesW,GetProcessHeap,HeapFree,GetLastError,GetLastError,GetProcessHeap,HeapFree,SetLastError, 29_2_00007FF7F21CFFE8
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F220A090 CreateFileW,GetLastError,GetProcessHeap,HeapAlloc,NtQueryInformationFile,NtOpenProcess,NtQueryInformationProcess,GetProcessHeap,HeapAlloc,NtQueryInformationProcess,NtClose,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,CloseHandle,GetProcessHeap,HeapFree, 29_2_00007FF7F220A090
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FFFF0DFBAE0 NtReadVirtualMemory, 29_2_00007FFFF0DFBAE0
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FFFF0DFAA70 VirtualAlloc,NtDuplicateObject,RtlQueueApcWow64Thread, 29_2_00007FFFF0DFAA70
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FFFF0DFC4D0 CreateFileMappingW,VirtualAlloc,NtMapViewOfSection,NtUnmapViewOfSection,NtDuplicateObject,NtDuplicateObject, 29_2_00007FFFF0DFC4D0
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FFFF0DF5CD0 RtlAddVectoredContinueHandler,VirtualProtect,VirtualProtect,RtlCreateUserThread,NtClose, 29_2_00007FFFF0DF5CD0
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FFFF0E2D520 NtQuerySystemInformation,RtlAllocateHeap, 29_2_00007FFFF0E2D520
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FFFF0E07770 NtClose, 29_2_00007FFFF0E07770
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FFFF0DE5F40 NtCreateSection,NtMapViewOfSection,NtUnmapViewOfSection,NtDuplicateObject,NtDuplicateObject, 29_2_00007FFFF0DE5F40
Contains functionality to communicate with device drivers
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F2200490: CreateFileW,GetProcessHeap,HeapAlloc,DeviceIoControl,GetLastError,GetProcessHeap,HeapFree,CloseHandle,GetProcessHeap,HeapFree,GetLastError,SetLastError, 29_2_00007FF7F2200490
Sample file is different than original file name gathered from version info
Source: IMqJSR2NIi.dll Binary or memory string: OriginalFilenamedpnhupnp.dJ vs IMqJSR2NIi.dll
PE file contains strange resources
Source: RecoveryDrive.exe.5.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: RecoveryDrive.exe.5.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: RecoveryDrive.exe.5.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: OptionalFeatures.exe.5.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: OptionalFeatures.exe.5.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: OptionalFeatures.exe.5.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Netplwiz.exe.5.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Netplwiz.exe.5.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Netplwiz.exe.5.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msra.exe.5.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msra.exe.5.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msra.exe.5.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msra.exe.5.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msra.exe.5.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msra.exe.5.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msra.exe.5.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msra.exe.5.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msra.exe.5.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msra.exe.5.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msra.exe.5.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msra.exe.5.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msra.exe.5.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msra.exe.5.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msra.exe.5.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: wscript.exe.5.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: wscript.exe.5.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: wscript.exe.5.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: wscript.exe.5.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DevicePairingWizard.exe.5.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msinfo32.exe.5.dr Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: msinfo32.exe.5.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msinfo32.exe.5.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msinfo32.exe.5.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msinfo32.exe.5.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msinfo32.exe.5.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msinfo32.exe.5.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Netplwiz.exe0.5.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Netplwiz.exe0.5.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Netplwiz.exe0.5.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Tries to load missing DLLs
Source: C:\Windows\System32\loaddll64.exe Section loaded: kernel34.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: kernel34.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: windows.globalization.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: capabilityaccessmanagerclient.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: kernel34.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: kernel34.dll Jump to behavior
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Section loaded: kernel34.dll Jump to behavior
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Section loaded: kernel34.dll Jump to behavior
Source: C:\Users\user\AppData\Local\ED1MV6ND\Netplwiz.exe Section loaded: kernel34.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Section loaded: kernel34.dll Jump to behavior
Source: C:\Users\user\AppData\Local\f3fc\OptionalFeatures.exe Section loaded: kernel34.dll
Source: C:\Users\user\AppData\Local\Zc3\Netplwiz.exe Section loaded: kernel34.dll
Source: C:\Users\user\AppData\Local\SxxDNr\MusNotificationUx.exe Section loaded: kernel34.dll
Source: C:\Users\user\AppData\Local\XNPtE2qti\wscript.exe Section loaded: kernel34.dll
PE file contains more sections than normal
Source: NETPLWIZ.dll0.5.dr Static PE information: Number of sections : 58 > 10
Source: MFPlat.DLL.5.dr Static PE information: Number of sections : 58 > 10
Source: NETPLWIZ.dll.5.dr Static PE information: Number of sections : 58 > 10
Source: ReAgent.dll.5.dr Static PE information: Number of sections : 58 > 10
Source: SLC.dll.5.dr Static PE information: Number of sections : 58 > 10
Source: UxTheme.dll.5.dr Static PE information: Number of sections : 58 > 10
Source: VERSION.dll.5.dr Static PE information: Number of sections : 58 > 10
Source: IMqJSR2NIi.dll Static PE information: Number of sections : 57 > 10
Source: XmlLite.dll.5.dr Static PE information: Number of sections : 58 > 10
Source: appwiz.cpl.5.dr Static PE information: Number of sections : 58 > 10
Source: MFC42u.dll.5.dr Static PE information: Number of sections : 58 > 10
Source: IMqJSR2NIi.dll Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: appwiz.cpl.5.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: NETPLWIZ.dll.5.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: XmlLite.dll.5.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: VERSION.dll.5.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: UxTheme.dll.5.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: MFPlat.DLL.5.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: MFC42u.dll.5.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: SLC.dll.5.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: NETPLWIZ.dll0.5.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: ReAgent.dll.5.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: IMqJSR2NIi.dll Virustotal: Detection: 68%
Source: IMqJSR2NIi.dll Metadefender: Detection: 62%
Source: IMqJSR2NIi.dll ReversingLabs: Detection: 85%
Source: IMqJSR2NIi.dll Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Windows\System32\loaddll64.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\IMqJSR2NIi.dll"
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\IMqJSR2NIi.dll",#1
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\IMqJSR2NIi.dll,BrandingFormatString
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\IMqJSR2NIi.dll",#1
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\IMqJSR2NIi.dll,BrandingFormatStringForEdition
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\IMqJSR2NIi.dll,BrandingLoadBitmap
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\msra.exe C:\Windows\system32\msra.exe
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\p9w993CR\msra.exe C:\Users\user\AppData\Local\p9w993CR\msra.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\mfpmp.exe C:\Windows\system32\mfpmp.exe
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe C:\Users\user\AppData\Local\jOnYG\mfpmp.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\Netplwiz.exe C:\Windows\system32\Netplwiz.exe
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\ED1MV6ND\Netplwiz.exe C:\Users\user\AppData\Local\ED1MV6ND\Netplwiz.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\RecoveryDrive.exe C:\Windows\system32\RecoveryDrive.exe
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\OptionalFeatures.exe C:\Windows\system32\OptionalFeatures.exe
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\f3fc\OptionalFeatures.exe C:\Users\user\AppData\Local\f3fc\OptionalFeatures.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\Netplwiz.exe C:\Windows\system32\Netplwiz.exe
