Edit tour
Windows
Analysis Report
cANdLlHS4N
Overview
General Information
| Sample Name: | cANdLlHS4N (renamed file extension from none to exe) |
| Analysis ID: | 586425 |
| MD5: | b3139b26a2dabb9b6e728884d8fa8b33 |
| SHA1: | de5672c7940e4fad3c8145ce9e8a5fcb1da0fcee |
| SHA256: | 5262cb9791df50fafcb2fbd5f93226050b51efe400c2924eecba97b7ce437481 |
| Infos: |   |
 | |
Detection
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Multi AV Scanner detection for submitted file
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Malicious sample detected (through community Yara rule)
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Submitted sample is a known malware sample
Writes to foreign memory regions
Contains functionality to start reverse TCP shell (cmd.exe)
Connects to many ports of the same IP (likely port scanning)
Allocates memory in foreign processes
Contains functionality to detect sleep reduction / modifications
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query locales information (e.g. system language)
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
Contains functionality to launch a process as a different user
Stores files to the Windows start menu directory
Found evasive API chain (may stop execution after checking a module file name)
Contains functionality to call native functions
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to dynamically determine API calls
Contains functionality to read the clipboard data
Contains functionality to record screenshots
HTTP GET or POST without a user agent
Contains functionality which may be used to detect a debugger (GetProcessHeap)
PE file contains an invalid checksum
Extensive use of GetProcAddress (often used to hide API calls)
PE file contains strange resources
Drops PE files
Contains functionality to read the PEB
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Detected TCP or UDP traffic on non-standard ports
Creates a start menu entry (Start Menu\Programs\Startup)
Potential key logger detected (key state polling based)
Detected non-DNS traffic on DNS port
Queries keyboard layouts
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to detect sandboxes (mouse cursor move detection)
Found large amount of non-executed APIs
Uses Microsoft's Enhanced Cryptographic Provider
May check if the current machine is a sandbox (GetTickCount - Sleep)
Creates a process in suspended mode (likely to inject code)
Contains functionality for read data from the clipboard
Classification
- System is w10x64
cANdLlHS4N.exe (PID: 6048 cmdline: "C:\Users\ user\Deskt op\cANdLlH S4N.exe" MD5: B3139B26A2DABB9B6E728884D8FA8B33) 
obedience.exe (PID: 488 cmdline: C:\Users\u ser\AppDat a\Local\Te mp\obedien ce.exe MD5: 6A1C14D5F16A07BEF55943134FE618C0) 
iexplore.exe (PID: 5844 cmdline: C:\Program Files (x8 6)\Interne t Explorer \iexplore. exe MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)
- obedience.exe (PID: 5080 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\obedie nce.exe" MD5: 6A1C14D5F16A07BEF55943134FE618C0) 
iexplore.exe (PID: 244 cmdline: C:\Program Files (x8 6)\Interne t Explorer \iexplore. exe MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| Dropper_DeploysMalwareViaSideLoading | Detect a dropper used to deploy an implant via side loading. This dropper has specifically been observed deploying REDLEAVES & PlugX | USG |
|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| REDLEAVES_DroppedFile_ObfuscatedShellcodeAndRAT_handkerchief | Detect obfuscated .dat file containing shellcode and core REDLEAVES RAT | USG |
| |
| SUSP_XORed_MSDOS_Stub_Message | Detects suspicious XORed MSDOS stub message | Florian Roth |
| |
| REDLEAVES_DroppedFile_ImplantLoader_Starburn | Detect the DLL responsible for loading and deobfuscating the DAT file containing shellcode and core REDLEAVES RAT | USG |
| |
| OpCloudHopper_Malware_6 | Detects malware from Operation Cloud Hopper | Florian Roth |
|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| REDLEAVES_DroppedFile_ObfuscatedShellcodeAndRAT_handkerchief | Detect obfuscated .dat file containing shellcode and core REDLEAVES RAT | USG |
| |
| SUSP_XORed_MSDOS_Stub_Message | Detects suspicious XORed MSDOS stub message | Florian Roth |
| |
| REDLEAVES_DroppedFile_ImplantLoader_Starburn | Detect the DLL responsible for loading and deobfuscating the DAT file containing shellcode and core REDLEAVES RAT | USG |
| |
| REDLEAVES_DroppedFile_ImplantLoader_Starburn | Detect the DLL responsible for loading and deobfuscating the DAT file containing shellcode and core REDLEAVES RAT | USG |
| |
| SUSP_XORed_MSDOS_Stub_Message | Detects suspicious XORed MSDOS stub message | Florian Roth |
| |
| Click to see the 37 entries | ||||
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| REDLEAVES_DroppedFile_ImplantLoader_Starburn | Detect the DLL responsible for loading and deobfuscating the DAT file containing shellcode and core REDLEAVES RAT | USG |
| |
| OpCloudHopper_Malware_6 | Detects malware from Operation Cloud Hopper | Florian Roth |
| |
| REDLEAVES_DroppedFile_ImplantLoader_Starburn | Detect the DLL responsible for loading and deobfuscating the DAT file containing shellcode and core REDLEAVES RAT | USG |
| |
| OpCloudHopper_Malware_6 | Detects malware from Operation Cloud Hopper | Florian Roth |
| |
| REDLEAVES_DroppedFile_ImplantLoader_Starburn | Detect the DLL responsible for loading and deobfuscating the DAT file containing shellcode and core REDLEAVES RAT | USG |
| |
| Click to see the 11 entries | ||||
There are no malicious signatures, click here to show all signatures.
| Source: | Author: frack113: | ||
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Virustotal: | Perma Link | ||
| Source: | Metadefender: | Perma Link | ||
| Source: | ReversingLabs: | |||
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | Code function: | 2_2_04B4B9B9 | |
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_009C8B98 | |
| Source: | Code function: | 1_2_00409798 | |
| Source: | Code function: | 1_2_00405F34 | |
| Source: | Code function: | 2_2_04B4B33C | |
| Source: | Code function: | 3_2_00409798 | |
| Source: | Code function: | 3_2_00405F34 | |
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
Networking | |
|---|
| Source: | Snort IDS: | ||
| Source: | TCP traffic: | ||
| Source: | ASN Name: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | HTTP traffic detected: | ||
| Source: | Code function: | 2_2_04B43A47 | |
| Source: | Code function: | 1_2_00429A00 | |
| Source: | Code function: | 2_2_04B55315 | |
| Source: | Code function: | 0_2_009AD29D | |
| Source: | Code function: | 0_2_009A7B6A | |
| Source: | Code function: | 1_2_00445BB4 | |
| Source: | Code function: | 1_2_0043D32C | |
System Summary | |
|---|
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Initial file: | ||
| Source: | Static PE information: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Code function: | 0_2_00A539D2 | |
| Source: | Code function: | 0_2_00AADB4F | |
| Source: | Code function: | 0_2_00ABECDC | |
| Source: | Code function: | 1_2_00482618 | |
| Source: | Code function: | 1_2_004847E4 | |
| Source: | Code function: | 1_2_0045893C | |
| Source: | Code function: | 1_2_0043AC9C | |
| Source: | Code function: | 1_2_00477074 | |
| Source: | Code function: | 1_2_0045DB80 | |
| Source: | Code function: | 1_2_6EDA0F49 | |
| Source: | Code function: | 1_2_6EDA0B77 | |
| Source: | Code function: | 1_2_6EDA07D9 | |
| Source: | Code function: | 2_2_03029246 | |
| Source: | Code function: | 2_2_0302D2F5 | |
| Source: | Code function: | 2_2_0300312C | |
| Source: | Code function: | 2_2_0300B053 | |
| Source: | Code function: | 2_2_03019774 | |
| Source: | Code function: | 2_2_0302962E | |
| Source: | Code function: | 2_2_03028641 | |
| Source: | Code function: | 2_2_0300E6C7 | |
| Source: | Code function: | 2_2_0300E4BC | |
| Source: | Code function: | 2_2_03028AD6 | |
| Source: | Code function: | 2_2_0302D846 | |
| Source: | Code function: | 2_2_0302FE65 | |
| Source: | Code function: | 2_2_03028E74 | |
| Source: | Code function: | 2_2_0302CDA4 | |
| Source: | Code function: | 2_2_03022DC8 | |
| Source: | Code function: | 2_2_0302EC5B | |
| Source: | Code function: | 2_2_04B4E428 | |
| Source: | Code function: | 2_2_04B685AD | |
| Source: | Code function: | 2_2_04B6959A | |
| Source: | Code function: | 2_2_04B68DE0 | |
| Source: | Code function: | 2_2_04B6FDD1 | |
| Source: | Code function: | 2_2_04B62D34 | |
| Source: | Code function: | 2_2_04B6CD10 | |
| Source: | Code function: | 2_2_04B596E0 | |
| Source: | Code function: | 2_2_04B4E633 | |
| Source: | Code function: | 2_2_04B6D7B2 | |
| Source: | Code function: | 2_2_04B4AFBF | |
| Source: | Code function: | 2_2_04B43098 | |
| Source: | Code function: | 2_2_04B691B2 | |
| Source: | Code function: | 2_2_04B6D261 | |
| Source: | Code function: | 2_2_04B68A42 | |
| Source: | Code function: | 2_2_04B6EBC7 | |
| Source: | Code function: | 3_2_00482618 | |
| Source: | Code function: | 3_2_004847E4 | |
| Source: | Code function: | 3_2_0045893C | |
| Source: | Code function: | 3_2_0043AC9C | |
| Source: | Code function: | 3_2_00477074 | |
| Source: | Code function: | 3_2_0045DB80 | |
| Source: | Code function: | 3_2_6EE60F49 | |
| Source: | Code function: | 3_2_6EE60B77 | |
| Source: | Code function: | 3_2_6EE607D9 | |
| Source: | Code function: | 3_2_6EE60344 | |
| Source: | Code function: | 2_2_04B4F8FF | |
