Joe Sandbox Class Analysis Report

Loading ...

Similarity Report

Overview

General Information

Joe Sandbox Version:23.0.0
Analysis ID:648369
Start date:29.08.2018
Start time:09:58:45
Joe Sandbox Product:Cloud
Overall analysis duration:0h 11m 0s
Hypervisor based Inspection enabled:false
Report type:full
Sample file name:DOC000YUT600.scr (renamed file extension from scr to exe)
Cookbook file name:default.jbs
Analysis system description:Windows 7 (Office 2010 SP2, Java 1.8.0_40, Flash 16.0.0.305, Acrobat Reader 11.0.08, Internet Explorer 11, Chrome 55, Firefox 43)
Number of analysed new started processes analysed:8
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies
  • HCA enabled
  • EGA enabled
  • HDC enabled
Analysis stop reason:Timeout
Detection:MAL
Classification:mal100.rans.troj.spyw.evad.winEXE@10/5@0/1
EGA Information:
  • Successful, ratio: 33.3%
HDC Information:
  • Successful, ratio: 99.9% (good quality ratio 90.9%)
  • Quality average: 76.9%
  • Quality standard deviation: 31.3%
HCA Information:Failed
Cookbook Comments:
  • Adjust boot time
Warnings:
Show All
  • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe
  • Execution Graph export aborted for target DOC000YUT600.exe, PID 3420 because it is empty
  • Execution Graph export aborted for target Regdriver.exe, PID 3484 because it is empty
  • Execution Graph export aborted for target regdrv.exe, PID 3452 because it is empty
  • Execution Graph export aborted for target regdrv.exe, PID 3532 because it is empty
  • Report size exceeded maximum capacity and may have missing disassembly code.
  • Report size getting too big, too many NtOpenKeyEx calls found.
  • Report size getting too big, too many NtQueryValueKey calls found.

Static File Info

File type:PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):6.7932256230048225
TrID:
  • Win32 Executable (generic) a (10002005/4) 99.94%
  • Win16/32 Executable Delphi generic (2074/23) 0.02%
  • Generic Win/DOS Executable (2004/3) 0.02%
  • DOS Executable Generic (2002/1) 0.02%
  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:DOC000YUT60.exe
File size:1816064
MD5:cd1974c09f7171e19634de0e00d7efb7
SHA1:41f02346c16fb2585edb2585ef67766e42e69528
SHA256:ccf07ed87ce33179ba77b74372818958a04236860738ce96993976493488e7b4
SHA512:485c46e035ca077065645dba67d1f40e0787ed04175a6a11e5fbe9e5d1289b98376f3b845b97871dd0cb6629061a3a12ed537fb11fe1db7001849288faa5e717
File Content Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

Similarity Information

Algorithm:APISTRING
Total Signature IDs in Database:4108360
Total Processes Database:48855
Total similar Processes:20168
Total similar Functions:207915

Similar Processes

  • DOC000YUT600.exe (MD5: CD1974C09F7171E19634DE0E00D7EFB7, PID: 3420)
    • DOC000YUT090.exe (PID: 3340, MD5: 68DD38B9F0BBC16EF985BEA78DBFDE51 AnalysisID: 45352 Similar Functions: 8)
    • Po_No_6111875-22.exe (PID: 3652, MD5: 5FF9678FCE561E1942FD09B7FDFA23A1 AnalysisID: 46407 Similar Functions: 8)
    • 71exact replicas of the pictures.scr (PID: 3848, MD5: 2CA36B311F65211EDD9440E953C7824D AnalysisID: 355875 Similar Functions: 6)
    • VTfIxABUKQX.exe (PID: 3360, MD5: E8806738A575A6639E7C9AAC882374AE AnalysisID: 37961 Similar Functions: 6)
    • window-on-top.tmp (PID: 3460, MD5: 90FC739C83CD19766ACB562C66A7D0E2 AnalysisID: 70878 Similar Functions: 6)
    • AnalyticsEdgeBasicInstaller.tmp (PID: 3472, MD5: 832DAB307E54AA08F4B6CDD9B9720361 AnalysisID: 66606 Similar Functions: 6)
    • pdf-to-xml.tmp (PID: 3468, MD5: 2C10DB017057DCE22651243244E4FEE6 AnalysisID: 67877 Similar Functions: 6)
    • VeriCoin_1.7.1_64bit.tmp (PID: 3452, MD5: 832DAB307E54AA08F4B6CDD9B9720361 AnalysisID: 73141 Similar Functions: 6)
    • sevnz.exe (PID: 3472, MD5: E8806738A575A6639E7C9AAC882374AE AnalysisID: 37961 Similar Functions: 6)
    • drivermax_9_14_cnet.tmp (PID: 2648, MD5: AB126F7F9FF2E7902FF2BBDC1A6D3158 AnalysisID: 29247 Similar Functions: 6)
    • hbBX0y0z51.tmp (PID: 3440, MD5: 1305181DE520F125AEABF85DC24A89D6 AnalysisID: 59014 Similar Functions: 6)
    • Processo_MPF_0008837353_2014_9_07_90182798772.exe (PID: 3320, MD5: E1C1EA4A105FBE869EC64AA457C252EB AnalysisID: 31598 Similar Functions: 5)
    • GoogleChromeSetup.MAL.exe (PID: 3456, MD5: 863253EC95D89B918DAAF1FBE154F173 AnalysisID: 60523 Similar Functions: 5)
    • GoogleChromeSetup.MAL.exe (PID: 3640, MD5: 863253EC95D89B918DAAF1FBE154F173 AnalysisID: 60523 Similar Functions: 5)
    • pQwinup.exe (PID: 1660, MD5: B56AA07E5FE953431CA8DE5326D6953D AnalysisID: 32007 Similar Functions: 5)
    • data.exe (PID: 3664, MD5: B56AA07E5FE953431CA8DE5326D6953D AnalysisID: 32007 Similar Functions: 5)
    • maildetective2.tmp (PID: 3292, MD5: E9F663D8D3671AE8761945502120E385 AnalysisID: 43154 Similar Functions: 5)
    • New Purchase Order No.0567.exe (PID: 3452, MD5: 76E104EBA0BB25DA3B345C6F351BAF42 AnalysisID: 64048 Similar Functions: 5)
    • PDFCreator-1_7_0_setup.tmp (PID: 3568, MD5: A2C4D52C66B4B399FACADB8CC8386745 AnalysisID: 46275 Similar Functions: 5)
    • Open OfficeSetup.Exe (PID: 3468, MD5: 03EC92CFA1B6B076ACB82E4E8D49D90C AnalysisID: 53419 Similar Functions: 5)
    • SteamHelper.tmp (PID: 3484, MD5: CD1F291594F75DE800B26457C76B04B0 AnalysisID: 49640 Similar Functions: 5)
    • FPaukxOmd8.tmp (PID: 3332, MD5: 9303156631EE2436DB23827E27337BE4 AnalysisID: 41220 Similar Functions: 5)
    • RFQ-857369 {Draft copy}.exe (PID: 3564, MD5: 028D4FD059E8A0F2F9E8C1635D036E2A AnalysisID: 71697 Similar Functions: 5)
    • WRMNLzRmzr.tmp (PID: 3404, MD5: 832DAB307E54AA08F4B6CDD9B9720361 AnalysisID: 51259 Similar Functions: 5)
    • darkcomet.exe (PID: 3252, MD5: 5A790B57A083A6B0FDDC5BACBBBD95DE AnalysisID: 41363 Similar Functions: 5)
    • SCAN00GOG0900.exe (PID: 3476, MD5: F51025B7377A6E1195B92C43C02AE280 AnalysisID: 48661 Similar Functions: 5)
    • pQwinup.exe (PID: 3776, MD5: B56AA07E5FE953431CA8DE5326D6953D AnalysisID: 32007 Similar Functions: 5)
    • K9tdOxcj76.exe (PID: 3084, MD5: 624023448A39E6EADB9F7722FAE2DCD3 AnalysisID: 38384 Similar Functions: 5)
    • CSmGZuzOw3.tmp (PID: 3664, MD5: D8CA4D5DF2DC54CA72DD9DBDE47BC3BB AnalysisID: 516917 Similar Functions: 5)
    • darkcomet-irixo.exe.exe (PID: 3880, MD5: 4716314D197F0B5485AEA5142842E06C AnalysisID: 58114 Similar Functions: 5)
  • regdrv.exe (MD5: CD1974C09F7171E19634DE0E00D7EFB7, PID: 3452)
    • window-on-top.tmp (PID: 3460, MD5: 90FC739C83CD19766ACB562C66A7D0E2 AnalysisID: 70878 Similar Functions: 6)
    • Hsksdycn.exe (PID: 3092, MD5: EEC006D47C4E68C91A6943F86A58ABBA AnalysisID: 37311 Similar Functions: 4)
    • 58DHL Shipment Doc# 070881019.exe (PID: 3180, MD5: 84F29ADF5A558248B2F8CDD64ACA919C AnalysisID: 38736 Similar Functions: 4)
    • 47PAYMENT.exe (PID: 3108, MD5: 3CF908E5EE436FDF3D2B780400866C7D AnalysisID: 38767 Similar Functions: 4)