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Zc3\Netplwiz.exe C:\Users\user\AppData\Local\Zc3\Netplwiz.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\MusNotificationUx.exe C:\Windows\system32\MusNotificationUx.exe
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\SxxDNr\MusNotificationUx.exe C:\Users\user\AppData\Local\SxxDNr\MusNotificationUx.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\wscript.exe C:\Windows\system32\wscript.exe
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\XNPtE2qti\wscript.exe C:\Users\user\AppData\Local\XNPtE2qti\wscript.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\DevicePairingWizard.exe C:\Windows\system32\DevicePairingWizard.exe
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\IMqJSR2NIi.dll",#1 Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\IMqJSR2NIi.dll,BrandingFormatString Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\IMqJSR2NIi.dll,BrandingFormatStringForEdition Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\IMqJSR2NIi.dll,BrandingLoadBitmap Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\IMqJSR2NIi.dll",#1 Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\msra.exe C:\Windows\system32\msra.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\p9w993CR\msra.exe C:\Users\user\AppData\Local\p9w993CR\msra.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\mfpmp.exe C:\Windows\system32\mfpmp.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\Netplwiz.exe C:\Windows\system32\Netplwiz.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\ED1MV6ND\Netplwiz.exe C:\Users\user\AppData\Local\ED1MV6ND\Netplwiz.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\RecoveryDrive.exe C:\Windows\system32\RecoveryDrive.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\OptionalFeatures.exe C:\Windows\system32\OptionalFeatures.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\f3fc\OptionalFeatures.exe C:\Users\user\AppData\Local\f3fc\OptionalFeatures.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\Netplwiz.exe C:\Windows\system32\Netplwiz.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Zc3\Netplwiz.exe C:\Users\user\AppData\Local\Zc3\Netplwiz.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\MusNotificationUx.exe C:\Windows\system32\MusNotificationUx.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\SxxDNr\MusNotificationUx.exe C:\Users\user\AppData\Local\SxxDNr\MusNotificationUx.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\wscript.exe C:\Windows\system32\wscript.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\XNPtE2qti\wscript.exe C:\Users\user\AppData\Local\XNPtE2qti\wscript.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\DevicePairingWizard.exe C:\Windows\system32\DevicePairingWizard.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\explorer.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\explorer.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\explorer.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\explorer.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32 Jump to behavior
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F2201900 AdjustTokenPrivileges,GetLastError,CloseHandle, 29_2_00007FF7F2201900
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F2206644 GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,GetLastError,DuplicateTokenEx,GetLastError,AdjustTokenPrivileges,SetThreadToken,CloseHandle,CloseHandle, 29_2_00007FF7F2206644
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F220CBF0 GetCurrentThread,OpenThreadToken,GetLastError,GetProcessHeap,HeapAlloc,AdjustTokenPrivileges,GetLastError,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,AdjustTokenPrivileges,GetLastError,CloseHandle,GetProcessHeap,HeapFree,SetLastError, 29_2_00007FF7F220CBF0
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winDLL@49/21@0/0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443DD564 GetModuleHandleW,SysStringByteLen,SysAllocStringByteLen,_time64,SysFreeString,SysFreeString,SysFreeString,SysStringByteLen,SysAllocStringByteLen,SysStringLen,VarBstrCat,SysFreeString,SysStringLen,VarBstrCat,SysFreeString,SysStringLen,VarBstrCat,SysFreeString,CoCreateInstance,SysFreeString,SysFreeString,SysFreeString,SysFreeString,SysFreeString,SysFreeString,SysFreeString, 19_2_00007FF7443DD564
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443E89D8 memset,GetParent,SendMessageW,GetParent,PostMessageW,GetModuleHandleW,LoadStringW,SendMessageW,GetDlgItem,SendMessageW,GetDlgItem,ShowWindow,GetDlgItem,ShowWindow,QueueUserWorkItem,GetLastError,GetLastError,GetDlgItem,EnableWindow,WaitForSingleObject,GetDlgItem,EnableWindow,GetDlgItem,ShowWindow,GetDlgItem,EnableWindow,GetDlgItem,GetDlgItem,ShowWindow,GetDlgItem,ShowWindow,GetDlgItem,ShowWindow,SendMessageW,GetDlgItem,ShowWindow,SendMessageW,CreateThread,SendMessageW,QueueUserWorkItem,GetLastError,GetLastError,GetModuleHandleW,LoadStringW,SetDlgItemTextW,WaitForSingleObject,GetDlgItem,EnableWindow,GetDlgItem,SendMessageW,SendMessageW,SysAllocString,SendMessageW,SysFreeString,SendMessageW,GetDlgItem,GetWindowTextLengthW,GetParent,SendMessageW,SysStringByteLen,SysAllocStringByteLen,SysAllocString,GetModuleHandleW,LoadStringW,FormatMessageW,GetDlgItem,SetWindowTextW,GetDlgItem,SendMessageW,PostMessageW,GetModuleHandleW,LoadStringW,GetModuleHandleW,LoadStringW,WaitForSingleObject,WaitForSingleObject,SysFreeString,SysFreeString,CloseHandle,LocalFree, 19_2_00007FF7443E89D8
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7444078A0 OpenSCManagerW,GetLastError,OpenServiceW,GetLastError,StartServiceW,GetLastError,QueryServiceStatus,Sleep,GetLastError,CloseServiceHandle,CloseServiceHandle, 19_2_00007FF7444078A0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF98CB00 GetProcessId,CreateToolhelp32Snapshot,Thread32First,Thread32Next, 19_2_00007FFFEF98CB00
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\IMqJSR2NIi.dll,BrandingFormatString
Source: C:\Users\user\AppData\Local\XNPtE2qti\wscript.exe Mutant created: \Sessions\1\BaseNamedObjects\{527116c4-1367-55fa-435c-646cb9a71231}
Source: C:\Users\user\AppData\Local\XNPtE2qti\wscript.exe Mutant created: \Sessions\1\BaseNamedObjects\{21abcada-76b5-44c0-b3f3-f4197d1aa80a}
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443CF69C FindResourceExW,FindResourceExW,LoadResource,LockResource,LoadResource,LockResource,CreateDialogIndirectParamW,GetLastError,GlobalHandle,GlobalFree,GetLastError,SetLastError, 19_2_00007FF7443CF69C
Source: IMqJSR2NIi.dll Static PE information: Image base 0x140000000 > 0x60000000
Source: IMqJSR2NIi.dll Static file information: File size 1351680 > 1048576
Source: IMqJSR2NIi.dll Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Source: Binary string: MSRA.pdb source: msra.exe, 00000013.00000000.367253133.00007FF74440C000.00000002.00000001.01000000.0000000A.sdmp, msra.exe, 00000013.00000002.391229137.00007FF74440C000.00000002.00000001.01000000.0000000A.sdmp, msra.exe.5.dr
Source: Binary string: RecoveryDrive.pdbGCTL source: RecoveryDrive.exe, 0000001D.00000000.459453459.00007FF7F224C000.00000002.00000001.01000000.00000011.sdmp, RecoveryDrive.exe, 0000001D.00000002.483695697.00007FF7F224C000.00000002.00000001.01000000.00000011.sdmp, RecoveryDrive.exe.5.dr
Source: Binary string: msinfo32.pdb source: msinfo32.exe.5.dr
Source: Binary string: wscript.pdbGCTL source: wscript.exe, 00000028.00000000.584120682.00007FF775F85000.00000002.00000001.01000000.0000001A.sdmp, wscript.exe, 00000028.00000002.611169672.00007FF775F85000.00000002.00000001.01000000.0000001A.sdmp, wscript.exe.5.dr
Source: Binary string: MFPMP.pdb source: mfpmp.exe, 00000016.00000000.402543032.00007FF7243D7000.00000002.00000001.01000000.0000000C.sdmp, mfpmp.exe, 00000016.00000002.426009184.00007FF7243D7000.00000002.00000001.01000000.0000000C.sdmp, mfpmp.exe.5.dr
Source: Binary string: netplwiz.pdb source: Netplwiz.exe, 0000001A.00000000.430649778.00007FF6D63E4000.00000002.00000001.01000000.0000000F.sdmp, Netplwiz.exe, 0000001A.00000002.454430360.00007FF6D63E4000.00000002.00000001.01000000.0000000F.sdmp, Netplwiz.exe, 00000021.00000000.525832806.00007FF618294000.00000002.00000001.01000000.00000015.sdmp, Netplwiz.exe, 00000021.00000002.548659085.00007FF618294000.00000002.00000001.01000000.00000015.sdmp, Netplwiz.exe.5.dr, Netplwiz.exe0.5.dr
Source: Binary string: MusNotificationUx.pdb source: MusNotificationUx.exe, 00000025.00000000.554704894.00007FF7E997E000.00000002.00000001.01000000.00000017.sdmp, MusNotificationUx.exe, 00000025.00000002.579596179.00007FF7E997E000.00000002.00000001.01000000.00000017.sdmp, MusNotificationUx.exe.5.dr
Source: Binary string: netplwiz.pdbGCTL source: Netplwiz.exe, 0000001A.00000000.430649778.00007FF6D63E4000.00000002.00000001.01000000.0000000F.sdmp, Netplwiz.exe, 0000001A.00000002.454430360.00007FF6D63E4000.00000002.00000001.01000000.0000000F.sdmp, Netplwiz.exe, 00000021.00000000.525832806.00007FF618294000.00000002.00000001.01000000.00000015.sdmp, Netplwiz.exe, 00000021.00000002.548659085.00007FF618294000.00000002.00000001.01000000.00000015.sdmp, Netplwiz.exe.5.dr, Netplwiz.exe0.5.dr
Source: Binary string: OptionalFeatures.pdb source: OptionalFeatures.exe, 0000001F.00000000.489565264.00007FF7638D4000.00000002.00000001.01000000.00000013.sdmp, OptionalFeatures.exe, 0000001F.00000002.512402334.00007FF7638D4000.00000002.00000001.01000000.00000013.sdmp, OptionalFeatures.exe.5.dr