| Source: | Code function: | 1_2_004637A8 | |
| Source: | Code function: | 1_2_0045893C | |
| Source: | Code function: | 1_2_00448B44 | |
| Source: | Code function: | 1_2_0043AFAC | |
| Source: | Code function: | 1_2_00463F4C | |
| Source: | Code function: | 1_2_00463FFC | |
| Source: | Code function: | 3_2_004637A8 | |
| Source: | Code function: | 3_2_0045893C | |
| Source: | Code function: | 3_2_00448B44 | |
| Source: | Code function: | 3_2_0043AFAC | |
| Source: | Code function: | 3_2_00463F4C | |
| Source: | Code function: | 3_2_00463FFC | |
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Virustotal: | ||
| Source: | Metadefender: | ||
| Source: | ReversingLabs: | ||
| Source: | Static PE information: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Binary string: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 0_2_009A13B0 | |
| Source: | File read: | Jump to behavior | ||
| Source: | Code function: | 1_2_004099C2 | |
| Source: | Binary or memory string: | ||
| Source: | Code function: | 1_2_00426E50 | |
| Source: | Key opened: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Code function: | 0_2_009A12C0 | |
| Source: | Mutant created: | ||
| Source: | Code function: | 0_2_009B508E | |
| Source: | Window detected: | ||
| Source: | Static PE information: | ||
| Source: | Static file information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_00AAD398 | |
| Source: | Code function: | 0_2_00AAD31D | |
| Source: | Code function: | 1_2_00450299 | |
| Source: | Code function: | 1_2_0048A04C | |
| Source: | Code function: | 1_2_0046610C | |
| Source: | Code function: | 1_2_0043E11C | |
| Source: | Code function: | 1_2_00482099 | |
| Source: | Code function: | 1_2_0048617C | |
| Source: | Code function: | 1_2_00466144 | |
| Source: | Code function: | 1_2_004301B0 | |
| Source: | Code function: | 1_2_0045020A | |
| Source: | Code function: | 1_2_00488278 | |
| Source: | Code function: | 1_2_0043E284 | |
| Source: | Code function: | 1_2_00488240 | |
| Source: | Code function: | 1_2_0048A334 | |
| Source: | Code function: | 1_2_004205FE | |
| Source: | Code function: | 1_2_0048A5C8 | |
| Source: | Code function: | 1_2_0041867D | |
| Source: | Code function: | 1_2_0046674F | |
| Source: | Code function: | 1_2_004188E5 | |
| Source: | Code function: | 1_2_0041C96A | |
| Source: | Code function: | 1_2_0048A9E4 | |
| Source: | Code function: | 1_2_0042CB14 | |
| Source: | Code function: | 1_2_0048CA58 | |
| Source: | Code function: | 1_2_00466B9C | |
| Source: | Code function: | 1_2_00406B51 | |
| Source: | Code function: | 1_2_00418B0D | |
| Source: | Code function: | 1_2_00430B57 | |
| Source: | Code function: | 1_2_00416C19 | |
| Source: | Code function: | 1_2_00466C0C | |
| Source: | Code function: | 1_2_00466BD4 | |
| Source: | Code function: | 0_2_00AC046C | |
| Source: | Static PE information: | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
Hooking and other Techniques for Hiding and Protection | |
|---|
| Source: | Icon embedded in binary file: | ||
| Source: | Code function: | 0_2_009A836B | |
| Source: | Code function: | 1_2_00463830 | |
| Source: | Code function: | 1_2_0044A290 | |
| Source: | Code function: | 1_2_00460740 | |
| Source: | Code function: | 1_2_0044AB44 | |
| Source: | Code function: | 1_2_0044B468 | |
| Source: | Code function: | 1_2_0042D738 | |
| Source: | Code function: | 1_2_00463F4C | |
| Source: | Code function: | 1_2_00463FFC | |
| Source: | Code function: | 3_2_00463830 | |
| Source: | Code function: | 3_2_0044A290 | |
| Source: | Code function: | 3_2_00460740 | |
| Source: | Code function: | 3_2_0044AB44 | |
| Source: | Code function: | 3_2_0044B468 | |
| Source: | Code function: | 3_2_0042D738 | |
| Source: | Code function: | 3_2_00463F4C | |
| Source: | Code function: | 3_2_00463FFC | |
| Source: | Code function: | 1_2_00430384 | |
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | Code function: | 1_2_0043EDE4 | |
| Source: | Code function: | 3_2_0043EDE4 | |
| Source: | Evasive API call chain: | graph_1-47245 | ||
| Source: | Evasive API call chain: | graph_0-21982 | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Code function: | 1_2_00462D8C | |
| Source: | Code function: | 3_2_00462D8C | |
| Source: | API coverage: | ||
| Source: | API coverage: | ||
| Source: | API coverage: | ||
| Source: | Code function: | 3_2_0043EDE4 | |
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Code function: | 1_2_004273EC | |
| Source: | Code function: | 0_2_009C8B98 | |
| Source: | Code function: | 1_2_00409798 | |
| Source: | Code function: | 1_2_00405F34 | |
| Source: | Code function: | 2_2_04B4B33C | |
| Source: | Code function: | 3_2_00409798 | |
| Source: | Code function: | 3_2_00405F34 | |
| Source: | API call chain: | graph_2-47130 | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Code function: | 0_2_00AAB46A | |
| Source: | Code function: | 0_2_00AC046C | |
| Source: | Code function: | 2_2_04B4BC1E | |
| Source: | Code function: | 2_2_03000019 | |
| Source: | Code function: | 0_2_00AAB46A | |
| Source: | Code function: | 0_2_00AB4A12 | |
| Source: | Code function: | 1_2_6ED9862C | |
| Source: | Code function: | 2_2_04B605A4 | |
| Source: | Code function: | 2_2_04B58E89 | |
| Source: | Code function: | 3_2_6EE5862C | |
HIPS / PFW / Operating System Protection Evasion | |
|---|
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Code function: | 0_2_00AC2663 | |
| Source: | Code function: | 0_2_00AB0970 | |
| Source: | Code function: | 0_2_00AC2AEB | |
| Source: | Code function: | 0_2_009B1AD1 | |
| Source: | Code function: | 0_2_00AC2B8E | |
| Source: | Code function: | 0_2_00AC2B52 | |
| Source: | Code function: | 1_2_0040610C | |
| Source: | Code function: | 1_2_00406217 | |
| Source: | Code function: | 1_2_0040C46C | |
| Source: | Code function: | 1_2_0040C420 | |
| Source: | Code function: | 1_2_00406A94 | |
| Source: | Code function: | 1_2_0040DB00 | |
| Source: | Code function: | 1_2_6ED9CB7A | |
| Source: | Code function: | 1_2_6ED9C88C | |
| Source: | Code function: | 2_2_0301C300 | |
| Source: | Code function: | 2_2_03027750 | |
| Source: | Code function: | 2_2_03026AF4 | |
| Source: | Code function: | 2_2_0302C81E | |
| Source: | Code function: | 2_2_03024E41 | |
| Source: | Code function: | 2_2_04B64DAD | |
| Source: | Code function: | 2_2_04B6C6B0 | |
| Source: | Code function: | 2_2_04B67E91 | |
| Source: | Code function: | 2_2_04B5D7AC | |
| Source: | Code function: | 2_2_04B67F86 | |
| Source: | Code function: | 2_2_04B68088 | |
| Source: | Code function: | 2_2_04B6802D | |
| Source: | Code function: | 2_2_04B68259 | |
| Source: | Code function: | 2_2_04B683BC | |
| Source: | Code function: | 2_2_04B68380 | |
| Source: | Code function: | 2_2_04B6CBDB | |
| Source: | Code function: | 2_2_04B68319 | |
| Source: | Code function: | 3_2_0040610C | |
| Source: | Code function: | 3_2_00406217 | |
| Source: | Code function: | 3_2_0040C46C | |
| Source: | Code function: | 3_2_0040C420 | |
| Source: | Code function: | 3_2_00406A94 | |
| Source: | Code function: | 3_2_0040DB00 | |
| Source: | Code function: | 3_2_6EE5CB7A | |
| Source: | Code function: | 3_2_6EE5C88C | |
| Source: | Code function: | 3_2_6EE600B0 | |
| Source: | Code function: | 2_2_04B50396 | |
| Source: | Code function: | 0_2_00AB6E0F | |
| Source: | Code function: | 0_2_00ABBE8D | |
| Source: | Code function: | 1_2_00450214 | |
Remote Access Functionality | |
|---|
| Source: | Code function: | 2_2_04B50396 | |
| Source: | Code function: | 2_2_04B5623C | |
| Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Exfiltration | Command and Control | Network Effects | Remote Service Effects | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 Valid Accounts | 2 Native API | 1 Valid Accounts | 1 Valid Accounts | 1 Deobfuscate/Decode Files or Information | 21 Input Capture | 2 System Time Discovery | Remote Services | 1 Archive Collected Data | Exfiltration Over Other Network Medium | 1 Ingress Tool Transfer | Eavesdrop on Insecure Network Communication | Remotely Track Device Without Authorization | Modify System Partition |
| Default Accounts | 1 Command and Scripting Interpreter | 2 Registry Run Keys / Startup Folder | 1 Access Token Manipulation | 2 Obfuscated Files or Information | LSASS Memory | 3 File and Directory Discovery | Remote Desktop Protocol | 1 Screen Capture | Exfiltration Over Bluetooth | 22 Encrypted Channel | Exploit SS7 to Redirect Phone Calls/SMS | Remotely Wipe Data Without Authorization | Device Lockout |
| Domain Accounts | At (Linux) | Logon Script (Windows) | 212 Process Injection | 1 Software Packing | Security Account Manager | 35 System Information Discovery | SMB/Windows Admin Shares | 21 Input Capture | Automated Exfiltration | 1 Non-Standard Port | Exploit SS7 to Track Device Location | Obtain Device Cloud Backups | Delete Device Data |
| Local Accounts | At (Windows) | Logon Script (Mac) | 2 Registry Run Keys / Startup Folder | 11 Masquerading | NTDS | 14 Security Software Discovery | Distributed Component Object Model | 2 Clipboard Data | Scheduled Transfer | 1 Remote Access Software | SIM Card Swap | Carrier Billing Fraud | |
| Cloud Accounts | Cron | Network Logon Script | Network Logon Script | 1 Valid Accounts | LSA Secrets | 2 Process Discovery | SSH | Keylogging | Data Transfer Size Limits | 1 Non-Application Layer Protocol | Manipulate Device Communication | Manipulate App Store Rankings or Ratings | |
