memreduct.zip
- SHA256 8eb5f7849d6737937aa0d40e60ae35075a51850dc761a13f6154bdc493750ad5
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
memreduct.zip
Resource
win11-20260513-en
windows11-21h2-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
memreduct.exe
Resource
win11-20260513-en
windows11-21h2-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
memreduct.exe
Resource
win11-20260513-en
windows11-21h2-x64
5 signatures
150 seconds
General
- Target memreduct.zip
- Size 356KB
- Sample260822-wlcqfaap7x
- SHA256 8eb5f7849d6737937aa0d40e60ae35075a51850dc761a13f6154bdc493750ad5
- MD5 581954e660dc490bb859acc6112a398b
- SHA1 e40adc71cecc9b17b751ca4617eecc97c3859174
- SHA512 1f19e11acbdaf4fa23ad0b3e41faf3cac8c8675257811c4ae55f829b602bdf4b8c3bae88abef9cedf8c1e449dcc4da6891f9213d88c753da984964b537cd78e7
- SSDEEP 6144:BJBGLGKwGwVhmJuNIKrNe+KHGDaZQTsMmIPkKLf6c0v64LSqYPEWRiOnkDd:HiG/Gw/mJuNI+Xo2T1hkPc0pm3Et
- TLSH T1927423771401E5B95E450EA40CE3C75CBBD8CB30E29371A6B05F809B0E77696CA2D8ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/memreduct.exe unpack002/$PLUGINSDIR/System.dll unpack002/$PLUGINSDIR/nsDialogs.dll unpack002/memreduct.exe
File Explorer
-
memreduct.zip.zip 356KB
-
memreduct.exe.exe 373KB
-
$PLUGINSDIR/System.dll.dll 12KB
-
$PLUGINSDIR/modern-header.bmp25KB
-
$PLUGINSDIR/modern-wizard.bmp150KB
-
$PLUGINSDIR/nsDialogs.dll.dll 9KB
-
memreduct.exe.exe 387KB
-
memreduct.exe.sig566B
memreduct.exe
- IMPHASH 46ce5c12b293febbeb513b196aa7f843
- SHA256 3c43c30de2fad7d1fe5d8ff0a2ed3c6666f2c2052242afa5683fc89367ea585f
- MD5 452573afb0d3c61b1c7a4008a4e98d68
- SHA1 7e49ca61833fa87ea8cd8e90bd08492cd764c2dd
- SHA512 887a2039cb9c847317bf33fa65a870feb58ffbc8ae73b0d96fc4967132b9c079bb302fcfdfa0256e946a10f038caef594fd2ee00c89065a41e2a93d311346fe5
- SSDEEP 6144:gX45rw6xUdTGLG8wGwVrmJuNIqrNe+KHGncZQTsMmIfkKLf6c0v64xSqYPEytC1:gX4JU2G1GwlmJuNIeXoAT1lkPc0pM50
- TLSH T1138422253540D4B7D9230B701DF2833AABE8C67553A6521B731D4A5F7F33B82CA09BA6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13983
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegEnumValueW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegOpenKeyExW
RegCreateKeyExW
shell32
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
SHFileOperationW
ShellExecuteExW
ole32
CoCreateInstance
OleUninitialize
OleInitialize
IIDFromString
CoTaskMemFree
comctl32
ImageList_Destroy
ord17
ImageList_AddMasked
ImageList_Create
user32
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
CreatePopupMenu
AppendMenuW
TrackPopupMenu
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
IsWindowEnabled
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CharPrevW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
CharNextA
wsprintfA
DispatchMessageW
CreateWindowExW
PeekMessageW
GetSystemMetrics
gdi32
GetDeviceCaps
SetBkColor
SelectObject
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
kernel32
RemoveDirectoryW
lstrcmpiA
GetTempFileNameW
CreateProcessW
CreateDirectoryW
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
WriteFile
GetCurrentProcess
GetModuleFileNameW
GetLastError
GetFileSize
CreateFileW
GetTickCount
Sleep
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
MulDiv
lstrcpyA
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
ExitProcess
Name
.text
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
126KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
176KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=163, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH 509a34b3a68a773e0afb4259e68f9f82
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10879
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalAlloc
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
867B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
662B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=20, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/modern-header.bmp
- SHA256 b74ed1397c5a50c22ddd4da1c01cf1a36484fa38623051b4959bb6e01d657547
- MD5 d98f2159025ccd128b59b6ba715cee46
- SHA1 9fc4c22d29ce4e4001a6902828f954ffd65e6851
- SHA512 f3becda9ccda6d76576ebd87d71c349541a34f9260848e650e2aa5225be6907276f3b7920fd41a6385699b452ca8fe49ec5c98ad97e45e3f8c5143003268c923
- SSDEEP 24:AKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKj:wTbWikXYfWi2222222mDIhc3/J
- TLSH T19FC2C0E8ECA5659C9C298B262F13FEF884881D956D46068DCC3FFB60D27E13E506C14B
- MD5 SHA1 SHA512 SSDEEP TLSH
$PLUGINSDIR/modern-wizard.bmp
- SHA256 411961864a8edb7cc2ba384e702bbb787040ea47488d2cefc2ef2c6f0a55a832
- MD5 48992d90bf2b3360d2301802a0c25900
- SHA1 b16b11f83534f5467a8d7c570370eb71f57e84ad
- SHA512 5a25418162b4c8753840174ec01a8a0eca808d11b77bd27120400b92382e69bca4d02cea35afc874e7fb9e591e20cabf7d43e34f0e4a439f2d84b47d0c1b30a3
- SSDEEP 48:LqdOFoa0jnNVVVVVVVVVVVVVVVVVVVVASCPKPKPfPgPqPnoyccccccccccccccc2:+dOWZ43sbm1gG
- TLSH T161E37DF735F46DB33500649F77675AB0942EBF7825A623A1903A3C7A4836FC6089C798
- MD5 SHA1 SHA512 SSDEEP TLSH
$PLUGINSDIR/nsDialogs.dll
- IMPHASH 3b477381217c97b22146297f93df2a92
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
- MD5 8f0e7415f33843431df308bb8e06af81
- SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
- SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
- SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
- TLSH T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7527
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrcpyW
GetFileAttributesW
lstrcmpiW
MulDiv
lstrlenW
HeapFree
GetProcessHeap
GetCurrentDirectoryW
HeapReAlloc
GlobalFree
lstrcpynW
GlobalAlloc
HeapAlloc
SetCurrentDirectoryW
user32
GetPropW
DestroyWindow
CallWindowProcW
SetCursor
LoadCursorW
RemovePropW
CharPrevW
GetWindowLongW
DrawTextW
GetWindowTextW
SetWindowLongW
GetDlgItem
GetSysColor
SetWindowPos
CreateDialogParamW
MapWindowPoints
GetWindowRect
SetPropW
CreateWindowExW
IsWindow
SetTimer
KillTimer
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
wsprintfW
MapDialogRect
GetClientRect
CharNextW
SendMessageW
DrawFocusRect
gdi32
SetTextColor
shell32
SHBrowseForFolderW
SHGetPathFromIDListW
comdlg32
GetSaveFileNameW
GetOpenFileNameW
CommDlgExtendedError
ole32
CoTaskMemFree
Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
638B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=56, id=1, productName=Unmarked objects,
count=13, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=5, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
memreduct.exe
- IMPHASH df513fa37df881a5e8aa55f4e1aff5c8
- SHA256 dd55a81d56e8c32918e5190b2ec2a1f2a7edbbca884627439b4b619fdfb5602d
- MD5 66f5c7ebe24abc9405e688c1597e1be9
- SHA1 39988b6f5b654475f786292e6859b067a388289d
- SHA512 226bb6f5fcd77d487aff2f378d87dfe8574e6331051b5c14fb8c767a6b7fc849e9299ab751e97ccfdbb7e199304b67ffb0b31626ce08c74153108a7471380673