Source: Binary string: MusNotificationUx.pdbGCTL source: MusNotificationUx.exe, 00000025.00000000.554704894.00007FF7E997E000.00000002.00000001.01000000.00000017.sdmp, MusNotificationUx.exe, 00000025.00000002.579596179.00007FF7E997E000.00000002.00000001.01000000.00000017.sdmp, MusNotificationUx.exe.5.dr
Source: Binary string: MFPMP.pdbUGP source: mfpmp.exe, 00000016.00000000.402543032.00007FF7243D7000.00000002.00000001.01000000.0000000C.sdmp, mfpmp.exe, 00000016.00000002.426009184.00007FF7243D7000.00000002.00000001.01000000.0000000C.sdmp, mfpmp.exe.5.dr
Source: Binary string: wscript.pdb source: wscript.exe, 00000028.00000000.584120682.00007FF775F85000.00000002.00000001.01000000.0000001A.sdmp, wscript.exe, 00000028.00000002.611169672.00007FF775F85000.00000002.00000001.01000000.0000001A.sdmp, wscript.exe.5.dr
Source: Binary string: RecoveryDrive.pdb source: RecoveryDrive.exe, 0000001D.00000000.459453459.00007FF7F224C000.00000002.00000001.01000000.00000011.sdmp, RecoveryDrive.exe, 0000001D.00000002.483695697.00007FF7F224C000.00000002.00000001.01000000.00000011.sdmp, RecoveryDrive.exe.5.dr
Source: Binary string: DevicePairingWizard.pdb source: DevicePairingWizard.exe.5.dr
Source: Binary string: msinfo32.pdbGCTL source: msinfo32.exe.5.dr
Source: Binary string: OptionalFeatures.pdbGCTL source: OptionalFeatures.exe, 0000001F.00000000.489565264.00007FF7638D4000.00000002.00000001.01000000.00000013.sdmp, OptionalFeatures.exe, 0000001F.00000002.512402334.00007FF7638D4000.00000002.00000001.01000000.00000013.sdmp, OptionalFeatures.exe.5.dr
Source: Binary string: DevicePairingWizard.pdbGCTL source: DevicePairingWizard.exe.5.dr
Source: Binary string: MSRA.pdbGCTL source: msra.exe, 00000013.00000000.367253133.00007FF74440C000.00000002.00000001.01000000.0000000A.sdmp, msra.exe, 00000013.00000002.391229137.00007FF74440C000.00000002.00000001.01000000.0000000A.sdmp, msra.exe.5.dr
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9CD500 push rax; iretd 19_2_00007FFFEF9CD501
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D4D500 push rax; iretd 22_2_00007FFFF6D4D501
PE file contains sections with non-standard names
Source: IMqJSR2NIi.dll Static PE information: section name: .vxl
Source: IMqJSR2NIi.dll Static PE information: section name: .qwubgr
Source: IMqJSR2NIi.dll Static PE information: section name: .eer
Source: IMqJSR2NIi.dll Static PE information: section name: .xwwauf
Source: IMqJSR2NIi.dll Static PE information: section name: .pkc
Source: IMqJSR2NIi.dll Static PE information: section name: .npkda
Source: IMqJSR2NIi.dll Static PE information: section name: .vhs
Source: IMqJSR2NIi.dll Static PE information: section name: .iaywj
Source: IMqJSR2NIi.dll Static PE information: section name: .nasi
Source: IMqJSR2NIi.dll Static PE information: section name: .zhvprh
Source: IMqJSR2NIi.dll Static PE information: section name: .yatdsp
Source: IMqJSR2NIi.dll Static PE information: section name: .njso
Source: IMqJSR2NIi.dll Static PE information: section name: .lgliat
Source: IMqJSR2NIi.dll Static PE information: section name: .ntqjh
Source: IMqJSR2NIi.dll Static PE information: section name: .sucsek
Source: IMqJSR2NIi.dll Static PE information: section name: .qsxjui
Source: IMqJSR2NIi.dll Static PE information: section name: .twctcm
Source: IMqJSR2NIi.dll Static PE information: section name: .nms
Source: IMqJSR2NIi.dll Static PE information: section name: .ogj
Source: IMqJSR2NIi.dll Static PE information: section name: .vrkgb
Source: IMqJSR2NIi.dll Static PE information: section name: .gikfw
Source: IMqJSR2NIi.dll Static PE information: section name: .ktl
Source: IMqJSR2NIi.dll Static PE information: section name: .crcn
Source: IMqJSR2NIi.dll Static PE information: section name: .wtfr
Source: IMqJSR2NIi.dll Static PE information: section name: .hep
Source: IMqJSR2NIi.dll Static PE information: section name: .ywg
Source: IMqJSR2NIi.dll Static PE information: section name: .sqsp
Source: IMqJSR2NIi.dll Static PE information: section name: .gzb
Source: IMqJSR2NIi.dll Static PE information: section name: .fatlss
Source: IMqJSR2NIi.dll Static PE information: section name: .plqa
Source: IMqJSR2NIi.dll Static PE information: section name: .vzt
Source: IMqJSR2NIi.dll Static PE information: section name: .dsbyd
Source: IMqJSR2NIi.dll Static PE information: section name: .cdelc
Source: IMqJSR2NIi.dll Static PE information: section name: .qkhkj
Source: IMqJSR2NIi.dll Static PE information: section name: .mnzegr
Source: IMqJSR2NIi.dll Static PE information: section name: .krw
Source: IMqJSR2NIi.dll Static PE information: section name: .jvsmn
Source: IMqJSR2NIi.dll Static PE information: section name: .bygpq
Source: IMqJSR2NIi.dll Static PE information: section name: .kzdbu
Source: IMqJSR2NIi.dll Static PE information: section name: .mwxorn
Source: IMqJSR2NIi.dll Static PE information: section name: .raf
Source: IMqJSR2NIi.dll Static PE information: section name: .zcyw
Source: IMqJSR2NIi.dll Static PE information: section name: .zeczh
Source: IMqJSR2NIi.dll Static PE information: section name: .pvv
Source: IMqJSR2NIi.dll Static PE information: section name: .lug
Source: IMqJSR2NIi.dll Static PE information: section name: .ski
Source: IMqJSR2NIi.dll Static PE information: section name: .japjd
Source: IMqJSR2NIi.dll Static PE information: section name: .mwtzml
Source: IMqJSR2NIi.dll Static PE information: section name: .vgssf
Source: IMqJSR2NIi.dll Static PE information: section name: .qqb
Source: IMqJSR2NIi.dll Static PE information: section name: .dpewel
Source: MusNotificationUx.exe.5.dr Static PE information: section name: .imrsiv
Source: MusNotificationUx.exe.5.dr Static PE information: section name: .didat
Source: msra.exe.5.dr Static PE information: section name: .didat
Source: mfpmp.exe.5.dr Static PE information: section name: .didat
Source: appwiz.cpl.5.dr Static PE information: section name: .vxl
Source: appwiz.cpl.5.dr Static PE information: section name: .qwubgr
Source: appwiz.cpl.5.dr Static PE information: section name: .eer
Source: appwiz.cpl.5.dr Static PE information: section name: .xwwauf
Source: appwiz.cpl.5.dr Static PE information: section name: .pkc
Source: appwiz.cpl.5.dr Static PE information: section name: .npkda
Source: appwiz.cpl.5.dr Static PE information: section name: .vhs
Source: appwiz.cpl.5.dr Static PE information: section name: .iaywj
Source: appwiz.cpl.5.dr Static PE information: section name: .nasi
Source: appwiz.cpl.5.dr Static PE information: section name: .zhvprh
Source: appwiz.cpl.5.dr Static PE information: section name: .yatdsp
Source: appwiz.cpl.5.dr Static PE information: section name: .njso
Source: appwiz.cpl.5.dr Static PE information: section name: .lgliat
Source: appwiz.cpl.5.dr Static PE information: section name: .ntqjh
Source: appwiz.cpl.5.dr Static PE information: section name: .sucsek
Source: appwiz.cpl.5.dr Static PE information: section name: .qsxjui
Source: appwiz.cpl.5.dr Static PE information: section name: .twctcm
Source: appwiz.cpl.5.dr Static PE information: section name: .nms
Source: appwiz.cpl.5.dr Static PE information: section name: .ogj
Source: appwiz.cpl.5.dr Static PE information: section name: .vrkgb
Source: appwiz.cpl.5.dr Static PE information: section name: .gikfw
Source: appwiz.cpl.5.dr Static PE information: section name: .ktl
Source: appwiz.cpl.5.dr Static PE information: section name: .crcn
Source: appwiz.cpl.5.dr Static PE information: section name: .wtfr
Source: appwiz.cpl.5.dr Static PE information: section name: .hep
Source: appwiz.cpl.5.dr Static PE information: section name: .ywg
Source: appwiz.cpl.5.dr Static PE information: section name: .sqsp
Source: appwiz.cpl.5.dr Static PE information: section name: .gzb
Source: appwiz.cpl.5.dr Static PE information: section name: .fatlss
Source: appwiz.cpl.5.dr Static PE information: section name: .plqa
Source: appwiz.cpl.5.dr Static PE information: section name: .vzt
Source: appwiz.cpl.5.dr Static PE information: section name: .dsbyd
Source: appwiz.cpl.5.dr Static PE information: section name: .cdelc
Source: appwiz.cpl.5.dr Static PE information: section name: .qkhkj
Source: appwiz.cpl.5.dr Static PE information: section name: .mnzegr
Source: appwiz.cpl.5.dr Static PE information: section name: .krw
Source: appwiz.cpl.5.dr Static PE information: section name: .jvsmn
Source: appwiz.cpl.5.dr Static PE information: section name: .bygpq
Source: appwiz.cpl.5.dr Static PE information: section name: .kzdbu
Source: appwiz.cpl.5.dr Static PE information: section name: .mwxorn
Source: appwiz.cpl.5.dr Static PE information: section name: .raf
Source: appwiz.cpl.5.dr Static PE information: section name: .zcyw
Source: appwiz.cpl.5.dr Static PE information: section name: .zeczh
Source: appwiz.cpl.5.dr Static PE information: section name: .pvv
Source: appwiz.cpl.5.dr Static PE information: section name: .lug
Source: appwiz.cpl.5.dr Static PE information: section name: .ski
Source: appwiz.cpl.5.dr Static PE information: section name: .japjd
Source: appwiz.cpl.5.dr Static PE information: section name: .mwtzml
Source: appwiz.cpl.5.dr Static PE information: section name: .vgssf
Source: appwiz.cpl.5.dr Static PE information: section name: .qqb
Source: appwiz.cpl.5.dr Static PE information: section name: .dpewel