    • 37statement of account.exe (PID: 3092, MD5: 151AB14A9FAE18D9DF3E040F213BFA1C AnalysisID: 37467 Similar Functions: 4)
    • 74ASVfdWjgISVfdWjgI.exe (PID: 3112, MD5: DB3C2D77BD50E0CD6B441BCC9DDF0712 AnalysisID: 37665 Similar Functions: 4)
    • 31SIMREG INCENTIVE BREAKDOWN.xlsx.exe (PID: 3252, MD5: 5D34E72A2C6BF15D7003F2942D1F8B63 AnalysisID: 40080 Similar Functions: 4)
    • Agreement_pdf.exe (PID: 3288, MD5: 77D378763AC0444A9F767F446772A479 AnalysisID: 363512 Similar Functions: 4)
    • 17Invoice.exe (PID: 3096, MD5: 0D8926429A27363F3994D09184572666 AnalysisID: 37668 Similar Functions: 4)
    • data.exe (PID: 3284, MD5: 1D8830D54E8E8F210792188C07C5E83A AnalysisID: 46942 Similar Functions: 4)
    • VTfIxABUKQX.exe (PID: 3360, MD5: E8806738A575A6639E7C9AAC882374AE AnalysisID: 37961 Similar Functions: 4)
    • 69NEW DAWN STAFF DRESS.xlsx.exe (PID: 3248, MD5: EAD2C482D0C82A21372F969C61302C31 AnalysisID: 39704 Similar Functions: 4)
    • dYdRqZwo.exe (PID: 3508, MD5: 5D34E72A2C6BF15D7003F2942D1F8B63 AnalysisID: 40080 Similar Functions: 4)
    • 71Payment.jpg............exe (PID: 3092, MD5: 0742CE86C683E9483BDF448B38BF2664 AnalysisID: 38833 Similar Functions: 4)
    • OHyCCfZu.exe (PID: 3436, MD5: 1D8830D54E8E8F210792188C07C5E83A AnalysisID: 46942 Similar Functions: 4)
    • FuVDbcfS.exe (PID: 3380, MD5: D92C4AE32F8DE6EBC6FC4E855E7B66AA AnalysisID: 39246 Similar Functions: 4)
    • XbNQXwEL.exe (PID: 3372, MD5: 1C319E894D3BF7D381D3EAC736FD5502 AnalysisID: 39695 Similar Functions: 4)
    • nVndEfAi.exe (PID: 3600, MD5: DDF37EB620C66DE4AF7017BB5DB95893 AnalysisID: 40506 Similar Functions: 4)
    • 58REMITTANCE COPY_BALANCE PAYMENT.exe (PID: 3264, MD5: 4030BA83FBC48E2F007FAE34829897E9 AnalysisID: 40041 Similar Functions: 4)
    • xPtlWgvn.exe (PID: 3728, MD5: AAD08C4F7D96A5986BA7941AC8336FD3 AnalysisID: 39827 Similar Functions: 4)
    • 36PAYMENT.exe (PID: 3196, MD5: 367A5392D23C0C007DD8E71DBB8B1EE7 AnalysisID: 38663 Similar Functions: 4)
    • vUCGyPcV.exe (PID: 3608, MD5: C0EAF6EBE3AF1A42B8C9911F92714FE4 AnalysisID: 39127 Similar Functions: 4)
    • pQwinup.exe (PID: 1660, MD5: B56AA07E5FE953431CA8DE5326D6953D AnalysisID: 32007 Similar Functions: 4)
    • EwKNSDWB.exe (PID: 3240, MD5: AADEF13F05E9E17B79EC50FB9665593B AnalysisID: 36631 Similar Functions: 4)
    • 69IMG00002.exe (PID: 3276, MD5: BFB80626BE700A621CABDFF267B6ED2E AnalysisID: 41839 Similar Functions: 4)
    • 38Payment.exe (PID: 3272, MD5: ABDD63CC62905D29A7D3D42AD83688CF AnalysisID: 38217 Similar Functions: 4)
    • 13MTN TP November airtime performance Bonus.pdf.exe (PID: 3384, MD5: C0EAF6EBE3AF1A42B8C9911F92714FE4 AnalysisID: 39127 Similar Functions: 4)
    • data.exe (PID: 3664, MD5: B56AA07E5FE953431CA8DE5326D6953D AnalysisID: 32007 Similar Functions: 4)
    • RAZBvEJG.exe (PID: 3524, MD5: 38F778B7F5D646D294E9ACC754648AAA AnalysisID: 36867 Similar Functions: 4)
    • fggCPClP.exe (PID: 3472, MD5: 4DE78F999AE56C63667C37E912DA7310 AnalysisID: 39823 Similar Functions: 4)
  • regdrv.exe (MD5: CD1974C09F7171E19634DE0E00D7EFB7, PID: 3468)
    • SCAN00GOG0900.exe (PID: 3476, MD5: F51025B7377A6E1195B92C43C02AE280 AnalysisID: 48661 Similar Functions: 232)
    • darkcomet-irixo.exe.exe (PID: 3880, MD5: 4716314D197F0B5485AEA5142842E06C AnalysisID: 58114 Similar Functions: 232)
    • IMG-FILE-093298393840933-09208438039039-023outputA4DB4EF.exe (PID: 3476, MD5: 88E0BC064945FA01C3B2745AC3633836 AnalysisID: 69994 Similar Functions: 229)
    • test.exe.exe (PID: 3260, MD5: 0D5A48D9FDC26E038BAF3D507CAF4DD5 AnalysisID: 40573 Similar Functions: 228)
    • neh.exe (PID: 3428, MD5: 264D0D08069B26210AD2261C1E37CCF2 AnalysisID: 40545 Similar Functions: 228)
    • New Purchase Order No.0567.exe (PID: 3452, MD5: 76E104EBA0BB25DA3B345C6F351BAF42 AnalysisID: 64048 Similar Functions: 226)
    • darkcomet.exe (PID: 3252, MD5: 5A790B57A083A6B0FDDC5BACBBBD95DE AnalysisID: 41363 Similar Functions: 226)
    • darkcomet-irixo-final.exe (PID: 3432, MD5: 34960F869AA933675A70C0C7C17ADDFE AnalysisID: 58113 Similar Functions: 224)
    • hmGCd1FvDh.exe (PID: 3072, MD5: 87265F45CFC51559590AF14E011970C2 AnalysisID: 39043 Similar Functions: 199)
    • 3Y8FRVDR9S.exe (PID: 3176, MD5: 7A4414974509912787972A84BF88FD4F AnalysisID: 39044 Similar Functions: 199)
    • k0uVX1KM6P.exe (PID: 3272, MD5: 77093B72A28802C0D03D46469FCBE972 AnalysisID: 39047 Similar Functions: 199)
    • G8Yxrw4J7t.exe (PID: 3344, MD5: 1F09E66A3F0B82E5A8BA7BB412D30975 AnalysisID: 39275 Similar Functions: 199)
    • window-on-top.tmp (PID: 3460, MD5: 90FC739C83CD19766ACB562C66A7D0E2 AnalysisID: 70878 Similar Functions: 182)
    • msdcsc.exe (PID: 3700, MD5: 264D0D08069B26210AD2261C1E37CCF2 AnalysisID: 40545 Similar Functions: 179)
    • msdcsc.exe (PID: 3316, MD5: 0D5A48D9FDC26E038BAF3D507CAF4DD5 AnalysisID: 40573 Similar Functions: 164)
    • svchost.exe (PID: 2892, MD5: 54A47F6B5E09A77E61649109C6A08866 AnalysisID: 24621 Similar Functions: 164)
    • Microupdate.exe (PID: 3400, MD5: 8C5984AB2114A0C70FB9209E89B2F9FC AnalysisID: 64772 Similar Functions: 145)
    • filename.exe (PID: 2488, MD5: 71790AE818639A05CAE4A4C3118682CD AnalysisID: 313125 Similar Functions: 128)
    • Filezilla.exe (PID: 2400, MD5: 1B9793452B165AC33B7E01430F3079E0 AnalysisID: 401368 Similar Functions: 124)
    • Filezilla.exe (PID: 2976, MD5: 1B9793452B165AC33B7E01430F3079E0 AnalysisID: 401368 Similar Functions: 124)
    • ABsound.exe (PID: 3712, MD5: F51025B7377A6E1195B92C43C02AE280 AnalysisID: 48661 Similar Functions: 118)
    • 71Docscan0039.exe (PID: 2068, MD5: F6255387376BF9BEF2E38AA57BEA40CE AnalysisID: 387104 Similar Functions: 117)
    • 92jfaENDBG.tmp (PID: 3232, MD5: B0DC55919303896D21E61FB59FE2B92F AnalysisID: 46535 Similar Functions: 117)
    • Filezilla.exe (PID: 236, MD5: 1B9793452B165AC33B7E01430F3079E0 AnalysisID: 401368 Similar Functions: 114)
    • Filezilla.exe (PID: 3516, MD5: FCE1F1C1BCFD0A5A0C5138D93F919A21 AnalysisID: 39749 Similar Functions: 113)
    • filename.exe (PID: 3224, MD5: 2691D4452E303259FE5D1444FE7036BB AnalysisID: 36765 Similar Functions: 112)
    • 1transfer slip.exe (PID: 3148, MD5: E919BD0AECE34CD73FBF198F87531C53 AnalysisID: 42767 Similar Functions: 112)
    • filename.exe (PID: 3236, MD5: A70C54007E0A0936339D0641198A6FF5 AnalysisID: 36662 Similar Functions: 112)
    • 17WIRE TRANSFER SLIP.exe (PID: 3920, MD5: 3BB691A8B6840769716C7FE316E7C01C AnalysisID: 331351 Similar Functions: 111)
    • 17WIRE TRANSFER SLIP.exe (PID: 2820, MD5: 3BB691A8B6840769716C7FE316E7C01C AnalysisID: 331351 Similar Functions: 110)
  • Regdriver.exe (MD5: CD1974C09F7171E19634DE0E00D7EFB7, PID: 3484)
    • 66DHL SHIPMENT INFO.exe (PID: 2524, MD5: C125E5E8896E9043E08493B49C31C0D9 AnalysisID: 389120 Similar Functions: 9)
    • DOC000YUT090.exe (PID: 3340, MD5: 68DD38B9F0BBC16EF985BEA78DBFDE51 AnalysisID: 45352 Similar Functions: 7)
    • Po_No_6111875-22.exe (PID: 3652, MD5: 5FF9678FCE561E1942FD09B7FDFA23A1 AnalysisID: 46407 Similar Functions: 7)