- SSDEEP 6144:+0jxaVsVSJisMi/WHHg+KTzrUd+Mb+kNHvsP:+UaKxji/WvKTzrjM1g
- TLSH T14784F708A991C4A9D1EA8334C56383F2E535FC99DF6389EB6264FD693E33DC06938711
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
178336
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\projects\memreduct\bin\64\memreduct.pdb
kernel32
InitializeCriticalSectionEx
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetFileType
HeapAlloc
HeapFree
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
WriteFile
GetStdHandle
RaiseException
EncodePointer
LoadLibraryExW
GetProcAddress
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetLastError
RtlUnwindEx
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
LCMapStringW
GetProcessHeap
SetFilePointerEx
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
CloseHandle
CreateFileW
RegisterApplicationRestart
VirtualProtect
GlobalUnlock
CreateProcessW
UnregisterApplicationRestart
GlobalLock
WriteConsoleW
GlobalAlloc
OutputDebugStringW
GetPrivateProfileSectionNamesW
GetLocaleInfoW
GetPrivateProfileSectionW
SetDllDirectoryW
LocalFree
GlobalFree
GetPrivateProfileStringW
SetSearchPathMode
SetDefaultDllDirectories
RtlPcToFileHeader
WritePrivateProfileStringW
user32
DeleteMenu
MonitorFromWindow
GetPropW
IsWindowVisible
InsertMenuItemW
GetWindow
CheckMenuRadioItem
GetMenuItemInfoW
EnableWindow
EndPaint
BeginPaint
GetCursorPos
GetMessageW
GetWindowThreadProcessId
UpdateWindow
DrawFrameControl
PtInRect
RegisterWindowMessageW
GetParent
DrawEdge
EnableMenuItem
GetKeyNameTextW
DrawIconEx
SetRect
DrawTextW
GetDlgItem
GetClientRect
GetComboBoxInfo
GetWindowDC
DrawMenuBar
GetClassNameW
SetPropW
BringWindowToTop
SetFocus
IntersectRect
EnumWindows
PostQuitMessage
GetSysColor
DrawFocusRect
TrackMouseEvent
SetWindowPlacement
MapWindowPoints
GetDlgCtrlID
GetMonitorInfoW
RedrawWindow
SetTimer
GetCapture
OffsetRect
ShowWindow
GetSubMenu
GetWindowPlacement
GetMenuBarInfo
GetWindowLongPtrW
GetSystemMetrics
EndDialog
ScreenToClient
GetIconInfo
LoadAcceleratorsW
SetWindowLongPtrW
EnumChildWindows
MonitorFromRect
SetWindowPos
GetDC
InflateRect
DestroyWindow
GetFocus
GetMenu
GetWindowRect
MapVirtualKeyW
CallWindowProcW
AllowSetForegroundWindow
DefWindowProcW
IsIconic
SetForegroundWindow
SystemParametersInfoW
CreateDialogIndirectParamW
CheckMenuItem
TrackPopupMenuEx
SetClipboardData
ChangeWindowMessageFilterEx
TranslateMessage
TranslateAcceleratorW
DrawTextExW
MoveWindow
IsWindowEnabled
GetForegroundWindow
SendDlgItemMessageW
FrameRect
EmptyClipboard
DestroyAcceleratorTable
SetMenuItemInfoW
CloseClipboard
CreateIconIndirect
DestroyIcon
SendMessageW
KillTimer
SetCursor
LoadCursorW
DestroyMenu
RegisterHotKey
ClientToScreen
CreatePopupMenu
LoadMenuW
UnregisterHotKey
DialogBoxIndirectParamW
InvalidateRect
IsDialogMessageW
DispatchMessageW
OpenClipboard
GetActiveWindow
GetClassLongPtrW
ReleaseDC
gdi32
SetPixelV
GetDeviceCaps
GetTextExtentExPointW
ExtTextOutW
SetDCPenColor
RoundRect
CreateBitmap
Rectangle
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
GetStockObject
DeleteDC
SetTextColor
CreateFontIndirectW
CreateSolidBrush
DeleteObject
SetBkColor
ExcludeClipRect
SetDCBrushColor
GetObjectW
CreateDIBSection
SetBkMode
SelectClipRgn
comdlg32
ChooseFontW
ChooseColorW
shell32
SHAppBarMessage
SHGetKnownFolderPath
Shell_NotifyIconW
CommandLineToArgvW
ShellExecuteW
ShellExecuteExW
ole32
CoUninitialize
CoInitializeEx
CoCreateInstance
CoTaskMemFree