Source: appwiz.cpl.5.dr Static PE information: section name: .srp
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .vxl
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .qwubgr
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .eer
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .xwwauf
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .pkc
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .npkda
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .vhs
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .iaywj
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .nasi
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .zhvprh
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .yatdsp
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .njso
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .lgliat
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .ntqjh
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .sucsek
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .qsxjui
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .twctcm
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .nms
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .ogj
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .vrkgb
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .gikfw
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .ktl
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .crcn
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .wtfr
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .hep
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .ywg
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .sqsp
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .gzb
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .fatlss
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .plqa
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .vzt
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .dsbyd
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .cdelc
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .qkhkj
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .mnzegr
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .krw
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .jvsmn
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .bygpq
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .kzdbu
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .mwxorn
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .raf
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .zcyw
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .zeczh
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .pvv
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .lug
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .ski
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .japjd
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .mwtzml
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .vgssf
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .qqb
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .dpewel
Source: NETPLWIZ.dll.5.dr Static PE information: section name: .lwpnxq
Source: XmlLite.dll.5.dr Static PE information: section name: .vxl
Source: XmlLite.dll.5.dr Static PE information: section name: .qwubgr
Source: XmlLite.dll.5.dr Static PE information: section name: .eer
Source: XmlLite.dll.5.dr Static PE information: section name: .xwwauf
Source: XmlLite.dll.5.dr Static PE information: section name: .pkc
Source: XmlLite.dll.5.dr Static PE information: section name: .npkda
Source: XmlLite.dll.5.dr Static PE information: section name: .vhs
Source: XmlLite.dll.5.dr Static PE information: section name: .iaywj
Source: XmlLite.dll.5.dr Static PE information: section name: .nasi
Source: XmlLite.dll.5.dr Static PE information: section name: .zhvprh
Source: XmlLite.dll.5.dr Static PE information: section name: .yatdsp
Source: XmlLite.dll.5.dr Static PE information: section name: .njso
Source: XmlLite.dll.5.dr Static PE information: section name: .lgliat
Source: XmlLite.dll.5.dr Static PE information: section name: .ntqjh
Source: XmlLite.dll.5.dr Static PE information: section name: .sucsek
Source: XmlLite.dll.5.dr Static PE information: section name: .qsxjui
Source: XmlLite.dll.5.dr Static PE information: section name: .twctcm
Source: XmlLite.dll.5.dr Static PE information: section name: .nms
Source: XmlLite.dll.5.dr Static PE information: section name: .ogj
Source: XmlLite.dll.5.dr Static PE information: section name: .vrkgb
Source: XmlLite.dll.5.dr Static PE information: section name: .gikfw
Source: XmlLite.dll.5.dr Static PE information: section name: .ktl
Source: XmlLite.dll.5.dr Static PE information: section name: .crcn
Source: XmlLite.dll.5.dr Static PE information: section name: .wtfr
Source: XmlLite.dll.5.dr Static PE information: section name: .hep
Source: XmlLite.dll.5.dr Static PE information: section name: .ywg
Source: XmlLite.dll.5.dr Static PE information: section name: .sqsp
Source: XmlLite.dll.5.dr Static PE information: section name: .gzb
Source: XmlLite.dll.5.dr Static PE information: section name: .fatlss
Source: XmlLite.dll.5.dr Static PE information: section name: .plqa
Source: XmlLite.dll.5.dr Static PE information: section name: .vzt
Source: XmlLite.dll.5.dr Static PE information: section name: .dsbyd
Source: XmlLite.dll.5.dr Static PE information: section name: .cdelc
Source: XmlLite.dll.5.dr Static PE information: section name: .qkhkj
Source: XmlLite.dll.5.dr Static PE information: section name: .mnzegr
Source: XmlLite.dll.5.dr Static PE information: section name: .krw
Source: XmlLite.dll.5.dr Static PE information: section name: .jvsmn
Source: XmlLite.dll.5.dr Static PE information: section name: .bygpq
Source: XmlLite.dll.5.dr Static PE information: section name: .kzdbu
Source: XmlLite.dll.5.dr Static PE information: section name: .mwxorn
Source: XmlLite.dll.5.dr Static PE information: section name: .raf
Source: XmlLite.dll.5.dr Static PE information: section name: .zcyw
Source: XmlLite.dll.5.dr Static PE information: section name: .zeczh
Source: XmlLite.dll.5.dr Static PE information: section name: .pvv
Source: XmlLite.dll.5.dr Static PE information: section name: .lug
Source: XmlLite.dll.5.dr Static PE information: section name: .ski
Source: XmlLite.dll.5.dr Static PE information: section name: .japjd
Source: XmlLite.dll.5.dr Static PE information: section name: .mwtzml
Source: XmlLite.dll.5.dr Static PE information: section name: .vgssf
Source: XmlLite.dll.5.dr Static PE information: section name: .qqb
Source: XmlLite.dll.5.dr Static PE information: section name: .dpewel
Source: XmlLite.dll.5.dr Static PE information: section name: .pbmw
Source: VERSION.dll.5.dr Static PE information: section name: .vxl
Source: VERSION.dll.5.dr Static PE information: section name: .qwubgr
Source: VERSION.dll.5.dr Static PE information: section name: .eer
Source: VERSION.dll.5.dr Static PE information: section name: .xwwauf
Source: VERSION.dll.5.dr Static PE information: section name: .pkc
Source: VERSION.dll.5.dr Static PE information: section name: .npkda
Source: VERSION.dll.5.dr Static PE information: section name: .vhs
Source: VERSION.dll.5.dr Static PE information: section name: .iaywj
Source: VERSION.dll.5.dr Static PE information: section name: .nasi
Source: VERSION.dll.5.dr Static PE information: section name: .zhvprh
Source: VERSION.dll.5.dr Static PE information: section name: .yatdsp
Source: VERSION.dll.5.dr Static PE information: section name: .njso
Source: VERSION.dll.5.dr Static PE information: section name: .lgliat
Source: VERSION.dll.5.dr Static PE information: section name: .ntqjh
Source: VERSION.dll.5.dr Static PE information: section name: .sucsek
Source: VERSION.dll.5.dr Static PE information: section name: .qsxjui
Source: VERSION.dll.5.dr Static PE information: section name: .twctcm
Source: VERSION.dll.5.dr Static PE information: section name: .nms
Source: VERSION.dll.5.dr Static PE information: section name: .ogj
Source: VERSION.dll.5.dr Static PE information: section name: .vrkgb
Source: VERSION.dll.5.dr Static PE information: section name: .gikfw
Source: VERSION.dll.5.dr Static PE information: section name: .ktl
Source: VERSION.dll.5.dr Static PE information: section name: .crcn
Source: VERSION.dll.5.dr Static PE information: section name: .wtfr
Source: VERSION.dll.5.dr Static PE information: section name: .hep
Source: VERSION.dll.5.dr Static PE information: section name: .ywg
Source: VERSION.dll.5.dr Static PE information: section name: .sqsp
Source: VERSION.dll.5.dr Static PE information: section name: .gzb
Source: VERSION.dll.5.dr Static PE information: section name: .fatlss
Source: VERSION.dll.5.dr Static PE information: section name: .plqa
Source: VERSION.dll.5.dr Static PE information: section name: .vzt
Source: VERSION.dll.5.dr Static PE information: section name: .dsbyd
Source: VERSION.dll.5.dr Static PE information: section name: .cdelc
Source: VERSION.dll.5.dr Static PE information: section name: .qkhkj
Source: VERSION.dll.5.dr Static PE information: section name: .mnzegr
Source: VERSION.dll.5.dr Static PE information: section name: .krw
Source: VERSION.dll.5.dr Static PE information: section name: .jvsmn
Source: VERSION.dll.5.dr Static PE information: section name: .bygpq