    • VTfIxABUKQX.exe (PID: 3360, MD5: E8806738A575A6639E7C9AAC882374AE AnalysisID: 37961 Similar Functions: 6)
    • window-on-top.tmp (PID: 3460, MD5: 90FC739C83CD19766ACB562C66A7D0E2 AnalysisID: 70878 Similar Functions: 6)
    • sevnz.exe (PID: 3472, MD5: E8806738A575A6639E7C9AAC882374AE AnalysisID: 37961 Similar Functions: 6)
    • Processo_MPF_0008837353_2014_9_07_90182798772.exe (PID: 3320, MD5: E1C1EA4A105FBE869EC64AA457C252EB AnalysisID: 31598 Similar Functions: 5)
    • 71exact replicas of the pictures.scr (PID: 3848, MD5: 2CA36B311F65211EDD9440E953C7824D AnalysisID: 355875 Similar Functions: 5)
    • pQwinup.exe (PID: 1660, MD5: B56AA07E5FE953431CA8DE5326D6953D AnalysisID: 32007 Similar Functions: 5)
    • data.exe (PID: 3664, MD5: B56AA07E5FE953431CA8DE5326D6953D AnalysisID: 32007 Similar Functions: 5)
    • New Purchase Order No.0567.exe (PID: 3452, MD5: 76E104EBA0BB25DA3B345C6F351BAF42 AnalysisID: 64048 Similar Functions: 5)
    • RFQ-857369 {Draft copy}.exe (PID: 3564, MD5: 028D4FD059E8A0F2F9E8C1635D036E2A AnalysisID: 71697 Similar Functions: 5)
    • darkcomet.exe (PID: 3252, MD5: 5A790B57A083A6B0FDDC5BACBBBD95DE AnalysisID: 41363 Similar Functions: 5)
    • SCAN00GOG0900.exe (PID: 3476, MD5: F51025B7377A6E1195B92C43C02AE280 AnalysisID: 48661 Similar Functions: 5)
    • pQwinup.exe (PID: 3776, MD5: B56AA07E5FE953431CA8DE5326D6953D AnalysisID: 32007 Similar Functions: 5)
    • drivermax_9_14_cnet.tmp (PID: 2648, MD5: AB126F7F9FF2E7902FF2BBDC1A6D3158 AnalysisID: 29247 Similar Functions: 5)
    • K9tdOxcj76.exe (PID: 3084, MD5: 624023448A39E6EADB9F7722FAE2DCD3 AnalysisID: 38384 Similar Functions: 5)
    • darkcomet-irixo.exe.exe (PID: 3880, MD5: 4716314D197F0B5485AEA5142842E06C AnalysisID: 58114 Similar Functions: 5)
    • yBLTd2qfZO.exe (PID: 3440, MD5: 03BB99E62C4CD6C4432DCA32DE043957 AnalysisID: 54872 Similar Functions: 4)
    • Hsksdycn.exe (PID: 3092, MD5: EEC006D47C4E68C91A6943F86A58ABBA AnalysisID: 37311 Similar Functions: 4)
    • Paint.exe (PID: 3360, MD5: EC2ECFF8B5F270506F95A5153AEEC6F8 AnalysisID: 46203 Similar Functions: 4)
    • 58DHL Shipment Doc# 070881019.exe (PID: 3180, MD5: 84F29ADF5A558248B2F8CDD64ACA919C AnalysisID: 38736 Similar Functions: 4)
    • 47PAYMENT.exe (PID: 3108, MD5: 3CF908E5EE436FDF3D2B780400866C7D AnalysisID: 38767 Similar Functions: 4)
    • Paint.exe (PID: 3768, MD5: D02D11222196B056FAC8A02EEB6BFAFF AnalysisID: 48244 Similar Functions: 4)
    • 46INSTRUCTIONS TO BIDDERS AND ACKNOWLEDGEMENT.PDF.exe (PID: 3040, MD5: 0DB348AF300B367E15F896ADB41BDF6F AnalysisID: 349956 Similar Functions: 4)
    • rnicrosoft.exe (PID: 3360, MD5: 03650E61AE4CD9D316DC59A0EB1E1BBA AnalysisID: 37144 Similar Functions: 4)
    • 37statement of account.exe (PID: 3092, MD5: 151AB14A9FAE18D9DF3E040F213BFA1C AnalysisID: 37467 Similar Functions: 4)
    • 49Bank copy 17-11-2017.exe (PID: 3284, MD5: 0E14513130F478BACF44E074A526AE21 AnalysisID: 37438 Similar Functions: 4)
    • taskhost.exe (PID: 3832, MD5: 5C4A18D1A9A77B3A2A334D673713DCDF AnalysisID: 293437 Similar Functions: 4)
    • 74ASVfdWjgISVfdWjgI.exe (PID: 3112, MD5: DB3C2D77BD50E0CD6B441BCC9DDF0712 AnalysisID: 37665 Similar Functions: 4)
  • regdrv.exe (MD5: CD1974C09F7171E19634DE0E00D7EFB7, PID: 3532)
    • window-on-top.tmp (PID: 3460, MD5: 90FC739C83CD19766ACB562C66A7D0E2 AnalysisID: 70878 Similar Functions: 6)
    • Hsksdycn.exe (PID: 3092, MD5: EEC006D47C4E68C91A6943F86A58ABBA AnalysisID: 37311 Similar Functions: 4)
    • 58DHL Shipment Doc# 070881019.exe (PID: 3180, MD5: 84F29ADF5A558248B2F8CDD64ACA919C AnalysisID: 38736 Similar Functions: 4)
    • 47PAYMENT.exe (PID: 3108, MD5: 3CF908E5EE436FDF3D2B780400866C7D AnalysisID: 38767 Similar Functions: 4)
    • 37statement of account.exe (PID: 3092, MD5: 151AB14A9FAE18D9DF3E040F213BFA1C AnalysisID: 37467 Similar Functions: 4)
    • 74ASVfdWjgISVfdWjgI.exe (PID: 3112, MD5: DB3C2D77BD50E0CD6B441BCC9DDF0712 AnalysisID: 37665 Similar Functions: 4)
    • 31SIMREG INCENTIVE BREAKDOWN.xlsx.exe (PID: 3252, MD5: 5D34E72A2C6BF15D7003F2942D1F8B63 AnalysisID: 40080 Similar Functions: 4)
    • Agreement_pdf.exe (PID: 3288, MD5: 77D378763AC0444A9F767F446772A479 AnalysisID: 363512 Similar Functions: 4)
    • 17Invoice.exe (PID: 3096, MD5: 0D8926429A27363F3994D09184572666 AnalysisID: 37668 Similar Functions: 4)
    • data.exe (PID: 3284, MD5: 1D8830D54E8E8F210792188C07C5E83A AnalysisID: 46942 Similar Functions: 4)
    • VTfIxABUKQX.exe (PID: 3360, MD5: E8806738A575A6639E7C9AAC882374AE AnalysisID: 37961 Similar Functions: 4)
    • 69NEW DAWN STAFF DRESS.xlsx.exe (PID: 3248, MD5: EAD2C482D0C82A21372F969C61302C31 AnalysisID: 39704 Similar Functions: 4)
    • dYdRqZwo.exe (PID: 3508, MD5: 5D34E72A2C6BF15D7003F2942D1F8B63 AnalysisID: 40080 Similar Functions: 4)
    • 71Payment.jpg............exe (PID: 3092, MD5: 0742CE86C683E9483BDF448B38BF2664 AnalysisID: 38833 Similar Functions: 4)
    • OHyCCfZu.exe (PID: 3436, MD5: 1D8830D54E8E8F210792188C07C5E83A AnalysisID: 46942 Similar Functions: 4)
    • FuVDbcfS.exe (PID: 3380, MD5: D92C4AE32F8DE6EBC6FC4E855E7B66AA AnalysisID: 39246 Similar Functions: 4)
    • XbNQXwEL.exe (PID: 3372, MD5: 1C319E894D3BF7D381D3EAC736FD5502 AnalysisID: 39695 Similar Functions: 4)
    • nVndEfAi.exe (PID: 3600, MD5: DDF37EB620C66DE4AF7017BB5DB95893 AnalysisID: 40506 Similar Functions: 4)
    • 58REMITTANCE COPY_BALANCE PAYMENT.exe (PID: 3264, MD5: 4030BA83FBC48E2F007FAE34829897E9 AnalysisID: 40041 Similar Functions: 4)
    • xPtlWgvn.exe (PID: 3728, MD5: AAD08C4F7D96A5986BA7941AC8336FD3 AnalysisID: 39827 Similar Functions: 4)
    • 36PAYMENT.exe (PID: 3196, MD5: 367A5392D23C0C007DD8E71DBB8B1EE7 AnalysisID: 38663 Similar Functions: 4)
    • vUCGyPcV.exe (PID: 3608, MD5: C0EAF6EBE3AF1A42B8C9911F92714FE4 AnalysisID: 39127 Similar Functions: 4)
    • pQwinup.exe (PID: 1660, MD5: B56AA07E5FE953431CA8DE5326D6953D AnalysisID: 32007 Similar Functions: 4)
    • EwKNSDWB.exe (PID: 3240, MD5: AADEF13F05E9E17B79EC50FB9665593B AnalysisID: 36631 Similar Functions: 4)
    • 69IMG00002.exe (PID: 3276, MD5: BFB80626BE700A621CABDFF267B6ED2E AnalysisID: 41839 Similar Functions: 4)
    • 38Payment.exe (PID: 3272, MD5: ABDD63CC62905D29A7D3D42AD83688CF AnalysisID: 38217 Similar Functions: 4)
    • 13MTN TP November airtime performance Bonus.pdf.exe (PID: 3384, MD5: C0EAF6EBE3AF1A42B8C9911F92714FE4 AnalysisID: 39127 Similar Functions: 4)
    • data.exe (PID: 3664, MD5: B56AA07E5FE953431CA8DE5326D6953D AnalysisID: 32007 Similar Functions: 4)
    • RAZBvEJG.exe (PID: 3524, MD5: 38F778B7F5D646D294E9ACC754648AAA AnalysisID: 36867 Similar Functions: 4)
    • fggCPClP.exe (PID: 3472, MD5: 4DE78F999AE56C63667C37E912DA7310 AnalysisID: 39823 Similar Functions: 4)

Similar Functions

  • Function_0004E254 API ID: GetCurrentProcessIdGetPropGetWindowThreadProcessIdGlobalFindAtom, String ID: , Total Matches: 5751