| Replication Through Removable Media | Launchd | Rc.common | Rc.common | 1 Access Token Manipulation | Cached Domain Credentials | 11 Application Window Discovery | VNC | GUI Input Capture | Exfiltration Over C2 Channel | 2 Application Layer Protocol | Jamming or Denial of Service | Abuse Accessibility Features | |
| External Remote Services | Scheduled Task | Startup Items | Startup Items | 212 Process Injection | DCSync | Network Sniffing | Windows Remote Management | Web Portal Capture | Exfiltration Over Alternative Protocol | Commonly Used Port | Rogue Wi-Fi Access Points | Data Encrypted for Impact |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 78% | Virustotal | Browse | ||
| 65% | Metadefender | Browse | ||
| 84% | ReversingLabs | Win32.Dropper.RedLeaves | ||
| 100% | Avira | TR/Korplug.dryww |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 100% | Avira | HEUR/AGEN.1226539 | ||
| 8% | Metadefender | Browse | ||
| 9% | ReversingLabs | Win32.PUA.Tsingsoft |
| Source | Detection | Scanner | Label | Link | Download |
|---|---|---|---|---|---|
| 100% | Avira | HEUR/AGEN.1232827 | Download File | ||
| 100% | Avira | HEUR/AGEN.1226539 | Download File | ||
| 100% | Avira | HEUR/AGEN.1226539 | Download File | ||
| 100% | Avira | TR/ATRAPS.Gen | Download File | ||
| 100% | Avira | HEUR/AGEN.1232827 | Download File |
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 1% | Virustotal | Browse | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe |
⊘No contacted domains info
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| true |
| unknown | |
| true |
| unknown | |
| true |
| unknown | |
| true |
| unknown | |
| true |
| unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 144.168.45.116 | unknown | United States | 54540 | INCERO-HVVCUS | false | |
| 67.205.132.17 | unknown | United States | 14061 | DIGITALOCEAN-ASNUS | true |
| IP |
|---|
| 192.168.2.1 |
| Joe Sandbox Version: | 34.0.0 Boulder Opal |
| Analysis ID: | 586425 |
| Start date: | 10.03.2022 |
| Start time: | 07:20:28 |
| Joe Sandbox Product: | CloudBasic |
| Overall analysis duration: | 0h 11m 8s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Sample file name: | cANdLlHS4N (renamed file extension from none to exe) |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211 |
| Number of analysed new started processes analysed: | 14 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Detection: | MAL |
| Classification: | mal100.troj.evad.winEXE@8/4@0/3 |
| EGA Information: |
|
| HDC Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe
- Excluded domains from analysis (whitelisted): fs.microsoft.com
- Not all processes where analyzed, report is missing behavior information
- Report creation exceeded maximum time and may have missing disassembly code information.
- Report size exceeded maximum capacity and may have missing disassembly code.
- Report size getting too big, too many NtOpenKeyEx calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
| Time | Type | Description |
|---|---|---|
| 07:21:35 | Autostart |
⊘No context
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
|---|---|---|---|---|---|
| INCERO-HVVCUS | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| DIGITALOCEAN-ASNUS | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
|
⊘No context
⊘No context
| Process: | C:\Users\user\Desktop\cANdLlHS4N.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 134244 |
| Entropy (8bit): | 6.439912486566814 |
| Encrypted: | false |
| SSDEEP: | 3072:JmeUE3TxGh4MwlW7AzD7Lcv4L2ZbDdlWG/4:Jm7EUhTwljDS4LevXWGg |
| MD5: | A03FFF06A20EE6943154481C883174A8 |
| SHA1: | 4470E24C366AD001ED6FE77B6A09C845D4EF6A86 |
| SHA-256: | 2F3C5A34E0483A5F1739AFAA3E893955F4D81869506A49F28F6A3AC944050900 |
| SHA-512: | DCF944225471940C4C84F31A1409715EB1AE0B68AA1DA21ADCA23477D3C589D8D15213BAA3C105710D532190570C55492885E515220E3B18941096571A292A73 |
| Malicious: | true |
| Yara Hits: |
|
| Antivirus: |
|
| Reputation: | low |
| Preview: |
| Process: | C:\Users\user\Desktop\cANdLlHS4N.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 254593 |
| Entropy (8bit): | 6.992551822422355 |
| Encrypted: | false |
| SSDEEP: | 6144:cMq9yyNTKrkgMEVAUtmEXlW+/xf8GQ6/Ta2QSirGf23YJKRluri9Zoqip3:Q9lNTokREm0mN+/uGQ6/O2orsKHt9Zo1 |
| MD5: | FB0C714CD2EBDCC6F33817ABE7813C36 |
| SHA1: | FC4F3698E768F690425523CDFD548B81D891C3B0 |
| SHA-256: | 773B176B3A68C3D21FAE907AF8FBA7908B55726BD591C5335C8C0BC9DE179B76 |
| SHA-512: | 65EF996A9A9BD47D50F7649C7895D000C943346B17385390B951691CEC07ED7AA487CA3225EE84022B67643F2A574E7DE8C18F81F2576F0BE92BD3930EE9FDC6 |
| Malicious: | false |
| Yara Hits: |
|
| Reputation: | low |
| Preview: |
| Process: | C:\Users\user\Desktop\cANdLlHS4N.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1616040 |
| Entropy (8bit): | 7.373866112987865 |
| Encrypted: | false |
| SSDEEP: | 49152:fFdy58d2Bqc8Y7IDbauSVGDzhGjThGDzhmj8L5NsmCY:fFs58d2Bqc8Y7IDbauSVGDzhGjThGDzo |
| MD5: | 6A1C14D5F16A07BEF55943134FE618C0 |
| SHA1: | 1A46E961BFFC6BCC1ADAC9708393462024F0F6AD |
| SHA-256: | ABA4DF64717462C61801D737C9FA20A7FADA61539EAEF50954331D31F7306D27 |
| SHA-512: | 07A8D9899CE04C4248CEBDFC105A37F3D8A337FF8F498F23853EDD05AC054DD99F976B13B2348660099C9135CE16A0876F7CFDF87E4B7139E88C27F9C598CF9B |
| Malicious: | true |
| Antivirus: |
|
| Reputation: | low |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\persuasion.lnk
Download File
| Process: | C:\Users\user\AppData\Local\Temp\obedience.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1118 |
| Entropy (8bit): | 5.008588795039891 |
| Encrypted: | false |
| SSDEEP: | 24:8mrk3tHwNeRhHgKGUsAwZfaBJ9YC7aB6m:8mrk3tIeRhTrOaBJ9GB6 |
| MD5: | D47E7BF51A9E2A6A44377FBC009DDB8D |
| SHA1: | 4EF66D3777808262BD963A9188EF9C5D4B298AD9 |
| SHA-256: | C755D52F273156F5C8F2D133260A8332C71FB8252398834379588949A8F8AE2D |
| SHA-512: | 0CBA99F6751C04383823984474BF8A23DBD094BEAFE60B9E89BBFE4309822EC65C8E2306EA8D916056826D9A3EDE8691F4444FD7183C7C8A2DA0F14D5FE8D266 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| File type: | |
| Entropy (8bit): | 7.349238472441651 |
| TrID: |
|
| File name: | cANdLlHS4N.exe |
| File size: | 3804160 |
| MD5: | b3139b26a2dabb9b6e728884d8fa8b33 |
| SHA1: | de5672c7940e4fad3c8145ce9e8a5fcb1da0fcee |
| SHA256: | 5262cb9791df50fafcb2fbd5f93226050b51efe400c2924eecba97b7ce437481 |
| SHA512: | f6b857fdb4b393e9e80893d081c46471cb75a92289d53a8d457fe889eee46b7212c5188032aa24400da6e8ba56168716aeb3e48c77758b4fbb74817ba4b13951 |
| SSDEEP: | 98304:drzo0aM7e5O92nAv/tyE6peB1IY8CEueiSH0h292bNcx:pzo0S4yRY8tueiSUh1bCx |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........a...............x\......xL..............vA......vu.[....vt......vE......vB.....Rich....................PE..L...M..X........... |
 | |
| Icon Hash: | e4e4b2b2a4b4b4a4 |
| Entrypoint: | 0x50cf91 |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | 32BIT_MACHINE, EXECUTABLE_IMAGE |
| DLL Characteristics: | TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT |
| Time Stamp: | 0x58ACFA4D [Wed Feb 22 02:41:17 2017 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 5 |
| OS Version Minor: | 1 |
| File Version Major: | 5 |
| File Version Minor: | 1 |
| Subsystem Version Major: | 5 |
| Subsystem Version Minor: | 1 |
| Import Hash: | c20231bee688c91a492f8eb02fe15604 |
| Instruction |
|---|
| call 00007F907CA3EEFEh |
| jmp 00007F907CA34F0Eh |
| mov edi, edi |
| push ebp |
| mov ebp, esp |
| push ebx |
| mov ebx, dword ptr [ebp+08h] |
| cmp ebx, FFFFFFE0h |
| jnbe 00007F907CA350F1h |
| push esi |
| push edi |
| cmp dword ptr [00773A24h], 00000000h |
| jne 00007F907CA3509Ah |
| call 00007F907CA3E88Dh |
| push 0000001Eh |
| call 00007F907CA3E6D7h |
| push 000000FFh |
| call 00007F907CA34A3Fh |
| pop ecx |
| pop ecx |
| test ebx, ebx |
| je 00007F907CA35086h |
| mov eax, ebx |
| jmp 00007F907CA35085h |
| xor eax, eax |
| inc eax |
| push eax |
| push 00000000h |
| push dword ptr [00773A24h] |
| call dword ptr [0053626Ch] |
| mov edi, eax |
| test edi, edi |
| jne 00007F907CA350A8h |
| push 0000000Ch |
| pop esi |
| cmp dword ptr [007742E8h], eax |
| je 00007F907CA3508Fh |
| push ebx |
| call 00007F907CA3E48Bh |
| pop ecx |
| test eax, eax |
| jne 00007F907CA3502Bh |
| jmp 00007F907CA35089h |
| call 00007F907CA35B82h |
| mov dword ptr [eax], esi |
| call 00007F907CA35B7Bh |
| mov dword ptr [eax], esi |
| mov eax, edi |
| pop edi |
| pop esi |
| jmp 00007F907CA35096h |
| push ebx |
| call 00007F907CA3E46Ah |
| pop ecx |
| call 00007F907CA35B67h |
| mov dword ptr [eax], 0000000Ch |
| xor eax, eax |
| pop ebx |
| pop ebp |
| ret |
| mov edi, edi |
| push ebp |
| mov ebp, esp |
| mov eax, dword ptr [ebp+08h] |
| push esi |
| mov esi, ecx |
| mov byte ptr [esi+0Ch], 00000000h |
| test eax, eax |
| jne 00007F907CA350E5h |
| call 00007F907CA3C2C2h |
| mov dword ptr [esi+08h], eax |
| mov ecx, dword ptr [eax+6Ch] |
| mov dword ptr [esi], ecx |
| mov ecx, dword ptr [eax+68h] |
| mov dword ptr [esi+04h], ecx |
| mov ecx, dword ptr [esi] |
| cmp ecx, dword ptr [00000000h] |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x179b14 | 0x168 | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x376000 | 0x9c28 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x380000 | 0x1bb70 | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x160b10 | 0x40 | .rdata |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x136000 | 0x9d0 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x134938 | 0x134a00 | False | 0.562648719117 | data | 6.53626347491 | IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ |
| .rdata | 0x136000 | 0x47062 | 0x47200 | False | 0.270200598638 | data | 5.08185706308 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0x17e000 | 0x1f7724 | 0x1f0200 | False | 0.373334258472 | data | 7.60576445986 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ |
| .rsrc | 0x376000 | 0x9c28 | 0x9e00 | False | 0.375247231013 | data | 5.1750982001 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0x380000 | 0x2aa6e | 0x2ac00 | False | 0.271872715643 | data | 5.04489445576 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country |
|---|---|---|---|---|---|
| RT_CURSOR | 0x376f58 | 0x134 | data | Chinese | China |
| RT_CURSOR | 0x37708c | 0xb4 | data | Chinese | China |
| RT_CURSOR | 0x377140 | 0x134 | AmigaOS bitmap font | Chinese | China |
| RT_CURSOR | 0x377274 | 0x134 | data | Chinese | China |
| RT_CURSOR | 0x3773a8 | 0x134 | data | Chinese | China |
| RT_CURSOR | 0x3774dc | 0x134 | data | Chinese | China |
| RT_CURSOR | 0x377610 | 0x134 | data | Chinese | China |
| RT_CURSOR | 0x377744 | 0x134 | data | Chinese | China |
| RT_CURSOR | 0x377878 | 0x134 | data | Chinese | China |
| RT_CURSOR | 0x3779ac | 0x134 | data | Chinese | China |
| RT_CURSOR | 0x377ae0 | 0x134 | data | Chinese | China |
| RT_CURSOR | 0x377c14 | 0x134 | data | Chinese | China |
| RT_CURSOR | 0x377d48 | 0x134 | AmigaOS bitmap font | Chinese | China |
| RT_CURSOR | 0x377e7c | 0x134 | data | Chinese | China |
| RT_CURSOR | 0x377fb0 | 0x134 | data | Chinese | China |
| RT_CURSOR | 0x3780e4 | 0x134 | data | Chinese | China |
| RT_BITMAP | 0x378218 | 0xb8 | data | Chinese | China |
| RT_BITMAP | 0x3782d0 | 0x144 | data | Chinese | China |
| RT_ICON | 0x378414 | 0x2e8 | dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 2290679807, next used block 8912767 | ||
| RT_ICON | 0x3786fc | 0x128 | GLS_BINARY_LSB_FIRST | ||
| RT_ICON | 0x378824 | 0xea8 | data | ||
| RT_ICON | 0x3796cc | 0x8a8 | dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 0, next used block 0 | ||
| RT_ICON | 0x379f74 | 0x568 | GLS_BINARY_LSB_FIRST | ||
| RT_ICON | 0x37a4dc | 0x25a8 | data | ||
| RT_ICON | 0x37ca84 | 0x10a8 | data | ||
| RT_ICON | 0x37db2c | 0x468 | GLS_BINARY_LSB_FIRST | ||
| RT_ICON | 0x37df94 | 0x2e8 | data | ||
| RT_ICON | 0x37e27c | 0x128 | GLS_BINARY_LSB_FIRST | ||
| RT_MENU | 0x37e3a4 | 0x18c | data | Chinese | China |
| RT_DIALOG | 0x37e530 | 0xd6 | data | ||
| RT_DIALOG | 0x37e608 | 0xe2 | data | Chinese | China |
| RT_DIALOG | 0x37e6ec | 0x34 | data | Chinese | China |
| RT_STRING | 0x37e720 | 0x2e | data | ||
| RT_STRING | 0x37e750 | 0x30 | data | ||
| RT_STRING | 0x37e780 | 0x8e | data | ||
| RT_STRING | 0x37e810 | 0xc0 | data | ||
| RT_STRING | 0x37e8d0 | 0x136 | data | ||
| RT_STRING | 0x37ea08 | 0x3c | data | ||
| RT_STRING | 0x37ea44 | 0x60 | data | ||
| RT_STRING | 0x37eaa4 | 0x54 | data | ||
| RT_STRING | 0x37eaf8 | 0x3a | data | ||
| RT_STRING | 0x37eb34 | 0xa4 | data | ||
| RT_STRING | 0x37ebd8 | 0x3e | data | ||
| RT_STRING | 0x37ec18 | 0x4e | data | Chinese | China |
| RT_STRING | 0x37ec68 | 0x2c | data | Chinese | China |
| RT_STRING | 0x37ec94 | 0x84 | data | Chinese | China |
| RT_STRING | 0x37ed18 | 0x1c4 | data | Chinese | China |
| RT_STRING | 0x37eedc | 0x14e | data | Chinese | China |
| RT_STRING | 0x37f02c | 0x10e | data | Chinese | China |
| RT_STRING | 0x37f13c | 0x50 | data | Chinese | China |
| RT_STRING | 0x37f18c | 0x44 | data | Chinese | China |
| RT_STRING | 0x37f1d0 | 0x68 | data | Chinese | China |
| RT_STRING | 0x37f238 | 0x1b2 | data | Chinese | China |
| RT_STRING | 0x37f3ec | 0xf4 | data | Chinese | China |
| RT_STRING | 0x37f4e0 | 0x24 | data | Chinese | China |
| RT_STRING | 0x37f504 | 0x1a6 | data | Chinese | China |
| RT_ACCELERATOR | 0x37f6ac | 0x68 | data | ||
| RT_GROUP_CURSOR | 0x37f714 | 0x22 | Lotus unknown worksheet or configuration, revision 0x2 | Chinese | China |
| RT_GROUP_CURSOR | 0x37f738 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | Chinese | China |
| RT_GROUP_CURSOR | 0x37f74c | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | Chinese | China |
| RT_GROUP_CURSOR | 0x37f760 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | Chinese | China |
| RT_GROUP_CURSOR | 0x37f774 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | Chinese | China |
| RT_GROUP_CURSOR | 0x37f788 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | Chinese | China |
| RT_GROUP_CURSOR | 0x37f79c | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | Chinese | China |
| RT_GROUP_CURSOR | 0x37f7b0 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | Chinese | China |
| RT_GROUP_CURSOR | 0x37f7c4 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | Chinese | China |
| RT_GROUP_CURSOR | 0x37f7d8 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | Chinese | China |
| RT_GROUP_CURSOR | 0x37f7ec | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | Chinese | China |
| RT_GROUP_CURSOR | 0x37f800 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | Chinese | China |
| RT_GROUP_CURSOR | 0x37f814 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | Chinese | China |
| RT_GROUP_CURSOR | 0x37f828 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | Chinese | China |
| RT_GROUP_CURSOR | 0x37f83c | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | Chinese | China |
| RT_GROUP_ICON | 0x37f850 | 0x76 | data | ||
| RT_GROUP_ICON | 0x37f8c8 | 0x22 | data | ||
| RT_VERSION | 0x37f8ec | 0xdc | data | ||
| RT_MANIFEST | 0x37f9c8 | 0x25f | ASCII text, with very long lines, with no line terminators | English | United States |
| DLL | Import |
|---|---|
| KERNEL32.dll | LCMapStringW, GetTimeZoneInformation, WriteConsoleW, CompareStringW, IsValidLocale, CreateFileW, SetEnvironmentVariableA, GetStringTypeW, IsValidCodePage, GetEnvironmentStringsW, QueryPerformanceCounter, FreeEnvironmentStringsW, GetLocaleInfoW, GetConsoleMode, GetConsoleCP, GetStdHandle, SetHandleCount, HeapCreate, IsDebuggerPresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, GetFileType, SetStdHandle, GetSystemTimeAsFileTime, HeapSize, HeapQueryInformation, HeapReAlloc, VirtualQuery, GetSystemInfo, CreateThread, ExitThread, HeapAlloc, GetStartupInfoW, HeapSetInformation, GetCommandLineA, EncodePointer, DecodePointer, ExitProcess, RaiseException, RtlUnwind, HeapFree, FindResourceExW, SearchPathA, GetProfileIntA, InitializeCriticalSectionAndSpinCount, SetErrorMode, GetNumberFormatA, GetWindowsDirectoryA, GetFileSizeEx, LocalFileTimeToFileTime, GetFileAttributesExA, FileTimeToLocalFileTime, FileTimeToSystemTime, GetShortPathNameA, GetVolumeInformationA, FindFirstFileA, FindClose, GetCurrentProcess, DuplicateHandle, GetFileSize, SetEndOfFile, UnlockFile, LockFile, FlushFileBuffers, SetFilePointer, WriteFile, ReadFile, MoveFileA, CreateFileA, lstrcmpiA, GetThreadLocale, GetStringTypeExA, DeleteFileA, GetCurrentDirectoryA, GetACP, GetOEMCP, GetCPInfo, GetModuleFileNameW, ReleaseActCtx, CreateActCtxW, TlsFree, DeleteCriticalSection, LocalReAlloc, TlsSetValue, TlsAlloc, InitializeCriticalSection, GlobalHandle, GlobalReAlloc, EnterCriticalSection, TlsGetValue, LeaveCriticalSection, LocalAlloc, GlobalFlags, CopyFileA, GlobalSize, FormatMessageA, LocalFree, lstrlenW, MulDiv, GetDiskFreeSpaceA, GetFullPathNameA, GetTempFileNameA, GetFileTime, SetFileTime, ReplaceFileA, SystemTimeToFileTime, GetFileAttributesA, GetUserDefaultLCID, GlobalFree, GetPrivateProfileStringA, WritePrivateProfileStringA, GetPrivateProfileIntA, WaitForSingleObject, ResumeThread, SetThreadPriority, GetCurrentThread, GetUserDefaultUILanguage, ConvertDefaultLocale, GetSystemDefaultUILanguage, GetModuleFileNameA, GetLocaleInfoA, InterlockedExchange, lstrcmpA, GlobalAlloc, GetModuleHandleW, FindResourceA, FreeResource, GetCurrentThreadId, GlobalFindAtomA, GlobalDeleteAtom, GetVersionExA, FreeLibrary, CompareStringA, LoadLibraryW, lstrcmpW, GlobalLock, GlobalUnlock, GetCurrentProcessId, GetProcAddress, GetModuleHandleA, LoadLibraryA, lstrlenA, GlobalGetAtomNameA, GlobalAddAtomA, ActivateActCtx, DeactivateActCtx, SetLastError, FindResourceW, LoadResource, LockResource, SizeofResource, InterlockedDecrement, InterlockedIncrement, CreateMutexA, GetLastError, WideCharToMultiByte, GetTempPathA, CreateProcessA, GetTickCount, VirtualAlloc, lstrcpyA, lstrcatA, MultiByteToWideChar, Sleep, CreateToolhelp32Snapshot, Process32First, Process32Next, CloseHandle, EnumSystemLocalesA, VirtualProtect, GetProcessHeap |