Source: VERSION.dll.5.dr Static PE information: section name: .kzdbu
Source: VERSION.dll.5.dr Static PE information: section name: .mwxorn
Source: VERSION.dll.5.dr Static PE information: section name: .raf
Source: VERSION.dll.5.dr Static PE information: section name: .zcyw
Source: VERSION.dll.5.dr Static PE information: section name: .zeczh
Source: VERSION.dll.5.dr Static PE information: section name: .pvv
Source: VERSION.dll.5.dr Static PE information: section name: .lug
Source: VERSION.dll.5.dr Static PE information: section name: .ski
Source: VERSION.dll.5.dr Static PE information: section name: .japjd
Source: VERSION.dll.5.dr Static PE information: section name: .mwtzml
Source: VERSION.dll.5.dr Static PE information: section name: .vgssf
Source: VERSION.dll.5.dr Static PE information: section name: .qqb
Source: VERSION.dll.5.dr Static PE information: section name: .dpewel
Source: VERSION.dll.5.dr Static PE information: section name: .ool
Source: UxTheme.dll.5.dr Static PE information: section name: .vxl
Source: UxTheme.dll.5.dr Static PE information: section name: .qwubgr
Source: UxTheme.dll.5.dr Static PE information: section name: .eer
Source: UxTheme.dll.5.dr Static PE information: section name: .xwwauf
Source: UxTheme.dll.5.dr Static PE information: section name: .pkc
Source: UxTheme.dll.5.dr Static PE information: section name: .npkda
Source: UxTheme.dll.5.dr Static PE information: section name: .vhs
Source: UxTheme.dll.5.dr Static PE information: section name: .iaywj
Source: UxTheme.dll.5.dr Static PE information: section name: .nasi
Source: UxTheme.dll.5.dr Static PE information: section name: .zhvprh
Source: UxTheme.dll.5.dr Static PE information: section name: .yatdsp
Source: UxTheme.dll.5.dr Static PE information: section name: .njso
Source: UxTheme.dll.5.dr Static PE information: section name: .lgliat
Source: UxTheme.dll.5.dr Static PE information: section name: .ntqjh
Source: UxTheme.dll.5.dr Static PE information: section name: .sucsek
Source: UxTheme.dll.5.dr Static PE information: section name: .qsxjui
Source: UxTheme.dll.5.dr Static PE information: section name: .twctcm
Source: UxTheme.dll.5.dr Static PE information: section name: .nms
Source: UxTheme.dll.5.dr Static PE information: section name: .ogj
Source: UxTheme.dll.5.dr Static PE information: section name: .vrkgb
Source: UxTheme.dll.5.dr Static PE information: section name: .gikfw
Source: UxTheme.dll.5.dr Static PE information: section name: .ktl
Source: UxTheme.dll.5.dr Static PE information: section name: .crcn
Source: UxTheme.dll.5.dr Static PE information: section name: .wtfr
Source: UxTheme.dll.5.dr Static PE information: section name: .hep
Source: UxTheme.dll.5.dr Static PE information: section name: .ywg
Source: UxTheme.dll.5.dr Static PE information: section name: .sqsp
Source: UxTheme.dll.5.dr Static PE information: section name: .gzb
Source: UxTheme.dll.5.dr Static PE information: section name: .fatlss
Source: UxTheme.dll.5.dr Static PE information: section name: .plqa
Source: UxTheme.dll.5.dr Static PE information: section name: .vzt
Source: UxTheme.dll.5.dr Static PE information: section name: .dsbyd
Source: UxTheme.dll.5.dr Static PE information: section name: .cdelc
Source: UxTheme.dll.5.dr Static PE information: section name: .qkhkj
Source: UxTheme.dll.5.dr Static PE information: section name: .mnzegr
Source: UxTheme.dll.5.dr Static PE information: section name: .krw
Source: UxTheme.dll.5.dr Static PE information: section name: .jvsmn
Source: UxTheme.dll.5.dr Static PE information: section name: .bygpq
Source: UxTheme.dll.5.dr Static PE information: section name: .kzdbu
Source: UxTheme.dll.5.dr Static PE information: section name: .mwxorn
Source: UxTheme.dll.5.dr Static PE information: section name: .raf
Source: UxTheme.dll.5.dr Static PE information: section name: .zcyw
Source: UxTheme.dll.5.dr Static PE information: section name: .zeczh
Source: UxTheme.dll.5.dr Static PE information: section name: .pvv
Source: UxTheme.dll.5.dr Static PE information: section name: .lug
Source: UxTheme.dll.5.dr Static PE information: section name: .ski
Source: UxTheme.dll.5.dr Static PE information: section name: .japjd
Source: UxTheme.dll.5.dr Static PE information: section name: .mwtzml
Source: UxTheme.dll.5.dr Static PE information: section name: .vgssf
Source: UxTheme.dll.5.dr Static PE information: section name: .qqb
Source: UxTheme.dll.5.dr Static PE information: section name: .dpewel
Source: UxTheme.dll.5.dr Static PE information: section name: .zit
Source: MFPlat.DLL.5.dr Static PE information: section name: .vxl
Source: MFPlat.DLL.5.dr Static PE information: section name: .qwubgr
Source: MFPlat.DLL.5.dr Static PE information: section name: .eer
Source: MFPlat.DLL.5.dr Static PE information: section name: .xwwauf
Source: MFPlat.DLL.5.dr Static PE information: section name: .pkc
Source: MFPlat.DLL.5.dr Static PE information: section name: .npkda
Source: MFPlat.DLL.5.dr Static PE information: section name: .vhs
Source: MFPlat.DLL.5.dr Static PE information: section name: .iaywj
Source: MFPlat.DLL.5.dr Static PE information: section name: .nasi
Source: MFPlat.DLL.5.dr Static PE information: section name: .zhvprh
Source: MFPlat.DLL.5.dr Static PE information: section name: .yatdsp
Source: MFPlat.DLL.5.dr Static PE information: section name: .njso
Source: MFPlat.DLL.5.dr Static PE information: section name: .lgliat
Source: MFPlat.DLL.5.dr Static PE information: section name: .ntqjh
Source: MFPlat.DLL.5.dr Static PE information: section name: .sucsek
Source: MFPlat.DLL.5.dr Static PE information: section name: .qsxjui
Source: MFPlat.DLL.5.dr Static PE information: section name: .twctcm
Source: MFPlat.DLL.5.dr Static PE information: section name: .nms
Source: MFPlat.DLL.5.dr Static PE information: section name: .ogj
Source: MFPlat.DLL.5.dr Static PE information: section name: .vrkgb
Source: MFPlat.DLL.5.dr Static PE information: section name: .gikfw
Source: MFPlat.DLL.5.dr Static PE information: section name: .ktl
Source: MFPlat.DLL.5.dr Static PE information: section name: .crcn
Source: MFPlat.DLL.5.dr Static PE information: section name: .wtfr
Source: MFPlat.DLL.5.dr Static PE information: section name: .hep
Source: MFPlat.DLL.5.dr Static PE information: section name: .ywg
Source: MFPlat.DLL.5.dr Static PE information: section name: .sqsp
Source: MFPlat.DLL.5.dr Static PE information: section name: .gzb
Source: MFPlat.DLL.5.dr Static PE information: section name: .fatlss
Source: MFPlat.DLL.5.dr Static PE information: section name: .plqa
Source: MFPlat.DLL.5.dr Static PE information: section name: .vzt
Source: MFPlat.DLL.5.dr Static PE information: section name: .dsbyd
Source: MFPlat.DLL.5.dr Static PE information: section name: .cdelc
Source: MFPlat.DLL.5.dr Static PE information: section name: .qkhkj
Source: MFPlat.DLL.5.dr Static PE information: section name: .mnzegr
Source: MFPlat.DLL.5.dr Static PE information: section name: .krw
Source: MFPlat.DLL.5.dr Static PE information: section name: .jvsmn
Source: MFPlat.DLL.5.dr Static PE information: section name: .bygpq
Source: MFPlat.DLL.5.dr Static PE information: section name: .kzdbu
Source: MFPlat.DLL.5.dr Static PE information: section name: .mwxorn
Source: MFPlat.DLL.5.dr Static PE information: section name: .raf
Source: MFPlat.DLL.5.dr Static PE information: section name: .zcyw
Source: MFPlat.DLL.5.dr Static PE information: section name: .zeczh
Source: MFPlat.DLL.5.dr Static PE information: section name: .pvv
Source: MFPlat.DLL.5.dr Static PE information: section name: .lug
Source: MFPlat.DLL.5.dr Static PE information: section name: .ski
Source: MFPlat.DLL.5.dr Static PE information: section name: .japjd
Source: MFPlat.DLL.5.dr Static PE information: section name: .mwtzml
Source: MFPlat.DLL.5.dr Static PE information: section name: .vgssf
Source: MFPlat.DLL.5.dr Static PE information: section name: .qqb
Source: MFPlat.DLL.5.dr Static PE information: section name: .dpewel
Source: MFPlat.DLL.5.dr Static PE information: section name: .skxwe
Source: MFC42u.dll.5.dr Static PE information: section name: .vxl
Source: MFC42u.dll.5.dr Static PE information: section name: .qwubgr
Source: MFC42u.dll.5.dr Static PE information: section name: .eer
Source: MFC42u.dll.5.dr Static PE information: section name: .xwwauf
Source: MFC42u.dll.5.dr Static PE information: section name: .pkc
Source: MFC42u.dll.5.dr Static PE information: section name: .npkda
Source: MFC42u.dll.5.dr Static PE information: section name: .vhs
Source: MFC42u.dll.5.dr Static PE information: section name: .iaywj
Source: MFC42u.dll.5.dr Static PE information: section name: .nasi
Source: MFC42u.dll.5.dr Static PE information: section name: .zhvprh
Source: MFC42u.dll.5.dr Static PE information: section name: .yatdsp
Source: MFC42u.dll.5.dr Static PE information: section name: .njso
Source: MFC42u.dll.5.dr Static PE information: section name: .lgliat
Source: MFC42u.dll.5.dr Static PE information: section name: .ntqjh
Source: MFC42u.dll.5.dr Static PE information: section name: .sucsek
Source: MFC42u.dll.5.dr Static PE information: section name: .qsxjui
Source: MFC42u.dll.5.dr Static PE information: section name: .twctcm
Source: MFC42u.dll.5.dr Static PE information: section name: .nms
Source: MFC42u.dll.5.dr Static PE information: section name: .ogj