  • Function_0004D2F4 API ID: GetCurrentProcessIdGetPropGetWindowThreadProcessIdGlobalFindAtom, String ID: , Total Matches: 5751
  • Function_0001C2D4 API ID: FindResourceLoadResourceLockResourceSizeofResource, String ID: , Total Matches: 4966
  • Function_0000EBCC API ID: GetThreadLocale, String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy, Total Matches: 3634
  • Function_0000D670 API ID: GetThreadLocale, String ID: eeee$ggg$yyyy, Total Matches: 3566
  • Function_00026564 API ID: GetDeviceCapsGetSystemMetrics$GetDCReleaseDC, String ID: , Total Matches: 3298
  • Function_000258EC API ID: SetBkColorSetBkMode$SelectObjectUnrealizeObject, String ID: , Total Matches: 3205
  • Function_0004155C API ID: DeleteMenu$EnableMenuItem$GetSystemMenu, String ID: , Total Matches: 3192
  • Function_0000FECC API ID: SafeArrayGetLBoundSafeArrayGetUBoundSafeArrayPtrOfIndexVariantClear, String ID: , Total Matches: 3189
  • Function_0000FECC API ID: SafeArrayGetLBoundSafeArrayGetUBoundSafeArrayPtrOfIndexVariantClear, String ID: , Total Matches: 3189
  • Function_00011444 API ID: SafeArrayGetLBoundSafeArrayGetUBoundSafeArrayPtrOfIndexVariantClear, String ID: , Total Matches: 3189
  • Function_0000FECC API ID: SafeArrayGetLBoundSafeArrayGetUBoundSafeArrayPtrOfIndexVariantClear, String ID: , Total Matches: 3189
  • Function_0000FECC API ID: SafeArrayGetLBoundSafeArrayGetUBoundSafeArrayPtrOfIndexVariantClear, String ID: , Total Matches: 3189
  • Function_0001016C API ID: SafeArrayPtrOfIndex$SafeArrayCreateSafeArrayGetLBoundSafeArrayGetUBoundVariantCopy, String ID: , Total Matches: 3182
  • Function_0001016C API ID: SafeArrayPtrOfIndex$SafeArrayCreateSafeArrayGetLBoundSafeArrayGetUBoundVariantCopy, String ID: , Total Matches: 3182
  • Function_000117E8 API ID: SafeArrayPtrOfIndex$SafeArrayCreateSafeArrayGetLBoundSafeArrayGetUBoundVariantCopy, String ID: , Total Matches: 3182
  • Function_0001016C API ID: SafeArrayPtrOfIndex$SafeArrayCreateSafeArrayGetLBoundSafeArrayGetUBoundVariantCopy, String ID: , Total Matches: 3182
  • Function_0001016C API ID: SafeArrayPtrOfIndex$SafeArrayCreateSafeArrayGetLBoundSafeArrayGetUBoundVariantCopy, String ID: , Total Matches: 3182
  • Function_000442A8 API ID: SendMessage$GetCurrentThreadIdGetCursorPosGetWindowThreadProcessIdSetCursorWindowFromPoint, String ID: , Total Matches: 3149
  • Function_000104F0 API ID: GetModuleHandle, String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$[FILE], Total Matches: 3143
  • Function_0000F4AC API ID: GetModuleHandleGetProcAddress, String ID: GetDiskFreeSpaceExA$[FILE], Total Matches: 3137
  • Function_0002E258 API ID: GetSystemMetrics, String ID: GetSystemMetrics, Total Matches: 3131
  • Function_000269DC API ID: SelectPalette$CreateCompatibleDCDeleteDCGetDIBitsRealizePalette, String ID: , Total Matches: 3081
  • Function_00026060 API ID: GetSystemPaletteEntries$GetDCGetDeviceCapsReleaseDC, String ID: , Total Matches: 3072
  • Function_000052FC API ID: GetStdHandleWriteFile$MessageBox, String ID: Error$Runtime error at 00000000, Total Matches: 3072
  • Function_00026178 API ID: GetPaletteEntries$GetDCGetDeviceCapsReleaseDC, String ID: , Total Matches: 3070
  • Function_00026210 API ID: SelectObject$CreateCompatibleDCCreatePaletteDeleteDCGetDIBColorTable, String ID: , Total Matches: 3064
  • Function_000291D0 API ID: SelectObject$CreateCompatibleDCDeleteDCRealizePaletteSelectPaletteSetBkColor$BitBltCreateBitmapDeleteObjectGetDCGetObjectPatBltReleaseDC, String ID: , Total Matches: 3060
  • Function_00028A00 API ID: SelectObject$CreateCompatibleDCDeleteDCGetDCReleaseDCSetDIBColorTable, String ID: , Total Matches: 3056
  • Function_00051458 API ID: PatBlt$SelectObject$GetDCExGetDesktopWindowReleaseDC, String ID: , Total Matches: 3040
  • Function_00038710 API ID: GetMenuItemIDGetMenuStateGetMenuStringGetSubMenu, String ID: , Total Matches: 3034
  • Function_0000C028 API ID: GetDateFormatGetThreadLocale, String ID: yyyy, Total Matches: 3032
  • Function_00056278 API ID: GetWindowLong$IntersectClipRectRestoreDCSaveDC, String ID: , Total Matches: 3025
  • Function_00058910 API ID: GetWindowLongScreenToClient$GetWindowPlacementGetWindowRectIsIconic, String ID: ,, Total Matches: 3020
  • Function_00043430 API ID: SetWindowLong$GetWindowLongRedrawWindowSetLayeredWindowAttributes, String ID: , Total Matches: 3003
  • Function_0002E71C API ID: IntersectRect$GetSystemMetrics$EnumDisplayMonitorsGetClipBoxGetDCOrgExOffsetRect, String ID: EnumDisplayMonitors, Total Matches: 2989
  • Function_00044B1C API ID: CreateEventCreateThreadGetCurrentThreadIdSetWindowsHookEx, String ID: , Total Matches: 2966
  • Function_000296E0 API ID: GetDeviceCapsSelectObjectSelectPaletteSetStretchBltMode$CreateCompatibleDCDeleteDCGetBrushOrgExRealizePaletteSetBrushOrgExStretchBlt, String ID: , Total Matches: 2962
  • Function_00044B90 API ID: CloseHandleGetCurrentThreadIdSetEventUnhookWindowsHookExWaitForSingleObject, String ID: , Total Matches: 2957
  • Function_00006A68 API ID: lstrcpyn$lstrlen$FindCloseFindFirstFileGetModuleHandleGetProcAddress, String ID: GetLongPathNameA$\$[FILE], Total Matches: 2934
  • Function_00028848 API ID: CreateCompatibleDCRealizePaletteSelectObjectSelectPalette, String ID: , Total Matches: 2913
  • Function_00006C2C API ID: lstrcpyn$LoadLibraryExRegOpenKeyEx$RegQueryValueEx$GetLocaleInfoGetModuleFileNameGetThreadLocaleRegCloseKeylstrlen, String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales, Total Matches: 2899
  • Function_0003EC18 API ID: FillRect$BeginPaintEndPaintGetClientRectGetWindowRect, String ID: , Total Matches: 2896
  • Function_00044344 API ID: CreateFontIndirect$GetStockObjectSystemParametersInfo, String ID: , Total Matches: 2886
  • Function_00021140 API ID: GetClassInfoRegisterClassSetWindowLongUnregisterClass, String ID: , Total Matches: 2877
  • Function_00066888 API ID: GetClassInfoRegisterClassSetWindowLongUnregisterClass, String ID: , Total Matches: 2877
  • Function_00034AE4 API ID: DrawTextOffsetRect$DrawEdge, String ID: , Total Matches: 2874
  • Function_0002E4A0 API ID: GetSystemMetrics$GetMonitorInfoSystemParametersInfolstrcpy, String ID: DISPLAY$GetMonitorInfo, Total Matches: 2853
  • Function_00006D38 API ID: lstrcpyn$LoadLibraryEx$GetLocaleInfoGetThreadLocalelstrlen, String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales, Total Matches: 2843
  • Function_00045334 API ID: EnumWindowsGetWindowGetWindowLongSetWindowPos, String ID: , Total Matches: 2678
  • Function_000328FC API ID: GetSystemMetricsGetWindowLong$ExcludeClipRectFillRectGetSysColorBrushGetWindowDCGetWindowRectInflateRectOffsetRectReleaseDC, String ID: , Total Matches: 2670
  • Function_00034550 API ID: InsertMenu$GetVersionInsertMenuItem, String ID: ,$?, Total Matches: 2669