| USER32.dll | CharUpperA, KillTimer, SetTimer, UnionRect, SetParent, GetSystemMenu, DeleteMenu, IsRectEmpty, LoadCursorW, SetLayeredWindowAttributes, EnumDisplayMonitors, LoadCursorA, GetSysColorBrush, MapVirtualKeyA, GetKeyNameTextA, SystemParametersInfoA, GetSystemMetrics, GetMenuItemInfoA, InflateRect, RealChildWindowFromPoint, EndPaint, BeginPaint, GetWindowDC, ClientToScreen, GrayStringA, DrawTextExA, DrawTextA, TabbedTextOutA, FillRect, GetMenuStringA, AppendMenuA, InsertMenuA, RemoveMenu, GetDC, ReleaseDC, SetWindowContextHelpId, MapDialogRect, CreateDialogIndirectParamA, GetNextDlgTabItem, EndDialog, ShowOwnedPopups, GetMessageA, TranslateMessage, GetCursorPos, ValidateRect, PostQuitMessage, MoveWindow, SetWindowTextA, IsDialogMessageA, CheckDlgButton, SetMenuItemBitmaps, GetMenuCheckMarkDimensions, LoadBitmapW, ModifyMenuA, GetMenuState, EnableMenuItem, CheckMenuItem, RegisterWindowMessageA, LoadIconA, SendDlgItemMessageA, IsChild, SetWindowsHookExA, CallNextHookEx, GetClassLongA, SetPropA, GetPropA, RemovePropA, GetFocus, GetWindowTextLengthA, GetWindowTextA, GetForegroundWindow, DispatchMessageA, BeginDeferWindowPos, EndDeferWindowPos, GetTopWindow, DestroyWindow, UnhookWindowsHookEx, CloseClipboard, GetMessagePos, GetMonitorInfoA, MapWindowPoints, ScrollWindow, TrackPopupMenu, SetScrollRange, GetScrollRange, SetScrollPos, GetScrollPos, SetForegroundWindow, ShowScrollBar, MessageBoxA, CreateWindowExA, GetClassInfoExA, RegisterClassA, AdjustWindowRectEx, GetWindowRect, ScreenToClient, DeferWindowPos, GetScrollInfo, SetScrollInfo, SetWindowPlacement, GetWindowPlacement, DefWindowProcA, CallWindowProcA, GetClassNameA, GetSysColor, UnpackDDElParam, ReuseDDElParam, LoadMenuA, DestroyMenu, WinHelpA, SetWindowPos, LoadImageA, DestroyIcon, SetFocus, GetWindowThreadProcessId, GetActiveWindow, IsWindowEnabled, EqualRect, GetDlgItem, SetWindowLongA, GetDlgCtrlID, GetKeyState, LoadIconW, SetCursor, PeekMessageA, GetCapture, ReleaseCapture, SetClipboardData, OpenClipboard, GetUpdateRect, LoadAcceleratorsA, GetParent, UpdateWindow, EnableWindow, PtInRect, GetClientRect, FrameRect, SetActiveWindow, IsWindowVisible, IsIconic, SendMessageA, InsertMenuItemA, GetSubMenu, GetMenuItemID, GetMenuItemCount, CreatePopupMenu, GetClassInfoA, IntersectRect, OffsetRect, SetRectEmpty, CopyRect, GetMenu, GetLastActivePopup, LoadAcceleratorsW, LoadMenuW, CharNextA, CopyAcceleratorTableA, SetRect, GetWindowRgn, DestroyCursor, DrawIcon, SubtractRect, MapVirtualKeyExA, BringWindowToTop, PostMessageA, SetMenu, GetDesktopWindow, GetWindow, ShowWindow, GetWindowLongA, IsWindow, TranslateAcceleratorA, InvalidateRect, IsCharLowerA, GetDoubleClickTime, CharUpperBuffA, CopyIcon, LoadImageW, MonitorFromWindow, EmptyClipboard, IsClipboardFormatAvailable, SetMenuDefaultItem, WaitMessage, PostThreadMessageA, CreateMenu, IsMenu, UpdateLayeredWindow, MonitorFromPoint, InvalidateRgn, DrawMenuBar, DefMDIChildProcA, DefFrameProcA, RegisterClipboardFormatA, CopyImage, GetIconInfo, EnableScrollBar, HideCaret, InvertRect, GetMenuDefaultItem, LockWindowUpdate, SetCursorPos, CreateAcceleratorTableA, GetKeyboardState, GetKeyboardLayout, ToAsciiEx, DrawFocusRect, DrawFrameControl, DrawEdge, DrawIconEx, DrawStateA, SetClassLongA, GetAsyncKeyState, NotifyWinEvent, WindowFromPoint, DestroyAcceleratorTable, RedrawWindow, SetWindowRgn, IsZoomed, UnregisterClassA, MessageBeep, GetNextDlgGroupItem, GetMessageTime, SetCapture, TranslateMDISysAccel |
| GDI32.dll | GetLayout, SetLayout, DeleteObject, SelectClipRgn, CreateRectRgn, GetViewportExtEx, GetWindowExtEx, BitBlt, GetPixel, PtVisible, RectVisible, TextOutA, ExtTextOutA, Escape, SelectObject, SetViewportOrgEx, OffsetViewportOrgEx, SetViewportExtEx, ScaleViewportExtEx, SetWindowOrgEx, OffsetWindowOrgEx, SetWindowExtEx, ScaleWindowExtEx, ExtSelectClipRgn, DeleteDC, CreatePatternBrush, GetStockObject, SelectPalette, GetObjectType, CreatePen, CreateSolidBrush, CreateHatchBrush, GetTextExtentPoint32A, CreateRectRgnIndirect, PatBlt, CreateDIBitmap, GetTextMetricsA, EnumFontFamiliesA, GetTextCharsetInfo, CombineRgn, GetMapMode, DPtoLP, GetBkColor, GetTextColor, GetRgnBox, CreateDIBSection, CreateRoundRectRgn, CreatePolygonRgn, CreateEllipticRgn, Polyline, Polygon, CreatePalette, GetPaletteEntries, GetNearestPaletteIndex, RealizePalette, GetSystemPaletteEntries, OffsetRgn, SetDIBColorTable, StretchBlt, SetPixel, Rectangle, EnumFontFamiliesExA, LPtoDP, GetWindowOrgEx, GetViewportOrgEx, PtInRegion, FillRgn, FrameRgn, GetBoundsRect, ExtFloodFill, SetPaletteEntries, GetTextFaceA, SetPixelV, MoveToEx, SetTextAlign, LineTo, IntersectClipRect, ExcludeClipRect, GetClipBox, SetMapMode, SetROP2, SetPolyFillMode, SetBkMode, RestoreDC, SaveDC, CreateDCA, CopyMetaFileA, GetDeviceCaps, CreateFontIndirectA, CreateBitmap, GetObjectA, SetBkColor, SetTextColor, CreateCompatibleDC, SetRectRgn, Ellipse, CreateCompatibleBitmap |
| MSIMG32.dll | AlphaBlend, TransparentBlt |
| COMDLG32.dll | GetFileTitleA |
| WINSPOOL.DRV | OpenPrinterA, DocumentPropertiesA, ClosePrinter |
| ADVAPI32.dll | RegEnumValueA, RegQueryValueExA, RegOpenKeyExA, RegCreateKeyExA, RegSetValueExA, RegDeleteValueA, RegDeleteKeyA, RegEnumKeyA, RegQueryValueA, RegEnumKeyExA, RegOpenKeyExW, RegCloseKey, RegSetValueA, GetFileSecurityA, SetFileSecurityA |
| SHELL32.dll | SHAppBarMessage, ShellExecuteA, DragFinish, DragQueryFileA, SHAddToRecentDocs, ExtractIconA, SHBrowseForFolderA, SHGetSpecialFolderPathA, SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHGetDesktopFolder, SHGetFileInfoA |
| COMCTL32.dll | ImageList_GetIconSize |
| SHLWAPI.dll | PathFindFileNameA, PathStripToRootA, PathIsUNCA, PathFindExtensionA, PathRemoveFileSpecW |
| ole32.dll | OleIsCurrentClipboard, OleLockRunning, IsAccelerator, OleTranslateAccelerator, OleDestroyMenuDescriptor, OleCreateMenuDescriptor, OleInitialize, CoFreeUnusedLibraries, OleUninitialize, CoInitializeEx, CreateStreamOnHGlobal, CreateILockBytesOnHGlobal, StgCreateDocfileOnILockBytes, CoGetClassObject, OleFlushClipboard, OleDuplicateData, ReleaseStgMedium, StringFromCLSID, CoTaskMemFree, CoTaskMemAlloc, CLSIDFromString, CoCreateGuid, CLSIDFromProgID, CoInitialize, CoCreateInstance, CoUninitialize, DoDragDrop, RevokeDragDrop, CoLockObjectExternal, RegisterDragDrop, OleGetClipboard, CoRegisterMessageFilter, CoRevokeClassObject, StgOpenStorageOnILockBytes |
| OLEAUT32.dll | SysStringLen, OleCreateFontIndirect, VariantTimeToSystemTime, SystemTimeToVariantTime, SafeArrayDestroy, VariantCopy, VarBstrFromDate, SysAllocStringByteLen, SysFreeString, VariantChangeType, SysAllocStringLen, VariantInit, VariantClear, SysAllocString |
| oledlg.dll | |
| OLEACC.dll | AccessibleObjectFromWindow, CreateStdAccessibleObject, LresultFromObject |
| gdiplus.dll | GdipGetImageGraphicsContext, GdipBitmapUnlockBits, GdipBitmapLockBits, GdipCreateBitmapFromScan0, GdipCreateBitmapFromStream, GdipGetImagePalette, GdipGetImagePaletteSize, GdipGetImagePixelFormat, GdipGetImageHeight, GdipGetImageWidth, GdipCloneImage, GdipDrawImageRectI, GdipSetInterpolationMode, GdipCreateFromHDC, GdiplusShutdown, GdiplusStartup, GdipCreateBitmapFromHBITMAP, GdipDisposeImage, GdipDeleteGraphics, GdipAlloc, GdipFree, GdipDrawImageI |
| IMM32.dll | ImmReleaseContext, ImmGetContext, ImmGetOpenStatus |
| WINMM.dll | PlaySoundA |
| Description | Data |
|---|---|
| Translation | 0x0009 0x04b0 |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| Chinese | China |  |
| English | United States |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | Protocol | SID | Message | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|---|---|---|
| 03/10/22-07:23:02.013122 | TCP | 2024173 | ET TROJAN Red Leaves magic packet detected (APT10 implant) | 49764 | 80 | 192.168.2.4 | 67.205.132.17 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Mar 10, 2022 07:21:37.608027935 CET | 49736 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:21:37.608115911 CET | 443 | 49736 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:21:37.608268023 CET | 49736 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:21:37.608624935 CET | 49736 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:21:37.608640909 CET | 443 | 49736 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:21:37.608659029 CET | 49736 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:21:37.608669996 CET | 443 | 49736 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:21:37.608793974 CET | 443 | 49736 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:21:42.973103046 CET | 49737 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:21:42.973156929 CET | 443 | 49737 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:21:42.973328114 CET | 49737 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:21:42.974839926 CET | 49737 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:21:42.974857092 CET | 443 | 49737 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:21:42.974925041 CET | 443 | 49737 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:21:42.974950075 CET | 49737 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:21:42.974972963 CET | 443 | 49737 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:21:42.976782084 CET | 49738 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:21:42.976818085 CET | 443 | 49738 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:21:42.976900101 CET | 49738 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:21:42.977200031 CET | 49738 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:21:42.977219105 CET | 443 | 49738 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:21:42.977279902 CET | 49738 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:21:42.977293015 CET | 443 | 49738 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:21:42.977401018 CET | 443 | 49738 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:21:42.992253065 CET | 49739 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:21:42.992326021 CET | 443 | 49739 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:21:42.992415905 CET | 49739 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:21:42.993453026 CET | 49739 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:21:42.993479013 CET | 443 | 49739 