Source: MFC42u.dll.5.dr Static PE information: section name: .vrkgb
Source: MFC42u.dll.5.dr Static PE information: section name: .gikfw
Source: MFC42u.dll.5.dr Static PE information: section name: .ktl
Source: MFC42u.dll.5.dr Static PE information: section name: .crcn
Source: MFC42u.dll.5.dr Static PE information: section name: .wtfr
Source: MFC42u.dll.5.dr Static PE information: section name: .hep
Source: MFC42u.dll.5.dr Static PE information: section name: .ywg
Source: MFC42u.dll.5.dr Static PE information: section name: .sqsp
Source: MFC42u.dll.5.dr Static PE information: section name: .gzb
Source: MFC42u.dll.5.dr Static PE information: section name: .fatlss
Source: MFC42u.dll.5.dr Static PE information: section name: .plqa
Source: MFC42u.dll.5.dr Static PE information: section name: .vzt
Source: MFC42u.dll.5.dr Static PE information: section name: .dsbyd
Source: MFC42u.dll.5.dr Static PE information: section name: .cdelc
Source: MFC42u.dll.5.dr Static PE information: section name: .qkhkj
Source: MFC42u.dll.5.dr Static PE information: section name: .mnzegr
Source: MFC42u.dll.5.dr Static PE information: section name: .krw
Source: MFC42u.dll.5.dr Static PE information: section name: .jvsmn
Source: MFC42u.dll.5.dr Static PE information: section name: .bygpq
Source: MFC42u.dll.5.dr Static PE information: section name: .kzdbu
Source: MFC42u.dll.5.dr Static PE information: section name: .mwxorn
Source: MFC42u.dll.5.dr Static PE information: section name: .raf
Source: MFC42u.dll.5.dr Static PE information: section name: .zcyw
Source: MFC42u.dll.5.dr Static PE information: section name: .zeczh
Source: MFC42u.dll.5.dr Static PE information: section name: .pvv
Source: MFC42u.dll.5.dr Static PE information: section name: .lug
Source: MFC42u.dll.5.dr Static PE information: section name: .ski
Source: MFC42u.dll.5.dr Static PE information: section name: .japjd
Source: MFC42u.dll.5.dr Static PE information: section name: .mwtzml
Source: MFC42u.dll.5.dr Static PE information: section name: .vgssf
Source: MFC42u.dll.5.dr Static PE information: section name: .qqb
Source: MFC42u.dll.5.dr Static PE information: section name: .dpewel
Source: MFC42u.dll.5.dr Static PE information: section name: .qhzxa
Source: SLC.dll.5.dr Static PE information: section name: .vxl
Source: SLC.dll.5.dr Static PE information: section name: .qwubgr
Source: SLC.dll.5.dr Static PE information: section name: .eer
Source: SLC.dll.5.dr Static PE information: section name: .xwwauf
Source: SLC.dll.5.dr Static PE information: section name: .pkc
Source: SLC.dll.5.dr Static PE information: section name: .npkda
Source: SLC.dll.5.dr Static PE information: section name: .vhs
Source: SLC.dll.5.dr Static PE information: section name: .iaywj
Source: SLC.dll.5.dr Static PE information: section name: .nasi
Source: SLC.dll.5.dr Static PE information: section name: .zhvprh
Source: SLC.dll.5.dr Static PE information: section name: .yatdsp
Source: SLC.dll.5.dr Static PE information: section name: .njso
Source: SLC.dll.5.dr Static PE information: section name: .lgliat
Source: SLC.dll.5.dr Static PE information: section name: .ntqjh
Source: SLC.dll.5.dr Static PE information: section name: .sucsek
Source: SLC.dll.5.dr Static PE information: section name: .qsxjui
Source: SLC.dll.5.dr Static PE information: section name: .twctcm
Source: SLC.dll.5.dr Static PE information: section name: .nms
Source: SLC.dll.5.dr Static PE information: section name: .ogj
Source: SLC.dll.5.dr Static PE information: section name: .vrkgb
Source: SLC.dll.5.dr Static PE information: section name: .gikfw
Source: SLC.dll.5.dr Static PE information: section name: .ktl
Source: SLC.dll.5.dr Static PE information: section name: .crcn
Source: SLC.dll.5.dr Static PE information: section name: .wtfr
Source: SLC.dll.5.dr Static PE information: section name: .hep
Source: SLC.dll.5.dr Static PE information: section name: .ywg
Source: SLC.dll.5.dr Static PE information: section name: .sqsp
Source: SLC.dll.5.dr Static PE information: section name: .gzb
Source: SLC.dll.5.dr Static PE information: section name: .fatlss
Source: SLC.dll.5.dr Static PE information: section name: .plqa
Source: SLC.dll.5.dr Static PE information: section name: .vzt
Source: SLC.dll.5.dr Static PE information: section name: .dsbyd
Source: SLC.dll.5.dr Static PE information: section name: .cdelc
Source: SLC.dll.5.dr Static PE information: section name: .qkhkj
Source: SLC.dll.5.dr Static PE information: section name: .mnzegr
Source: SLC.dll.5.dr Static PE information: section name: .krw
Source: SLC.dll.5.dr Static PE information: section name: .jvsmn
Source: SLC.dll.5.dr Static PE information: section name: .bygpq
Source: SLC.dll.5.dr Static PE information: section name: .kzdbu
Source: SLC.dll.5.dr Static PE information: section name: .mwxorn
Source: SLC.dll.5.dr Static PE information: section name: .raf
Source: SLC.dll.5.dr Static PE information: section name: .zcyw
Source: SLC.dll.5.dr Static PE information: section name: .zeczh
Source: SLC.dll.5.dr Static PE information: section name: .pvv
Source: SLC.dll.5.dr Static PE information: section name: .lug
Source: SLC.dll.5.dr Static PE information: section name: .ski
Source: SLC.dll.5.dr Static PE information: section name: .japjd
Source: SLC.dll.5.dr Static PE information: section name: .mwtzml
Source: SLC.dll.5.dr Static PE information: section name: .vgssf
Source: SLC.dll.5.dr Static PE information: section name: .qqb
Source: SLC.dll.5.dr Static PE information: section name: .dpewel
Source: SLC.dll.5.dr Static PE information: section name: .hjsmf
Source: NETPLWIZ.dll0.5.dr Static PE information: section name: .vxl
Source: NETPLWIZ.dll0.5.dr Static PE information: section name: .qwubgr
Source: NETPLWIZ.dll0.5.dr Static PE information: section name: .eer
Source: NETPLWIZ.dll0.5.dr Static PE information: section name: .xwwauf
Source: NETPLWIZ.dll0.5.dr Static PE information: section name: .pkc
Source: NETPLWIZ.dll0.5.dr Static PE information: section name: .npkda
Source: NETPLWIZ.dll0.5.dr Static PE information: section name: .vhs
Source: NETPLWIZ.dll0.5.dr Static PE information: section name: .iaywj
Source: NETPLWIZ.dll0.5.dr Static PE information: section name: .nasi
Source: NETPLWIZ.dll0.5.dr Static PE information: section name: .zhvprh
Source: NETPLWIZ.dll0.5.dr Static PE information: section name: .yatdsp
Source: NETPLWIZ.dll0.5.dr Static PE information: section name: .njso
Source: NETPLWIZ.dll0.5.dr Static PE information: section name: .lgliat
Source: NETPLWIZ.dll0.5.dr Static PE information: section name: .ntqjh
Source: NETPLWIZ.dll0.5.dr Static PE information: section name: .sucsek
Source: NETPLWIZ.dll0.5.dr Static PE information: section name: .qsxjui
Source: NETPLWIZ.dll0.5.dr Static PE information: section name: .twctcm
Source: NETPLWIZ.dll0.5.dr Static PE information: section name: .nms
Source: NETPLWIZ.dll0.5.dr Static PE information: section name: .ogj
Source: NETPLWIZ.dll0.5.dr Static PE information: section name: .vrkgb
Source: NETPLWIZ.dll0.5.dr Static PE information: section name: .gikfw
Source: NETPLWIZ.dll0.5.dr Static PE information: section name: .ktl
Source: NETPLWIZ.dll0.5.dr Static PE information: section name: .crcn
Source: NETPLWIZ.dll0.5.dr Static PE information: section name: .wtfr
Source: NETPLWIZ.dll0.5.dr Static PE information: section name: .hep
Source: NETPLWIZ.dll0.5.dr Static PE information: section name: .ywg
Source: NETPLWIZ.dll0.5.dr Static PE information: section name: .sqsp
Source: NETPLWIZ.dll0.5.dr Static PE information: section name: .gzb
Source: NETPLWIZ.dll0.5.dr Static PE information: section name: .fatlss
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443C50F4 LoadLibraryW,GetProcAddress,SysFreeString, 19_2_00007FF7443C50F4
Binary contains a suspicious time stamp
Source: Netplwiz.exe.5.dr Static PE information: 0xD5E5CD76 [Sun Sep 19 19:22:30 2083 UTC]
Source: initial sample Static PE information: section name: .text entropy: 7.78392111205
Source: initial sample Static PE information: section name: .text entropy: 7.78392111205
Source: initial sample Static PE information: section name: .text entropy: 7.78392111205
Source: initial sample Static PE information: section name: .text entropy: 7.78392111205
Source: initial sample Static PE information: section name: .text entropy: 7.78392111205
Source: initial sample Static PE information: section name: .text entropy: 7.78392111205
Source: initial sample Static PE information: section name: .text entropy: 7.78392111205
Source: initial sample Static PE information: section name: .text entropy: 7.78392111205
Source: initial sample Static PE information: section name: .text entropy: 7.78392111205
Source: initial sample Static PE information: section name: .text entropy: 7.78392111205
Source: initial sample Static PE information: section name: .text entropy: 7.78392111205
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\f3fc\appwiz.cpl Jump to dropped file
Drops PE files