  • Function_0002F204 API ID: GetProcAddress$LoadLibrary, String ID: CloseThemeData$DrawThemeBackground$DrawThemeEdge$DrawThemeIcon$DrawThemeParentBackground$DrawThemeText$EnableThemeDialogTexture$EnableTheming$GetCurrentThemeName$GetThemeAppProperties$GetThemeBackgroundContentRect$GetThemeBackgroundRegion$GetThemeBool$GetThemeColor$GetThemeDocumentationProperty$GetThemeEnumValue$GetThemeFilename$GetThemeFont$GetThemeInt$GetThemeIntList$GetThemeMargins$GetThemeMetric$GetThemePartSize$GetThemePosition$GetThemePropertyOrigin$GetThemeRect$GetThemeString$GetThemeSysBool$GetThemeSysColor$GetThemeSysColorBrush$GetThemeSysFont$GetThemeSysInt$GetThemeSysSize$GetThemeSysString$GetThemeTextExtent$GetThemeTextMetrics$GetWindowTheme$HitTestThemeBackground$IsAppThemed$IsThemeActive$IsThemeBackgroundPartiallyTransparent$IsThemeDialogTextureEnabled$IsThemePartDefined$OpenThemeData$SetThemeAppProperties$SetWindowTheme$[FILE], Total Matches: 2590
  • Function_0000D8AA API ID: GetModuleFileName$LoadStringVirtualQuery, String ID: , Total Matches: 2563
  • Function_0000D8AC API ID: GetModuleFileName$LoadStringVirtualQuery, String ID: , Total Matches: 2563
  • Function_00034924 API ID: GetMenuItemCount$DestroyMenuGetMenuStateRemoveMenu, String ID: , Total Matches: 2509
  • Function_00042C9C API ID: SendMessage$GetActiveWindowGetCapture$ReleaseCapture, String ID: , Total Matches: 2310
  • Function_0002E408 API ID: GetSystemMetrics, String ID: MonitorFromPoint, Total Matches: 2190
  • Function_000389B4 API ID: RestoreDCSaveDC$DefWindowProcGetSubMenuGetWindowDC, String ID: , Total Matches: 2150
  • Function_00028B08 API ID: SelectObject$SelectPalette$CreateCompatibleDCGetDIBitsGetDeviceCapsRealizePaletteSetBkColorSetTextColor$BitBltCreateBitmapCreateCompatibleBitmapCreateDIBSectionDeleteDCFillRectGetDCGetDIBColorTableGetObjectPatBltSetDIBColorTable, String ID: , Total Matches: 1987
  • Function_000282D0 API ID: GetWinMetaFileBitsMulDiv$GetDC, String ID: `, Total Matches: 1938
  • Function_0003804C API ID: DrawMenuBarGetMenuItemInfoSetMenuItemInfo, String ID: P, Total Matches: 1778
  • Function_00054934 API ID: GetWindowLong$GetClassInfoRegisterClassSetWindowLongUnregisterClass, String ID: @, Total Matches: 1764
  • Function_0005D6E8 API ID: GetProcAddress$SetErrorMode$GetModuleHandleLoadLibrary, String ID: ImmGetCompositionStringA$ImmGetContext$ImmGetConversionStatus$ImmIsIME$ImmNotifyIME$ImmReleaseContext$ImmSetCompositionFontA$ImmSetCompositionWindow$ImmSetConversionStatus$ImmSetOpenStatus$USER32$WINNLSEnableIME$[FILE], Total Matches: 1532
  • Function_00004BBF API ID: SetFilePointer$CloseHandleCreateFileGetFileSizeGetFileTypeGetLastErrorGetStdHandleReadFileSetEndOfFile, String ID: , Total Matches: 908
  • Function_000035C4 API ID: SetFilePointer$CloseHandleCreateFileGetFileSizeGetFileTypeGetLastErrorGetStdHandleReadFileSetEndOfFile, String ID: , Total Matches: 908
  • Function_000043BF API ID: SetFilePointer$CloseHandleCreateFileGetFileSizeGetFileTypeGetLastErrorGetStdHandleReadFileSetEndOfFile, String ID: , Total Matches: 908
  • Function_00028418 API ID: CopyEnhMetaFileGetClipboardDataGetEnhMetaFileHeader, String ID: , Total Matches: 804
  • Function_0002B438 API ID: GetDCGetTextMetricsReleaseDCSelectObject, String ID: , Total Matches: 789
  • Function_0005F5F8 API ID: CloseHandle$CreateFileCreateFileMappingGetFileSizeMapViewOfFileUnmapViewOfFile, String ID: , Total Matches: 462
  • Function_00006BE0 API ID: GetSystemDefaultLCID, String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy, Total Matches: 412
  • Function_000063E0 API ID: GetSystemDefaultLCID, String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy, Total Matches: 412
  • Function_00046524 API ID: PeekMessage$DispatchMessage$IsWindowUnicodeTranslateMessage, String ID: , Total Matches: 329
  • Function_00004E2A API ID: ExitProcessMessageBox, String ID: Error$Runtime error at 00000000, Total Matches: 311
  • Function_0004D1B0 API ID: GetWindowLongSetWindowLong$SetProp$IsWindowUnicode, String ID: , Total Matches: 309
  • Function_00060AC0 API ID: GetProcAddress$GetModuleHandle, String ID: CreateToolhelp32Snapshot$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Module32First$Module32FirstW$Module32Next$Module32NextW$Process32First$Process32FirstW$Process32Next$Process32NextW$Thread32First$Thread32Next$Toolhelp32ReadProcessMemory$[FILE], Total Matches: 300
  • Function_000462F4 API ID: SendMessage$GetWindowThreadProcessId$GetCaptureGetParentIsWindowUnicode, String ID: , Total Matches: 293
  • Function_0002B47C API ID: MulDiv, String ID: MS Shell Dlg 2$SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes$Tahoma, Total Matches: 283
  • Function_0002A930 API ID: CreateHalftonePaletteDeleteObjectGetDCReleaseDC, String ID: (, Total Matches: 272
  • Function_00005E44 API ID: FileTimeToDosDateTimeFileTimeToLocalFileTimeFindNextFileGetLastError, String ID: , Total Matches: 271
  • Function_0000A404 API ID: FileTimeToDosDateTimeFileTimeToLocalFileTimeFindNextFileGetLastError, String ID: , Total Matches: 271
  • Function_00005644 API ID: FileTimeToDosDateTimeFileTimeToLocalFileTimeFindNextFileGetLastError, String ID: , Total Matches: 271
  • Function_000085D4 API ID: RegisterWindowMessage$SendMessage$FindWindow, String ID: MSH_SCROLL_LINES_MSG$MSH_WHEELSUPPORT_MSG$MSWHEEL_ROLLMSG$Magellan MSWHEEL$MouseZ, Total Matches: 268
  • Function_0003B7D8 API ID: ShowWindow$SetWindowLong$GetWindowLongIsIconicIsWindowVisible, String ID: , Total Matches: 256
  • Function_00046834 API ID: SetWindowPos$GetWindowRectMessageBoxSetActiveWindow, String ID: (, Total Matches: 241
  • Function_000455EC API ID: ShowOwnedPopupsShowWindow$EnumWindows, String ID: , Total Matches: 230
  • Function_00045518 API ID: GetCurrentProcessIdGetWindowGetWindowThreadProcessIdIsWindowVisible, String ID: , Total Matches: 218
  • Function_0002B29C API ID: DeleteObject$GetIconInfoGetObject, String ID: , Total Matches: 214
  • Function_0002EB3C API ID: DispatchMessageMsgWaitForMultipleObjectsExPeekMessageTranslateMessageWaitForMultipleObjectsEx, String ID: , Total Matches: 211
  • Function_00002820 API ID: MessageBox, String ID: $ bytes: $7$An unexpected memory leak has occurred. $String$The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak$Unknown, Total Matches: 200
  • Function_0002EA7C API ID: FindWindowExGetCurrentThreadIdGetWindowThreadProcessIdIsWindow, String ID: OleMainThreadWndClass, Total Matches: 198
  • Function_00041160 API ID: ExcludeClipRectFillRectGetStockObjectRestoreDCSaveDCSetBkColor, String ID: , Total Matches: 196
  • Function_000564D0 API ID: SelectObject$BeginPaintBitBltCreateCompatibleBitmapCreateCompatibleDCSetWindowOrgEx, String ID: , Total Matches: 190
  • Function_0000281E API ID: MessageBox, String ID: $ bytes: $7$An unexpected memory leak has occurred. $The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak, Total Matches: 190