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:21:42.993547916 CET | 443 | 49739 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:21:42.995389938 CET | 49740 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:21:42.995440960 CET | 443 | 49740 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:21:42.995537996 CET | 49740 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:21:42.995886087 CET | 49740 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:21:42.995913029 CET | 443 | 49740 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:21:42.995955944 CET | 443 | 49740 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:21:42.995991945 CET | 49740 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:21:42.996011972 CET | 443 | 49740 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:21:42.997436047 CET | 49741 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:21:42.997484922 CET | 443 | 49741 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:21:42.998003960 CET | 49741 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:21:42.998060942 CET | 49741 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:21:42.998078108 CET | 443 | 49741 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:21:42.998094082 CET | 49741 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:21:42.998102903 CET | 443 | 49741 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:21:42.998209000 CET | 443 | 49741 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:21:53.106363058 CET | 49743 | 443 | 192.168.2.4 | 144.168.45.116 |
| Mar 10, 2022 07:21:53.106456041 CET | 443 | 49743 | 144.168.45.116 | 192.168.2.4 |
| Mar 10, 2022 07:21:53.106570959 CET | 49743 | 443 | 192.168.2.4 | 144.168.45.116 |
| Mar 10, 2022 07:21:53.108678102 CET | 49743 | 443 | 192.168.2.4 | 144.168.45.116 |
| Mar 10, 2022 07:21:53.108748913 CET | 443 | 49743 | 144.168.45.116 | 192.168.2.4 |
| Mar 10, 2022 07:21:53.108772039 CET | 49743 | 443 | 192.168.2.4 | 144.168.45.116 |
| Mar 10, 2022 07:21:53.108789921 CET | 443 | 49743 | 144.168.45.116 | 192.168.2.4 |
| Mar 10, 2022 07:21:53.108952999 CET | 443 | 49743 | 144.168.45.116 | 192.168.2.4 |
| Mar 10, 2022 07:22:03.153788090 CET | 49746 | 53 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:22:06.168540955 CET | 49746 | 53 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:22:12.184732914 CET | 49746 | 53 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:22:12.366229057 CET | 49747 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:22:12.366271973 CET | 443 | 49747 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:22:12.366451979 CET | 49747 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:22:12.366818905 CET | 49747 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:22:12.366833925 CET | 443 | 49747 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:22:12.366939068 CET | 443 | 49747 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:22:12.368575096 CET | 49748 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:22:12.368624926 CET | 443 | 49748 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:22:12.368717909 CET | 49748 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:22:12.369051933 CET | 49748 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:22:12.369082928 CET | 443 | 49748 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:22:12.369129896 CET | 443 | 49748 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:22:12.369153023 CET | 49748 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:22:12.369174957 CET | 443 | 49748 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:22:12.370532990 CET | 49749 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:22:12.370563984 CET | 443 | 49749 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:22:12.370745897 CET | 49749 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:22:12.372329950 CET | 49749 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:22:12.372349024 CET | 443 | 49749 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:22:12.372400045 CET | 443 | 49749 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:22:12.372473955 CET | 49749 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:22:12.372488022 CET | 443 | 49749 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:22:12.374878883 CET | 49750 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:22:12.374902964 CET | 443 | 49750 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:22:12.374969959 CET | 49750 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:22:12.375251055 CET | 49750 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:22:12.375267029 CET | 443 | 49750 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:22:12.375308990 CET | 443 | 49750 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:22:12.375382900 CET | 49750 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:22:12.375394106 CET | 443 | 49750 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:22:12.396006107 CET | 49751 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:22:12.396064997 CET | 443 | 49751 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:22:12.396150112 CET | 49751 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:22:12.396461010 CET | 49751 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:22:12.396492958 CET | 443 | 49751 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:22:12.396565914 CET | 443 | 49751 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:22:22.436521053 CET | 49756 | 443 | 192.168.2.4 | 144.168.45.116 |
| Mar 10, 2022 07:22:22.436614990 CET | 443 | 49756 | 144.168.45.116 | 192.168.2.4 |
| Mar 10, 2022 07:22:22.436717033 CET | 49756 | 443 | 192.168.2.4 | 144.168.45.116 |
| Mar 10, 2022 07:22:22.437103033 CET | 49756 | 443 | 192.168.2.4 | 144.168.45.116 |
| Mar 10, 2022 07:22:22.437125921 CET | 443 | 49756 | 144.168.45.116 | 192.168.2.4 |
| Mar 10, 2022 07:22:22.437145948 CET | 49756 | 443 | 192.168.2.4 | 144.168.45.116 |
| Mar 10, 2022 07:22:22.437156916 CET | 443 | 49756 | 144.168.45.116 | 192.168.2.4 |
| Mar 10, 2022 07:22:22.437196016 CET | 443 | 49756 | 144.168.45.116 | 192.168.2.4 |
| Mar 10, 2022 07:22:32.485387087 CET | 49757 | 995 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:22:35.499186993 CET | 49757 | 995 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:22:41.499576092 CET | 49757 | 995 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:22:41.756865025 CET | 49758 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:22:41.756936073 CET | 443 | 49758 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:22:41.757055998 CET | 49758 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:22:41.757384062 CET | 49758 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:22:41.757410049 CET | 443 | 49758 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:22:41.757497072 CET | 443 | 49758 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:22:41.757600069 CET | 49758 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:22:41.757621050 CET | 443 | 49758 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:22:41.759078026 CET | 49759 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:22:41.759146929 CET | 443 | 49759 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:22:41.760272026 CET | 49759 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:22:41.760591984 CET | 49759 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:22:41.760622978 CET | 443 | 49759 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:22:41.760663986 CET | 49759 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:22:41.760668039 CET | 443 | 49759 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:22:41.760693073 CET | 443 | 49759 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:22:41.762319088 CET | 49760 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:22:41.762377024 CET | 443 | 49760 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:22:41.762454033 CET | 49760 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:22:41.762743950 CET | 49760 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:22:41.762769938 CET | 443 | 49760 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:22:41.762810946 CET | 443 | 49760 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:22:41.762919903 CET | 49760 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:22:41.762937069 CET | 443 | 49760 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:22:41.764241934 CET | 49761 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:22:41.764287949 CET | 443 | 49761 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:22:41.764377117 CET | 49761 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:22:41.764647961 CET | 49761 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:22:41.764672995 CET | 443 | 49761 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:22:41.764715910 CET | 443 | 49761 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:22:41.764782906 CET | 49761 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:22:41.764801979 CET | 443 | 49761 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:22:41.821080923 CET | 49762 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:22:41.821141005 CET | 443 | 49762 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:22:41.821234941 CET | 49762 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:22:41.821583033 CET | 49762 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:22:41.821615934 CET | 443 | 49762 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:22:41.821687937 CET | 443 | 49762 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:22:41.821732998 CET | 49762 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:22:41.821763039 CET | 443 | 49762 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:22:51.860562086 CET | 49763 | 443 | 192.168.2.4 | 144.168.45.116 |