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\f3fc\OptionalFeatures.exe Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\TQg3bhA\ReAgent.dll Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Zc3\Netplwiz.exe Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\SxxDNr\XmlLite.dll Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\CdAVuX3\DevicePairingWizard.exe Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\OiZS\SLC.dll Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\jOnYG\MFPlat.DLL Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\OiZS\msinfo32.exe Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\p9w993CR\UxTheme.dll Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\XNPtE2qti\VERSION.dll Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\p9w993CR\msra.exe Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\XNPtE2qti\wscript.exe Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\ED1MV6ND\NETPLWIZ.dll Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\ED1MV6ND\Netplwiz.exe Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\SxxDNr\MusNotificationUx.exe Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Zc3\NETPLWIZ.dll Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\f3fc\appwiz.cpl Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\CdAVuX3\MFC42u.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7444078A0 OpenSCManagerW,GetLastError,OpenServiceW,GetLastError,StartServiceW,GetLastError,QueryServiceStatus,Sleep,GetLastError,CloseServiceHandle,CloseServiceHandle, 19_2_00007FF7444078A0
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443E38F4 GetWindowRect,GetDesktopWindow,GetWindowRect,IsIconic,GetDesktopWindow,GetWindowRect,GetDesktopWindow,GetWindowRect, 19_2_00007FF7443E38F4
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443DB0A0 SendMessageW,PostMessageW,IsIconic,OpenIcon,SetForegroundWindow,PostMessageW,GetDlgItem,SetFocus,SendMessageW,GetDlgItem,SendMessageW, 19_2_00007FF7443DB0A0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443D44C0 SendMessageW,PostMessageW,KillTimer,KillTimer,GetDlgItem,SetFocus,KillTimer,IsIconic,OpenIcon,SetForegroundWindow,ReleaseCapture,LoadCursorW,SetCursor,SetFocus,PtInRect,GetDlgItem,GetSysColor,SetTextColor,GetSysColor,SetBkColor,GetSysColorBrush, 19_2_00007FF7443D44C0
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F220613C memset,memset,GetSystemDirectoryW,GetLastError,LoadLibraryExW,GetProcAddress,GetProcAddress,GetLastError,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary, 29_2_00007FF7F220613C
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\explorer.exe TID: 6320 Thread sleep count: 43 > 30 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Windows\explorer.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\OiZS\SLC.dll Jump to dropped file
Source: C:\Windows\explorer.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\OiZS\msinfo32.exe Jump to dropped file
Source: C:\Windows\explorer.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\CdAVuX3\MFC42u.dll Jump to dropped file
Uses the system / local time for branch decision (may execute only at specific dates)
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21C7410 GetSystemTimeAsFileTime followed by cmp: cmp dword ptr [rsp+20h], 03h and CTI: jne 00007FF7F21C762Ch 29_2_00007FF7F21C7410
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F22251F4 GetSystemTimeAsFileTime followed by cmp: cmp r9d, 01h and CTI: je 00007FF7F2225362h 29_2_00007FF7F22251F4
Found evasive API chain checking for process token information
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Windows\System32\loaddll64.exe Check user administrative privileges: GetTokenInformation,DecisionNodes
Contains functionality to read device registry values (via SetupAPI)
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21FB77C SetErrorMode,SetupDiGetClassDevsW,GetLastError,memset,SetupDiEnumDeviceInterfaces,SetupDiGetDeviceInterfaceDetailW,GetLastError,memset,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,SetupDiGetDeviceInterfaceDetailW,memset,SetupDiEnumDeviceInterfaces,GetLastError,SetErrorMode,GetProcessHeap,HeapFree,SetupDiGetDeviceRegistryPropertyW,GetLastError,GetLastError, 29_2_00007FF7F21FB77C
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe API coverage: 1.6 %
Source: C:\Users\user\AppData\Local\ED1MV6ND\Netplwiz.exe API coverage: 3.4 %
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe API coverage: 1.2 %
Source: C:\Windows\System32\loaddll64.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24FDDC0 GetSystemInfo, 0_2_00007FFFE24FDDC0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24FED10 FindFirstFileExW, 0_2_00007FFFE24FED10
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443DE800 memset,FindFirstFileW,FindClose, 19_2_00007FF7443DE800
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FFFEF9AED10 FindFirstFileExW, 19_2_00007FFFEF9AED10
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FFFF6D2ED10 FindFirstFileExW, 22_2_00007FFFF6D2ED10
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F2205458 memset,memset,memset,memset,FindFirstFileW,CompareStringW,CompareStringW,memset,FindNextFileW,FindClose,CoTaskMemFree,GetProcessHeap,HeapFree, 29_2_00007FF7F2205458
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21D21CC GetProcessHeap,HeapFree,GetFileAttributesW,GetLastError,GetProcessHeap,HeapFree,_wcsicmp,GetProcessHeap,HeapFree,FindClose,FindFirstFileW,FindClose,GetLastError,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,FindNextFileW,memmove,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,FindClose,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree, 29_2_00007FF7F21D21CC
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21E6718 WIMCreateFile,GetLastError,FindClose,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,WIMCloseHandle,WIMCloseHandle,memset,WIMGetAttributes,GetLastError,memset,GetFullPathNameW,GetLastError,memset,FindFirstFileW,GetLastError,GetProcessHeap,HeapFree,WIMCreateFile,WIMCloseHandle,memset,WIMGetAttributes,FindNextFileW,GetLastError,GetLastError,GetLastError, 29_2_00007FF7F21E6718
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21E57FC memset,GetSystemWindowsDirectoryW,GetLastError,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetFileAttributesW,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetFileAttributesW,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetVolumeInformationW,memset,FindFirstFileW,GetLastError,CompareStringW,CompareStringW,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,FindNextFileW,GetLastError,GetLastError,GetProcessHeap,HeapFree,GetFileAttributesW,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetFileAttributesW,GetProcessHeap,HeapFree,FindClose,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree, 29_2_00007FF7F21E57FC
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F2200638 memset,SetLastError,SetLastError,HeapAlloc,GetLastError,FindFirstFileW,memset,memset,wcsrchr,SetLastError,CompareStringW,CompareStringW,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,memset,FindNextFileW,GetLastError,GetLastError,GetLastError,FindClose,GetLastError,RtlFreeHeap,GetLastError,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,SetLastError,SetLastError, 29_2_00007FF7F2200638
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21FE958 free,memset,FindFirstFileW,GetLastError,GetLastError,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,FindClose, 29_2_00007FF7F21FE958
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F220B964 memset,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,FindFirstFileW,GetLastError,GetLastError,_wcsicmp,_wcsicmp,GetLastError,GetCurrentThread,NtQueryInformationThread,FindNextFileW,GetLastError,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,FindClose,SetLastError, 29_2_00007FF7F220B964
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21E4E28 GetFileAttributesW,GetLastError,memset,FindFirstFileW,GetLastError,FindClose,GetProcessHeap,CompareStringW,CompareStringW,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,FindNextFileW,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,CreateFileW,GetLastError,CloseHandle,GetFileSizeEx,GetLastError,CloseHandle,CloseHandle,GetProcessHeap,HeapFree,CloseHandle,GetProcessHeap,CloseHandle,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree, 29_2_00007FF7F21E4E28
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FFFF0E1ED10 FindFirstFileExW, 29_2_00007FFFF0E1ED10
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21CB29C memset,GetSystemWindowsDirectoryW,GetLastError,memset,GetLogicalDriveStringsW,GetLastError,GetProcessHeap,HeapFree,memset,GetVolumeInformationW,LoadStringW,GetProcessHeap,HeapFree, 29_2_00007FF7F21CB29C
Source: explorer.exe, 00000005.00000000.314962831.00000000051AC000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000005.00000000.298920594.00000000051F7000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: -94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}71USER
Source: explorer.exe, 00000005.00000000.301869724.0000000006005000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.301869724.0000000006005000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000005.00000000.317091968.0000000005EAB000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.301869724.0000000006005000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.298920594.00000000051F7000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 00000005.00000000.314894153.0000000005136000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: explorer.exe, 00000005.00000000.301869724.0000000006005000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}on:Mondz?S