  • Function_000031FC API ID: CharNext, String ID: $ $ $"$"$"$"$"$", Total Matches: 169
  • Function_00046070 API ID: DefWindowProcIsWindowEnabledSetActiveWindowSetFocusSetWindowPosShowWindow, String ID: , Total Matches: 165
  • Function_000458CC API ID: SetFocus$GetFocusIsWindowEnabledPostMessage$GetLastActivePopupIsWindowVisibleSendMessage, String ID: , Total Matches: 159
  • Function_0008DDE0 API ID: FindResourceFreeResourceLoadResourceLockResourceSizeofResource, String ID: , Total Matches: 153
  • Function_0003F2B8 API ID: GetWindowLongSendMessageSetWindowLong$GetClassLongGetSystemMenuSetClassLongSetWindowPos, String ID: , Total Matches: 142
  • Function_00082028 API ID: DispatchMessageGetMessageTranslateMessage, String ID: , Total Matches: 124
  • Function_0008AEA8 API ID: AdjustTokenPrivilegesCloseHandleGetCurrentProcessGetLastErrorLookupPrivilegeValueOpenProcessToken, String ID: , Total Matches: 122
  • Function_0003F914 API ID: SetMenu$GetMenuSetWindowPos, String ID: , Total Matches: 113
  • Function_0002473C API ID: CompareStringCreateFontIndirect, String ID: Default, Total Matches: 108
  • Function_0003E644 API ID: RestoreDCSaveDC$GetParentGetWindowDCSetFocus, String ID: , Total Matches: 105
  • Function_000715B0 API ID: CloseServiceHandle$DeleteServiceOpenSCManagerOpenService, String ID: , Total Matches: 102
  • Function_0005944C API ID: OffsetRect$MapWindowPoints$DrawEdgeExcludeClipRectFillRectGetClientRectGetRgnBoxGetWindowDCGetWindowLongGetWindowRectInflateRectIntersectClipRectIntersectRectReleaseDC, String ID: , Total Matches: 99
  • Function_000658F4 API ID: VirtualFreeVirtualProtect, String ID: FinalizeSections: VirtualProtect failed, Total Matches: 91
  • Function_0008A070 API ID: AdjustTokenPrivilegesExitWindowsExGetCurrentProcessLookupPrivilegeValueOpenProcessToken, String ID: SeShutdownPrivilege, Total Matches: 81
  • Function_00060DDC API ID: GetProcAddress$LoadLibrary, String ID: EmptyWorkingSet$EnumDeviceDrivers$EnumProcessModules$EnumProcesses$GetDeviceDriverBaseNameA$GetDeviceDriverBaseNameW$GetDeviceDriverFileNameA$GetDeviceDriverFileNameW$GetMappedFileNameA$GetMappedFileNameW$GetModuleBaseNameA$GetModuleBaseNameW$GetModuleFileNameExA$GetModuleFileNameExW$GetModuleInformation$GetProcessMemoryInfo$InitializeProcessForWsWatch$[FILE]$QueryWorkingSet, Total Matches: 77
  • Function_00042280 API ID: ShowWindow$SendMessageSetWindowPos$CallWindowProcGetActiveWindowSetActiveWindow, String ID: , Total Matches: 76
  • Function_000606CC API ID: gethostbynameinet_addr, String ID: %d.%d.%d.%d$0.0.0.0, Total Matches: 75
  • Function_00066038 API ID: FreeLibraryGetProcessHeapHeapFreeVirtualFree, String ID: , Total Matches: 74
  • Function_00065598 API ID: GetProcAddress$IsBadReadPtrLoadLibrary, String ID: BuildImportTable: GetProcAddress failed$BuildImportTable: ReallocMemory failed$BuildImportTable: can't load library: , Total Matches: 72
  • Function_000714B8 API ID: CloseServiceHandle$ControlServiceOpenSCManagerOpenServiceQueryServiceStatusStartService, String ID: , Total Matches: 71
  • Function_00065A0C API ID: VirtualAlloc$GetProcessHeapHeapAlloc, String ID: BTMemoryLoadLibary: BuildImportTable failed$BTMemoryLoadLibary: Can't attach library$BTMemoryLoadLibary: Get DLLEntyPoint failed$BTMemoryLoadLibary: IMAGE_NT_SIGNATURE is not valid$BTMemoryLoadLibary: VirtualAlloc failed$BTMemoryLoadLibary: dll dos header is not valid$MZ$PE, Total Matches: 70
  • Function_00004448 API ID: RegCloseKeyRegOpenKeyExRegQueryValueEx, String ID: &$FPUMaskValue$SOFTWARE\Borland\Delphi\RTL, Total Matches: 63
  • Function_0006D36C API ID: ShellExecute, String ID: /k $[FILE]$open, Total Matches: 62
  • Function_0000A3AC API ID: DosDateTimeToFileTimeGetLastErrorLocalFileTimeToFileTimeSetFileTime, String ID: , Total Matches: 51
  • Function_0002EC20 API ID: GetModuleHandleGetProcAddress, String ID: CoWaitForMultipleHandles$[FILE], Total Matches: 48
  • Function_00071640 API ID: CloseServiceHandleEnumServicesStatusOpenSCManager, String ID: , Total Matches: 47
  • Function_0005DAE0 API ID: GlobalAddAtom$GetCurrentProcessIdGetCurrentThreadIdGetModuleHandleGetProcAddressRegisterWindowMessage, String ID: AnimateWindow$ControlOfs%.8X%.8X$Delphi%.8X$USER32, Total Matches: 45
  • Function_0008A8AC API ID: CloseHandle$CreateFile$CreateProcessWaitForSingleObject, String ID: D, Total Matches: 45
  • Function_00066D4C API ID: CloseHandle$CreateFile$CreateProcessWaitForSingleObject, String ID: D, Total Matches: 45
  • Function_0002FA80 API ID: GetProcAddressLoadLibrary, String ID: DWMAPI.DLL$DwmIsCompositionEnabled, Total Matches: 41
  • Function_00084388 API ID: CloseHandleGetExitCodeProcessOpenProcessTerminateProcess, String ID: , Total Matches: 39
  • Function_000710F0 API ID: GetWindowShowWindow$FindWindowGetClassName, String ID: BUTTON$Shell_TrayWnd, Total Matches: 37
  • Function_0008A218 API ID: ShellExecuteEx, String ID: <$runas, Total Matches: 35
  • Function_000629C0 API ID: CoCreateInstance, String ID: <*I$L*I, Total Matches: 35
  • Function_000630C8 API ID: CoCreateInstance, String ID: <*I$L*I, Total Matches: 35
  • Function_0002F9E4 API ID: GetProcAddressLoadLibrary, String ID: DWMAPI.DLL$DwmExtendFrameIntoClientArea, Total Matches: 35
  • Function_0008AFE8 API ID: Sleep$GetCurrentProcessGetTokenInformationLookupPrivilegeDisplayNameLookupPrivilegeNameOpenProcessToken, String ID: , Total Matches: 34
  • Function_00071850 API ID: CloseServiceHandle$CreateServiceOpenSCManager, String ID: Description$System\CurrentControlSet\Services\, Total Matches: 34
  • Function_0006F17C API ID: GetWindowPlacementGetWindowTextIsWindowVisible, String ID: ,$Maximized$Minimized$Normal$Normal/Unactive$Show/Unactive$True, Total Matches: 33
  • Function_0008C3E4 API ID: FreeLibraryGetProcAddressLoadLibrary, String ID: _DCEntryPoint, Total Matches: 32
  • Function_0008D3C4 API ID: GetVersionEx, String ID: Unknow$Windows 2000$Windows 7$Windows 95$Windows 98$Windows Me$Windows NT 4.0$Windows Server 2003$Windows Vista$Windows XP, Total Matches: 32
  • Function_0008DA48 API ID: Netbios, String ID: %.2x-%.2x-%.2x-%.2x-%.2x-%.2x$3$memory allocation failed!, Total Matches: 32
  • Function_0008CF38 API ID: GetForegroundWindowGetWindowTextGetWindowTextLength, String ID: , Total Matches: 31
  • Function_0006E0DC API ID: RegOpenKeyEx$RegCloseKeyRegDeleteValue, String ID: , Total Matches: 31
  • Function_000840D8 API ID: CloseHandleGetTokenInformationLookupAccountSid$GetLastErrorOpenProcessOpenProcessToken, String ID: , Total Matches: 30
  • Function_0006E3F0 API ID: SHGetPathFromIDListSHGetSpecialFolderLocation, String ID: .LNK, Total Matches: 30
  • Function_0008AC14 API ID: GetCurrentProcessGetTokenInformationLookupPrivilegeDisplayNameLookupPrivilegeNameOpenProcessToken, String ID: GetTokenInformation error$OpenProcessToken error, Total Matches: 30