| Mar 10, 2022 07:22:51.860620022 CET | 443 | 49763 | 144.168.45.116 | 192.168.2.4 |
| Mar 10, 2022 07:22:51.860721111 CET | 49763 | 443 | 192.168.2.4 | 144.168.45.116 |
| Mar 10, 2022 07:22:51.861187935 CET | 49763 | 443 | 192.168.2.4 | 144.168.45.116 |
| Mar 10, 2022 07:22:51.861203909 CET | 443 | 49763 | 144.168.45.116 | 192.168.2.4 |
| Mar 10, 2022 07:22:51.861249924 CET | 443 | 49763 | 144.168.45.116 | 192.168.2.4 |
| Mar 10, 2022 07:22:51.861258984 CET | 49763 | 443 | 192.168.2.4 | 144.168.45.116 |
| Mar 10, 2022 07:22:51.861270905 CET | 443 | 49763 | 144.168.45.116 | 192.168.2.4 |
| Mar 10, 2022 07:23:01.908960104 CET | 49764 | 80 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:02.012634039 CET | 80 | 49764 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:02.012759924 CET | 49764 | 80 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:02.013122082 CET | 49764 | 80 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:02.013169050 CET | 49764 | 80 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:02.116442919 CET | 80 | 49764 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:02.116471052 CET | 80 | 49764 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:02.116496086 CET | 80 | 49764 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:02.116514921 CET | 80 | 49764 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:02.116650105 CET | 49764 | 80 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:07.486567020 CET | 49765 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:07.486629963 CET | 443 | 49765 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:07.486742973 CET | 49765 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:07.487189054 CET | 49765 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:07.487215042 CET | 443 | 49765 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:07.487267971 CET | 49765 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:07.487281084 CET | 443 | 49765 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:07.487313032 CET | 443 | 49765 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:07.488965988 CET | 49766 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:07.488998890 CET | 443 | 49766 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:07.489103079 CET | 49766 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:07.489439964 CET | 49766 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:07.489464998 CET | 443 | 49766 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:07.489515066 CET | 443 | 49766 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:07.489613056 CET | 49766 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:07.489633083 CET | 443 | 49766 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:07.491219997 CET | 49767 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:07.491257906 CET | 443 | 49767 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:07.491483927 CET | 49767 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:07.491816044 CET | 49767 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:07.491835117 CET | 443 | 49767 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:07.491875887 CET | 443 | 49767 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:07.492024899 CET | 49767 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:07.492069006 CET | 443 | 49767 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:07.493947029 CET | 49768 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:07.494015932 CET | 443 | 49768 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:07.497068882 CET | 49768 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:07.497479916 CET | 49768 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:07.497514963 CET | 443 | 49768 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:07.497564077 CET | 49768 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:07.497575998 CET | 443 | 49768 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:07.497601032 CET | 443 | 49768 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:07.499073982 CET | 49769 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:07.499128103 CET | 443 | 49769 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:07.502388954 CET | 49769 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:07.508974075 CET | 49769 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:07.509027958 CET | 443 | 49769 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:07.509052038 CET | 49769 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:07.509063959 CET | 443 | 49769 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:07.509160995 CET | 443 | 49769 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:12.533687115 CET | 49764 | 80 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:17.550909042 CET | 49770 | 443 | 192.168.2.4 | 144.168.45.116 |
| Mar 10, 2022 07:23:17.550981998 CET | 443 | 49770 | 144.168.45.116 | 192.168.2.4 |
| Mar 10, 2022 07:23:17.551107883 CET | 49770 | 443 | 192.168.2.4 | 144.168.45.116 |
| Mar 10, 2022 07:23:17.551667929 CET | 49770 | 443 | 192.168.2.4 | 144.168.45.116 |
| Mar 10, 2022 07:23:17.551698923 CET | 443 | 49770 | 144.168.45.116 | 192.168.2.4 |
| Mar 10, 2022 07:23:17.551769018 CET | 49770 | 443 | 192.168.2.4 | 144.168.45.116 |
| Mar 10, 2022 07:23:17.551795959 CET | 443 | 49770 | 144.168.45.116 | 192.168.2.4 |
| Mar 10, 2022 07:23:27.600503922 CET | 49771 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:27.600574970 CET | 443 | 49771 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:27.601896048 CET | 49771 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:27.602406979 CET | 49771 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:27.602438927 CET | 443 | 49771 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:27.602456093 CET | 49771 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:27.602464914 CET | 443 | 49771 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:27.602531910 CET | 443 | 49771 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:32.737730026 CET | 49772 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:32.737780094 CET | 443 | 49772 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:32.737865925 CET | 49772 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:32.738704920 CET | 49772 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:32.738723040 CET | 443 | 49772 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:32.738790035 CET | 49772 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:32.738800049 CET | 443 | 49772 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:32.738898039 CET | 443 | 49772 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:32.741889000 CET | 49773 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:32.741935968 CET | 443 | 49773 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:32.742029905 CET | 49773 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:32.745321989 CET | 49773 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:32.745356083 CET | 443 | 49773 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:32.745388985 CET | 443 | 49773 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:32.747672081 CET | 49774 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:32.747715950 CET | 443 | 49774 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:32.747786045 CET | 49774 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:32.748333931 CET | 49774 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:32.748358965 CET | 443 | 49774 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:32.748398066 CET | 443 | 49774 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:32.748428106 CET | 49774 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:32.748446941 CET | 443 | 49774 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:32.750837088 CET | 49775 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:32.750869989 CET | 443 | 49775 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:32.750950098 CET | 49775 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:32.760200977 CET | 49775 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:32.760236025 CET | 443 | 49775 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:32.760302067 CET | 443 | 49775 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:32.764406919 CET | 49776 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:32.764461040 CET | 443 | 49776 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:32.764542103 CET | 49776 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:32.765038967 CET | 49776 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:32.765058041 CET | 443 | 49776 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:32.765125036 CET | 443 | 49776 | 67.205.132.17 | 192.168.2.4 |
| Mar 10, 2022 07:23:32.765129089 CET | 49776 | 443 | 192.168.2.4 | 67.205.132.17 |