Source: explorer.exe, 00000005.00000000.301869724.0000000006005000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware SATA CD00dRom0cY
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443FD9C0 GetCurrentThreadId,memset,IsDebuggerPresent,OutputDebugStringW, 19_2_00007FF7443FD9C0
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21FD0A8 _cwprintf_s_l,OutputDebugStringW,GetLastError,CurrentIP,WdsSetupLogMessageW,CreateFileW,GetLastError,GetLastError,GetProcessHeap,HeapAlloc,DeviceIoControl,GetLastError,DeviceIoControl,GetLastError,GetLastError,GetProcessHeap,HeapFree,CloseHandle, 29_2_00007FF7F21FD0A8
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443C50F4 LoadLibraryW,GetProcAddress,SysFreeString, 19_2_00007FF7443C50F4
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443E6D60 memset,CoInitializeEx,CoCreateInstance,GetProcessHeap,HeapFree,CoTaskMemFree,CoUninitialize, 19_2_00007FF7443E6D60
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24E97D0 LdrLoadDll,FindClose, 0_2_00007FFFE24E97D0
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF744408FEC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 19_2_00007FF744408FEC
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF744409330 SetUnhandledExceptionFilter, 19_2_00007FF744409330
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FF7243D29F0 SetUnhandledExceptionFilter, 22_2_00007FF7243D29F0
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FF7243D2D14 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 22_2_00007FF7243D2D14
Source: C:\Users\user\AppData\Local\ED1MV6ND\Netplwiz.exe Code function: 26_2_00007FF6D63E3690 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 26_2_00007FF6D63E3690
Source: C:\Users\user\AppData\Local\ED1MV6ND\Netplwiz.exe Code function: 26_2_00007FF6D63E3930 SetUnhandledExceptionFilter, 26_2_00007FF6D63E3930
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F22483E0 SetUnhandledExceptionFilter, 29_2_00007FF7F22483E0
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F224864C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 29_2_00007FF7F224864C

HIPS / PFW / Operating System Protection Evasion
barindex
Benign windows process drops PE files
Source: C:\Windows\explorer.exe File created: RecoveryDrive.exe.5.dr Jump to dropped file
Changes memory attributes in foreign processes to executable or writable
Source: C:\Windows\System32\rundll32.exe Memory protected: C:\Windows\explorer.exe base: 7FF802C5EFE0 protect: page execute and read and write Jump to behavior
Source: C:\Windows\System32\rundll32.exe Memory protected: C:\Windows\explorer.exe base: 7FF802C5E000 protect: page execute read Jump to behavior
Source: C:\Windows\System32\rundll32.exe Memory protected: C:\Windows\explorer.exe base: 7FF8024E2A20 protect: page execute and read and write Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Windows\System32\rundll32.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Contains functionality to prevent local Windows debugging
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FF7243D5730 EnterCriticalSection,IsDebuggerPresent,DebugBreak,GetLastError,SetLastError,LeaveCriticalSection, 22_2_00007FF7243D5730
Source: C:\Users\user\AppData\Local\jOnYG\mfpmp.exe Code function: 22_2_00007FF7243D54A0 EnterCriticalSection,IsDebuggerPresent,DebugBreak,LeaveCriticalSection, 22_2_00007FF7243D54A0
Uses Atom Bombing / ProGate to inject into other processes
Source: C:\Windows\System32\rundll32.exe Atom created: 405553565741544156488D6C24D14881EC98 0x00000000 inc eax 0x00000001 push ebp 0x00000002 push ebx 0x00000003 push esi 0x00000004 push edi 0x00000005 inc ecx 0x00000006 push esp 0x00000007 inc ecx 0x00000008 push esi 0x00000009 dec eax 0x0000000a lea ebp, dword ptr [esp-2Fh] 0x0000000e dec eax 0x0000000f sub esp, 00000098h Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\IMqJSR2NIi.dll",#1 Jump to behavior
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443DF97C AllocateAndInitializeSid,GetLastError,CheckTokenMembership,GetLastError,GetCurrentProcess,OpenProcessToken,GetLastError,GetTokenInformation,GetLastError,CheckTokenMembership,GetLastError,CloseHandle,CloseHandle,FreeSid, 19_2_00007FF7443DF97C
Source: explorer.exe, 00000005.00000000.270251757.0000000000B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.301443810.0000000005610000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.283649956.0000000005E60000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000005.00000000.270251757.0000000000B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.294124779.00000000005C8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.249818320.00000000005C8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000005.00000000.270251757.0000000000B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.310355895.0000000000B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.294474835.0000000000B50000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Program Manager,
Source: explorer.exe, 00000005.00000000.270251757.0000000000B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.310355895.0000000000B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.294474835.0000000000B50000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\AppData\Local\ED1MV6ND\Netplwiz.exe Code function: HeapSetInformation,memset,LoadCursorW,GetStockObject,RegisterClassW,GetUserDefaultUILanguage,GetLocaleInfoW,CreateWindowExW,GetLastError,CreateWindowExW,UsersRunDllW,DestroyWindow, 26_2_00007FF6D63E286C
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: memset,memset,GetLocaleInfoW,GetLastError,wcstoul,GetLocaleInfoW,GetLastError,GetNumberFormatW,GetLastError,GetProcessHeap,HeapAlloc,GetNumberFormatW,GetLastError,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree, 29_2_00007FF7F21CCA0C
Queries device information via Setup API
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21FB77C SetErrorMode,SetupDiGetClassDevsW,GetLastError,memset,SetupDiEnumDeviceInterfaces,SetupDiGetDeviceInterfaceDetailW,GetLastError,memset,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,SetupDiGetDeviceInterfaceDetailW,memset,SetupDiEnumDeviceInterfaces,GetLastError,SetErrorMode,GetProcessHeap,HeapFree,SetupDiGetDeviceRegistryPropertyW,GetLastError,GetLastError, 29_2_00007FF7F21FB77C
Queries the installation date of Windows
Source: C:\Windows\System32\loaddll64.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443ECD1C memset,memset,GetLocalTime,SysAllocString,SysFreeString,SysAllocString,SysFreeString,SysFreeString, 19_2_00007FF7443ECD1C
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F21C4344 GetTimeZoneInformation,GetLastError,GetSystemTime,SystemTimeToTzSpecificLocalTime, 29_2_00007FF7F21C4344
Source: C:\Users\user\AppData\Local\TQg3bhA\RecoveryDrive.exe Code function: 29_2_00007FF7F223E3E0 memset,RtlGetVersion,GetCurrentProcess,SetPriorityClass,GetLastError,NtSetInformationProcess,NtSetInformationThread,NtSetInformationProcess,NtSetInformationThread, 29_2_00007FF7F223E3E0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFFE24E9400 GetUserNameW, 0_2_00007FFFE24E9400
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443DCD5C memset,CreateBindCtx,memset,memset,memset,MkParseDisplayName,SysAllocString,GetProcessHeap,HeapFree,SysFreeString,CoTaskMemFree, 19_2_00007FF7443DCD5C
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7443DED48 memset,memset,CreateBindCtx,memset,MkParseDisplayName, 19_2_00007FF7443DED48
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7444077E4 RpcBindingFree,NdrClientCall3, 19_2_00007FF7444077E4
Source: C:\Users\user\AppData\Local\p9w993CR\msra.exe Code function: 19_2_00007FF7444079B4 memset,RpcStringBindingComposeW,RpcBindingFromStringBindingW,RpcStringFreeW,LocalAlloc,CreateWellKnownSid,GetLastError,RpcBindingSetAuthInfoExW,LocalFree,RpcBindingFree, 19_2_00007FF7444079B4
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 595302 Sample: IMqJSR2NIi Startdate: 23/03/2022 Architecture: WINDOWS Score: 100 42 Antivirus detection for dropped file 2->42 44 Antivirus / Scanner detection for submitted sample 2->44 46 Multi AV Scanner detection for submitted file 2->46 48 4 other signatures 2->48 8 loaddll64.exe 1 2->8         started        process3 process4 10 rundll32.exe 8->10         started        13 cmd.exe 1 8->13         started        15 rundll32.exe 8->15         started        17 rundll32.exe 8->17         started        signatures5 54 Changes memory attributes in foreign processes to executable or writable 10->54 56 Uses Atom Bombing / ProGate to inject into other processes 10->56 58 Queues an APC in another process (thread injection) 10->58 19 explorer.exe 2 61 10->19 injected 23 rundll32.exe 13->23         started        process6 file7 34 C:\Users\user\AppData\Local\...\UxTheme.dll, PE32+ 19->34 dropped 36 C:\Users\user\AppData\Local\jOnYG\mfpmp.exe, PE32+ 19->36 dropped 38 C:\Users\user\AppData\Local\...\MFPlat.DLL, PE32+ 19->38 dropped 40 17 other files (7 malicious) 19->40 dropped 50 Benign windows process drops PE files 19->50 25 mfpmp.exe 19->25         started        28 msra.exe 19->28         started        30 Netplwiz.exe 19->30         started        32 14 other processes 19->32 signatures8 process9 signatures10 52 Contains functionality to prevent local Windows debugging 25->52
⊘No contacted IP infos