  • Function_0006F3B8 API ID: GetWindowPlacementGetWindowText, String ID: ,$False$Maximized$Minimized$Normal$Normal/Unactive$Show/Unactive, Total Matches: 30
  • Function_00005026 API ID: UnhandledExceptionFilter, String ID: @$@, Total Matches: 29
  • Function_00005028 API ID: UnhandledExceptionFilter, String ID: @$@, Total Matches: 29
  • Function_0008B42C API ID: keybd_event, String ID: CTRLA$CTRLC$CTRLF$CTRLP$CTRLV$CTRLX$CTRLY$CTRLZ, Total Matches: 29
  • Function_0008B908 API ID: GetTokenInformation$CloseHandleGetCurrentProcessOpenProcessToken, String ID: Default$Full$Limited$unknow, Total Matches: 28
  • Function_0006E244 API ID: RegOpenKeyEx$RegCloseKeyRegDeleteKey, String ID: , Total Matches: 27
  • Function_0008C494 API ID: CloseHandle$CreateFileCreateThreadFindResourceLoadResourceLocalAllocLockResourceSizeofResourceWriteFile, String ID: [FILE], Total Matches: 27
  • Function_00004B2E API ID: UnhandledExceptionFilter, String ID: @, Total Matches: 27
  • Function_00004C5A API ID: UnhandledExceptionFilter, String ID: @, Total Matches: 27
  • Function_00072C70 API ID: SetFileAttributes, String ID: I wasn't able to open the hosts file, maybe because UAC is enabled in remote computer!$drivers\etc\hosts, Total Matches: 26
  • Function_0006F5E4 API ID: GetWindowPlacementGetWindowTextIsWindowVisible, String ID: ,, Total Matches: 26
  • Function_00085150 API ID: RegCloseKeyRegOpenKeyRegSetValueEx, String ID: Software\Microsoft\Windows\CurrentVersion\Run, Total Matches: 24
  • Function_00070B94 API ID: DragQueryFile$GlobalLockGlobalUnlock, String ID: , Total Matches: 22
  • Function_000754C4 API ID: GetModuleHandleGetProcAddress$CreateProcess, String ID: CloseHandle$CreateMutexA$CreateProcessA$D$DCPERSFWBP$ExitThread$GetExitCodeProcess$GetLastError$GetProcAddress$LoadLibraryA$MessageBoxA$OpenProcess$SetLastError$Sleep$TerminateProcess$WaitForSingleObject$kernel32$[FILE]$notepad$user32$[FILE], Total Matches: 21
  • Function_000314A0 API ID: GlobalAllocGlobalLockGlobalUnlockSetClipboardData, String ID: , Total Matches: 21
  • Function_0008C91C API ID: GetVolumeInformation, String ID: %.4x:%.4x, Total Matches: 20
  • Function_000889F0 API ID: GetMonitorInfo, String ID: H$MONSIZE, Total Matches: 20
  • Function_0007EAEC API ID: CreateThreadDispatchMessageGetMessageTranslateMessage, String ID: at $,xI$AI$AI$MPI$OFFLINEK$PWD$Unknow, Total Matches: 19
  • Function_00082320 API ID: CreateThreadExitThreadSleep, String ID: @$BTRESULTUDP Flood|UDP Flood task finished!|, Total Matches: 19
  • Function_0006E724 API ID: NetApiBufferFree$NetShareEnumNetShareGetInfo, String ID: , Total Matches: 19
  • Function_000827C4 API ID: CreateThreadExitThreadSleep, String ID: @$BTRESULTSyn Flood|Syn task finished!|, Total Matches: 19
  • Function_00072E88 API ID: inet_ntoa$WSAIoctlclosesocketsocket, String ID: Broadcast adress : $ Broadcasts : NO$ Broadcasts : YES$ IP : $ IP Mask : $ Loopback interface$ Network interface$ Status : DOWN$ Status : UP, Total Matches: 19
  • Function_00083858 API ID: CreateThreadExitThreadSleep, String ID: @$BTRESULTHTTP Flood|Http Flood task finished!|, Total Matches: 19
  • Function_000221F0 API ID: RegQueryValueEx, String ID: ldA, Total Matches: 18
  • Function_000818F8 API ID: GetKeyState$CallNextHookEx$GetKeyboardStateMapVirtualKeyToAscii, String ID: [<-]$[DEL]$[DOWN]$[ESC]$[F1]$[F2]$[F3]$[F4]$[F5]$[F6]$[F7]$[F8]$[INS]$[LEFT]$[NUM_LOCK]$[RIGHT]$[SNAPSHOT]$[UP], Total Matches: 18
  • EntryPoint API ID: CoInitialize, String ID: .dcp$DCDATA$GENCODE$MPI$NETDATA, Total Matches: 18
  • Function_00074208 API ID: GetProcAddress$LoadLibrary, String ID: WlanCloseHandle$WlanEnumInterfaces$WlanGetAvailableNetworkList$WlanOpenHandle$WlanQueryInterface$[FILE], Total Matches: 17
  • Function_00088D70 API ID: BitBltCreateCompatibleBitmapCreateCompatibleDCCreateDCSelectObject, String ID: image/jpeg, Total Matches: 17
  • Function_00074E20 API ID: CreateRemoteThreadReadProcessMemoryWaitForSingleObject, String ID: DCPERSFWBP, Total Matches: 17
  • Function_0000F3A4 API ID: FindResourceLoadResource, String ID: 0PI$DVCLAL, Total Matches: 17
  • Function_00089580 API ID: CloseHandleCreatePipePeekNamedPipe$CreateProcessDispatchMessageGetEnvironmentVariableGetExitCodeProcessOemToCharPeekMessageReadFileSleepTerminateProcessTranslateMessage, String ID: COMSPEC$D, Total Matches: 17
  • Function_00081318 API ID: CreateThreadExitThread, String ID: Bytes ($,xI$:: $:: Clipboard Change : size = $FTPSIZE$FTPUPLOADK$dclogs\, Total Matches: 16
  • Function_00022188 API ID: RegSetValueEx, String ID: NoControlPanel$tdA, Total Matches: 16
  • Function_00082630 API ID: ExitThread$Sleepclosesocketconnectgethostbynameinet_addrntohsrecvsocket, String ID: , Total Matches: 16
  • Function_0005E7B4 API ID: GetActiveObject, String ID: E, Total Matches: 16
  • Function_0008485C API ID: HttpQueryInfoInternetCloseHandleInternetOpenInternetOpenUrlInternetReadFileShellExecute, String ID: 200$Mozilla$open, Total Matches: 16
  • Function_00080880 API ID: recv$closesocketshutdown$connectgethostbynameinet_addrntohssocket, String ID: [.dll]$[.dll]$[.dll]$[.dll]$[.dll], Total Matches: 16
  • Function_00082E34 API ID: Sleep$CreateThreadExitThread, String ID: .255$127.0.0.1$LanList, Total Matches: 16
  • Function_00074F80 API ID: GetModuleHandleGetProcAddress$CreateProcess, String ID: CloseHandle$D$DeleteFileA$ExitThread$GetExitCodeProcess$GetLastError$GetProcAddress$LoadLibraryA$MessageBoxA$OpenProcess$Sleep$TerminateProcess$kernel32$[FILE]$notepad$[FILE], Total Matches: 16
  • Function_0007F4E0 API ID: recv$closesocketconnectgethostbynameinet_addrntohsshutdownsocket, String ID: [.dll]$PLUGIN$QUICKUP, Total Matches: 16
  • Function_0001F7B4 API ID: EnterCriticalSectionGetCurrentThreadId$InterlockedExchangeLeaveCriticalSection, String ID: 4PI, Total Matches: 16
  • Function_00049834 API ID: GetModuleHandleGetProcAddressImageList_Write, String ID: $qA$ImageList_WriteEx$[FILE]$[FILE], Total Matches: 16
  • Function_0000DA34 API ID: GetStdHandleWriteFile$CharToOemLoadStringMessageBox, String ID: LPI, Total Matches: 16
  • Function_00086374 API ID: send, String ID: #KEEPALIVE#$AI, Total Matches: 15
  • Function_0008DD0C API ID: GlobalMemoryStatus, String ID: $%d%, Total Matches: 15
  • Function_00086094 API ID: DispatchMessagePeekMessageTranslateMessage, String ID: @^H, Total Matches: 15
  • Function_000801FC API ID: recv$closesocketconnectgethostbynameinet_addrntohssendshutdownsocket, String ID: [.dll]$[.dll]$[.dll]$[.dll]$[.dll], Total Matches: 15
  • Function_000821A0 API ID: ExitThread$Sleepclosesocketgethostbynameinet_addrntohssendtosocket, String ID: , Total Matches: 15
  • Function_000843EC API ID: CloseHandleOpenProcess, String ID: ACCESS DENIED (x64), Total Matches: 15
  • Function_00088B18 API ID: GetDeviceCaps$CreateDCEnumDisplayMonitors, String ID: DISPLAY$MONSIZE0x0x0x0, Total Matches: 15