oleaut32
SysFreeString
SysAllocString
ntdll
RtlFreeHeap
RtlMultiByteToUnicodeSize
RtlCreateHeap
RtlQueryPerformanceCounter
NtSetThreadExecutionState
NtCreateMutant
NtQueryInformationFile
RtlSetHeapInformation
RtlRaiseStatus
NtCreateKeyedEvent
NtQueryInformationThread
NtSetSystemInformation
LdrAccessResource
NtQueryValueKey
RtlExpandEnvironmentStrings_U
NtOpenFile
RtlEqualSid
RtlGetDaclSecurityDescriptor
NtMapViewOfSection
RtlInterlockedPopEntrySList
NtQueryDefaultLocale
NtWaitForSingleObject
NtSetValueKey
NtUnmapViewOfSection
NtQuerySecurityObject
NtQueryDirectoryFile
NtCreateFile
RtlOpenCurrentUser
RtlMultiByteToUnicodeN
RtlFindMessage
NtWaitForKeyedEvent
RtlGetVersion
RtlInitAnsiString
NtFlushBuffersFile
RtlRunOnceBeginInitialize
RtlInitUnicodeStringEx
NtDeviceIoControlFile
NtQueryAttributesFile
RtlUTF8ToUnicodeN
RtlLengthSid
NtDeleteValueKey
NtDelayExecution
RtlReAllocateHeap
LdrGetDllHandleEx
NtQueryInformationToken
NtReleaseKeyedEvent
LdrLoadDll
NtSetInformationThread
NtReadFile
LdrFindResource_U
NtSetInformationFile
LdrUnloadDll
NtCreateThreadEx
RtlFreeUnicodeString
RtlGetAce
RtlDosPathNameToNtPathName_U_WithStatus
RtlDowncaseUnicodeChar
RtlUpcaseUnicodeChar
RtlTimeToTimeFields
LdrGetProcedureAddressEx
NtOpenKeyEx
RtlRandomEx
NtReleaseMutant
NtWriteFile
NtQuerySystemInformation
NtCreateSection
RtlDosSearchPath_Ustr
RtlAllocateHeap
RtlInitializeSListHead
NtOpenProcessToken
RtlInterlockedPushEntrySList
NtAdjustPrivilegesToken
NtOpenMutant
NtResumeThread
NtSetInformationProcess
NtClose
RtlSetUnhandledExceptionFilter
NtTerminateThread
RtlRunOnceComplete
NtQueryInformationProcess
RtlExitUserProcess
RtlInitUnicodeString
comctl32
InitCommonControlsEx
ImageList_Draw
ImageList_GetIconSize
ord381
ord345
dwmapi
DwmSetWindowAttribute
dbghelp
MiniDumpWriteDump
shlwapi
PathUnquoteSpacesW
ord354
StrFormatByteSizeEx
StrTrimW
uxtheme
GetThemeFont
GetThemeBackgroundContentRect
DrawThemeEdge
BeginBufferedAnimation
BufferedPaintRenderAnimation
DrawThemeBackground
GetThemePartSize
CloseThemeData
IsThemeBackgroundPartiallyTransparent
DrawThemeParentBackground
GetThemeTransitionDuration
SetWindowTheme
EndBufferedAnimation
DrawThemeTextEx
OpenThemeData
winhttp
WinHttpGetIEProxyConfigForCurrentUser
WinHttpCrackUrl
WinHttpConnect
WinHttpSetStatusCallback
WinHttpSendRequest
WinHttpCloseHandle
WinHttpSetOption
WinHttpOpenRequest
WinHttpReadData
WinHttpOpen
WinHttpReceiveResponse
WinHttpQueryHeaders
Name
.text
Size
245KB
Virtual Size
244KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
77KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=259, version=33140,
count=9, id=259, version=34321,
count=16, id=260, version=34321,
count=40, id=261, version=34321,
count=144, id=261, version=33140,
count=14, id=260, version=33140,
count=2, id=262, version=33140,
count=39, id=257, version=33140,
count=483, id=1, productName=Unmarked objects,
count=3, id=264, version=34809,
count=1, id=255, version=34809,
count=1, id=258, version=34809,
memreduct.exe.sig
- SHA256 3152dde222deb493a3e56e41014f9ba7340393b0aa2a7f61615228a4c0af560e
- MD5 561870cd86db34a61af8c34b15fc7dc5
- SHA1 6e1d822f277bc8d590e132c42998934ecd7f2402
- SHA512 0046d53cb7a7d0e6a1287aed24771c3f046b38f93f0763a942ee177852106cabc9b5212fa04d18c69e8fc5b649eeb229be4c38f2b23949dd1c4bf733f4983776
- TLSH T16DF0759F370D38DA6155F09939B82021B8B92B81F0FC72AC9173FB812B2D10D591417F
- MD5 SHA1 SHA512 TLSH