  • Function_00062C84 API ID: CoCreateInstance, String ID: )I$,*I$\)I$l)I$|*I, Total Matches: 15
  • Function_00089244 API ID: recv$ExitThreadclosesocketconnectgethostbynameinet_addrntohssendshutdownsocket, String ID: AI$DATAFLUX, Total Matches: 15
  • Function_00073208 API ID: inet_ntoa$WSAIoctlclosesocketsocket, String ID: , Total Matches: 15
  • Function_00073448 API ID: InternetConnectInternetOpen, String ID: 84G$DCSC, Total Matches: 15
  • Function_00085954 API ID: DeleteFile$BeepMessageBox, String ID: Error$SYSINFO$out.txt$systeminfo$tmp.txt, Total Matches: 15
  • Function_0007FA8C API ID: GetDeviceCaps$recv$DeleteObjectSelectObject$BitBltCreateCompatibleBitmapCreateCompatibleDCGetDCReleaseDCclosesocketconnectgethostbynameinet_addrntohssendshutdownsocket, String ID: THUMB, Total Matches: 15
  • Function_00044D60 API ID: CharLowerCharNextGetModuleFileNameLoadIconOemToChar, String ID: 08B$0PI$8PI$MAINICON$\tA, Total Matches: 14
  • Function_000450B4 API ID: DeleteMenu$GetClassInfoGetSystemMenuRegisterClassSendMessageSetClassLongSetWindowLong, String ID: LPI$PMD, Total Matches: 14
  • Function_00021808 API ID: RegCloseKeyRegCreateKeyEx, String ID: ddA, Total Matches: 14
  • Function_00086210 API ID: recvsend, String ID: EndReceive, Total Matches: 14
  • Function_0002E370 API ID: GetWindowPlacementGetWindowRectIsIconic, String ID: MonitorFromWindow$pB, Total Matches: 14
  • Function_0002E574 API ID: GetSystemMetrics$SystemParametersInfolstrcpy, String ID: DISPLAY$GetMonitorInfoA$tB, Total Matches: 14
  • Function_00086918 API ID: send$recv$closesocket$Sleepconnectgethostbynamegetsocknamentohsselectsocket, String ID: , Total Matches: 14
  • Function_00074D58 API ID: VirtualAllocExWriteProcessMemory, String ID: DCPERSFWBP$[FILE], Total Matches: 14
  • Function_00086E2C API ID: CloseHandleCreateThreadExitThreadLocalAllocSleepacceptbindlistenntohssocket, String ID: ERR|Cannot listen to port, try another one..|$ERR|Socket error..|$OK|Successfully started..|, Total Matches: 14
  • Function_0007EE3C API ID: ShellExecute$CopyFile$DeleteFilePlaySoundSetFileAttributes, String ID: .dcp$BATCH$EDITSVR$GENCODE$HOSTS$SOUND$UPANDEXEC$UPDATE$UPLOADEXEC$drivers\etc\hosts$open, Total Matches: 14
  • Function_00080F70 API ID: GetForegroundWindowGetWindowTextGetWindowTextLength, String ID: 3 H, Total Matches: 13
  • Function_00081ED8 API ID: GetModuleHandleSetWindowsHookEx, String ID: 3 H$dclogs\, Total Matches: 13
  • Function_0008851C API ID: recv$closesocketconnectgethostbynameinet_addrmouse_eventntohsshutdownsocket, String ID: CONTROLIO$XLEFT$XMID$XRIGHT$XWHEEL, Total Matches: 13
  • Function_0008317C API ID: ExitThreadrecv$closesocketconnectgethostbynameinet_addrntohssendshutdownsocket, String ID: AI$DATAFLUX, Total Matches: 13
  • Function_00021F68 API ID: RegQueryValueEx, String ID: n"B, Total Matches: 12
  • Function_0002E2E0 API ID: GetSystemMetrics, String ID: B$MonitorFromRect, Total Matches: 12
  • Function_00048CDC API ID: ImageList_Draw$ImageList_GetImageCount, String ID: 6B, Total Matches: 12
  • Function_00046EDC API ID: GetCurrentThreadIdSetTimerWaitMessage, String ID: 4PI$TfD, Total Matches: 12
  • Function_00031584 API ID: GetClipboardDataGlobalLockGlobalUnlock, String ID: 3 H, Total Matches: 12
  • Function_00031630 API ID: EnumClipboardFormatsGetClipboardData, String ID: 84B, Total Matches: 12
  • Function_0008298C API ID: ExitThread$closesocket$connectgethostbynameinet_addrntohssocket, String ID: PortScanAdd$T)H, Total Matches: 11
  • Function_00084B30 API ID: Sleep, String ID: BTERRORDownload File| Error on downloading file check if you type the correct url...|$BTRESULTDownload File|Mass Download : File Downloaded , Executing new one in temp dir...|$BTRESULTMass Download|Downloading File...|$DownloadFail$DownloadSuccess, Total Matches: 11
  • Function_000836D8 API ID: ExitThread$Sleepclosesocketconnectgethostbynameinet_addrntohsrecvsocket, String ID: POST /index.php/1.0Host: , Total Matches: 11
  • Function_000878A4 API ID: CloseHandleCreateThreadEnterCriticalSectionLeaveCriticalSectionLocalAlloc, String ID: , Total Matches: 11
  • Function_0008E06C API ID: SendMessage$FindWindowEx$CloseHandleFindWindowGetWindowThreadProcessIdOpenProcessReadProcessMemoryVirtualAllocVirtualAllocExVirtualFreeVirtualFreeExWriteProcessMemory, String ID: #32770$SysListView32$d"H, Total Matches: 10
  • Function_0002E648 API ID: GetSystemMetrics$SystemParametersInfolstrcpy, String ID: DISPLAY$GetMonitorInfoW$HB, Total Matches: 10
  • Function_00048A94 API ID: BitBltImageList_DrawExSetBkColorSetTextColor, String ID: 6B, Total Matches: 10
  • Function_00082B34 API ID: ExitThread$CreateThreadLocalAllocSleep, String ID: p)H, Total Matches: 10
  • Function_00083468 API ID: InternetCloseHandle$ExitThreadInternetOpenInternetOpenUrl, String ID: Times.$[.exe]$H4H$myappname, Total Matches: 10
  • Function_00087488 API ID: EnterCriticalSectionLeaveCriticalSectionclosesocket, String ID: FpH, Total Matches: 10
  • Function_000319C4 API ID: EnumClipboardFormats, String ID: 84B, Total Matches: 10
  • Function_000556F4 API ID: DefWindowProcGetCaptureSetWindowPos_TrackMouseEvent, String ID: zC, Total Matches: 9
  • Function_0008CFB4 API ID: capGetDriverDescription, String ID: - , Total Matches: 8
  • Function_00075E2C API ID: send, String ID: AI, Total Matches: 7
  • Function_000865E0 API ID: DispatchMessagePeekMessageSleepTranslateMessageclosesocketconnectgethostbynameinet_addrntohsrecvshutdownsocket, String ID: AI$`cH, Total Matches: 6
  • Function_000028CC API ID: RtlEnterCriticalSectionRtlLeaveCriticalSection, String ID: (&, Total Matches: 5
  • Function_00002C40 API ID: RtlEnterCriticalSectionRtlLeaveCriticalSection, String ID: (&, Total Matches: 5
  • Function_0001239C API ID: GetWindowsDirectory, String ID: \pagefile.sys$\user.dat, Total Matches: 3
  • Function_00012D78 API ID: GetModuleHandleGetProcAddressLoadLibrary, String ID: could not be located in the dynamic link library $KERNEL32.DLL$LOADER ERROR$The ordinal $The procedure entry point , Total Matches: 3
  • Function_0008FA10 API ID: Sleep$CopyFileCreateThreadExitProcess$GetLastErrorMessageBoxSetLastErrorShellExecute, String ID: at $" +s +h$,xI$AI$BIND$CHANGEDATE$CHIDED$CHIDEF$COMBOPATH$DCMUTEX$DIRATTRIB$EDTDATE$EDTPATH$FAKEMSG$[.dll]$FWB$GENCODE$Guest$INSTALL$KEYNAME$MELT$MSGCORE$MSGICON$MSGTITLE$MULTIBIND$MULTIPLUGS$MUTEX$NETDATA$OVDNS$PDNS$PERS$PERSINST$PLUGS$SH1$SH10$SH3$SH4$SH5$SH6$SH7$SH8$SH9$SID$attrib "$notepad$open, Total Matches: 3
  • Function_00011B9C API ID: GetWindowsDirectory, String ID: \pagefile.sys$\user.dat, Total Matches: 3
  • Function_00012578 API ID: GetModuleHandleGetProcAddressLoadLibrary, String ID: could not be located in the dynamic link library $KERNEL32.DLL$LOADER ERROR$The ordinal $The procedure entry point , Total Matches: 3