| Mar 10, 2022 07:23:32.765146017 CET | 443 | 49776 | 67.205.132.17 | 192.168.2.4 |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 0 | 192.168.2.4 | 49737 | 67.205.132.17 | 443 | C:\Program Files (x86)\Internet Explorer\iexplore.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 10, 2022 07:21:42.974839926 CET | 838 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 1 | 192.168.2.4 | 49738 | 67.205.132.17 | 443 | C:\Program Files (x86)\Internet Explorer\iexplore.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 10, 2022 07:21:42.977200031 CET | 838 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 10 | 192.168.2.4 | 49758 | 67.205.132.17 | 443 | C:\Program Files (x86)\Internet Explorer\iexplore.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 10, 2022 07:22:41.757384062 CET | 1124 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 11 | 192.168.2.4 | 49759 | 67.205.132.17 | 443 | C:\Program Files (x86)\Internet Explorer\iexplore.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 10, 2022 07:22:41.760591984 CET | 1125 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 12 | 192.168.2.4 | 49760 | 67.205.132.17 | 443 | C:\Program Files (x86)\Internet Explorer\iexplore.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 10, 2022 07:22:41.762743950 CET | 1126 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 13 | 192.168.2.4 | 49761 | 67.205.132.17 | 443 | C:\Program Files (x86)\Internet Explorer\iexplore.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 10, 2022 07:22:41.764647961 CET | 1126 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 14 | 192.168.2.4 | 49762 | 67.205.132.17 | 443 | C:\Program Files (x86)\Internet Explorer\iexplore.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 10, 2022 07:22:41.821583033 CET | 1127 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 15 | 192.168.2.4 | 49764 | 67.205.132.17 | 80 | C:\Program Files (x86)\Internet Explorer\iexplore.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 10, 2022 07:23:02.013122082 CET | 1128 | OUT | |
| Mar 10, 2022 07:23:02.013169050 CET | 1128 | OUT | |
| Mar 10, 2022 07:23:02.116496086 CET | 1129 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 16 | 192.168.2.4 | 49765 | 67.205.132.17 | 443 | C:\Program Files (x86)\Internet Explorer\iexplore.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 10, 2022 07:23:07.487189054 CET | 1129 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 17 | 192.168.2.4 | 49766 | 67.205.132.17 | 443 | C:\Program Files (x86)\Internet Explorer\iexplore.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 10, 2022 07:23:07.489439964 CET | 1130 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 18 | 192.168.2.4 | 49767 | 67.205.132.17 | 443 | C:\Program Files (x86)\Internet Explorer\iexplore.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 10, 2022 07:23:07.491816044 CET | 1131 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 19 | 192.168.2.4 | 49768 | 67.205.132.17 | 443 | C:\Program Files (x86)\Internet Explorer\iexplore.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 10, 2022 07:23:07.497479916 CET | 1131 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 2 | 192.168.2.4 | 49739 | 67.205.132.17 | 443 | C:\Program Files (x86)\Internet Explorer\iexplore.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 10, 2022 07:21:42.993453026 CET | 839 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 20 | 192.168.2.4 | 49769 | 67.205.132.17 | 443 | C:\Program Files (x86)\Internet Explorer\iexplore.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 10, 2022 07:23:07.508974075 CET | 1132 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 21 | 192.168.2.4 | 49772 | 67.205.132.17 | 443 | C:\Program Files (x86)\Internet Explorer\iexplore.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 10, 2022 07:23:32.738704920 CET | 1135 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 22 | 192.168.2.4 | 49773 | 67.205.132.17 | 443 | C:\Program Files (x86)\Internet Explorer\iexplore.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 10, 2022 07:23:32.745321989 CET | 1136 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 23 | 192.168.2.4 | 49774 | 67.205.132.17 | 443 | C:\Program Files (x86)\Internet Explorer\iexplore.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 10, 2022 07:23:32.748333931 CET | 1136 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 24 | 192.168.2.4 | 49775 | 67.205.132.17 | 443 | C:\Program Files (x86)\Internet Explorer\iexplore.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 10, 2022 07:23:32.760200977 CET | 1137 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 25 | 192.168.2.4 | 49776 | 67.205.132.17 | 443 | C:\Program Files (x86)\Internet Explorer\iexplore.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 10, 2022 07:23:32.765038967 CET | 1138 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 3 | 192.168.2.4 | 49740 | 67.205.132.17 | 443 | C:\Program Files (x86)\Internet Explorer\iexplore.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 10, 2022 07:21:42.995886087 CET | 840 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 4 | 192.168.2.4 | 49741 | 67.205.132.17 | 443 | C:\Program Files (x86)\Internet Explorer\iexplore.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 10, 2022 07:21:42.998060942 CET | 840 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 5 | 192.168.2.4 | 49747 | 67.205.132.17 | 443 | C:\Program Files (x86)\Internet Explorer\iexplore.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 10, 2022 07:22:12.366818905 CET | 1112 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 6 | 192.168.2.4 | 49748 | 67.205.132.17 | 443 | C:\Program Files (x86)\Internet Explorer\iexplore.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 10, 2022 07:22:12.369051933 CET | 1112 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 7 | 192.168.2.4 | 49749 | 67.205.132.17 | 443 | C:\Program Files (x86)\Internet Explorer\iexplore.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 10, 2022 07:22:12.372329950 CET | 1113 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 8 | 192.168.2.4 | 49750 | 67.205.132.17 | 443 | C:\Program Files (x86)\Internet Explorer\iexplore.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 10, 2022 07:22:12.375251055 CET | 1114 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 9 | 192.168.2.4 | 49751 | 67.205.132.17 | 443 | C:\Program Files (x86)\Internet Explorer\iexplore.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 10, 2022 07:22:12.396461010 CET | 1114 | OUT |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 07:21:31 |
| Start date: | 10/03/2022 |
| Path: | C:\Users\user\Desktop\cANdLlHS4N.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x9a0000 |
| File size: | 3804160 bytes |
| MD5 hash: | B3139B26A2DABB9B6E728884D8FA8B33 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | low |
| Target ID: | 1 |
| Start time: | 07:21:33 |
| Start date: | 10/03/2022 |
| Path: | C:\Users\user\AppData\Local\Temp\obedience.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 1616040 bytes |
| MD5 hash: | 6A1C14D5F16A07BEF55943134FE618C0 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | Borland Delphi |
| Yara matches: |
|
| Antivirus matches: |
|
| Reputation: | low |
| Target ID: | 2 |
| Start time: | 07:21:35 |
| Start date: | 10/03/2022 |
| Path: | C:\Program Files (x86)\Internet Explorer\iexplore.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x920000 |
| File size: | 822536 bytes |
| MD5 hash: | 071277CC2E3DF41EEEA8013E2AB58D5A |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | high |
| Target ID: | 3 |
| Start time: | 07:21:44 |
| Start date: | 10/03/2022 |
| Path: | C:\Users\user\AppData\Local\Temp\obedience.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 1616040 bytes |
| MD5 hash: | 6A1C14D5F16A07BEF55943134FE618C0 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | Borland Delphi |
| Yara matches: |
|
| Reputation: | low |
| Target ID: | 4 |
| Start time: | 07:21:46 |
| Start date: | 10/03/2022 |
| Path: | C:\Program Files (x86)\Internet Explorer\iexplore.exe |
| Wow64 process (32bit): | |
| Commandline: | |
| Imagebase: | |
| File size: | 822536 bytes |
| MD5 hash: | 071277CC2E3DF41EEEA8013E2AB58D5A |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
Execution Graph
| Execution Coverage: | 9.2% |
| Dynamic/Decrypted Code Coverage: | 0% |
| Signature Coverage: | 2.1% |
| Total number of Nodes: | 1408 |
| Total number of Limit Nodes: | 52 |
Graph
Function 009A13B0 Relevance: 36.9, APIs: 19, Strings: 2, Instructions: 180stringcomsleepCOMMON
Download Yara Rule
Control-flow Graph
| C-Code - Quality: 68% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009A12C0 Relevance: 7.6, APIs: 5, Instructions: 81processCOMMON
Download Yara Rule
| C-Code - Quality: 79% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009BF8B8 Relevance: 64.8, APIs: 43, Instructions: 304COMMON
Download Yara Rule
Control-flow Graph
| C-Code - Quality: 95% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Control-flow Graph
| C-Code - Quality: 93% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009A3DF0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 173stringprocessCOMMON
Download Yara Rule
Control-flow Graph
| C-Code - Quality: 81% |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009BC9BB Relevance: 16.6, APIs: 11, Instructions: 106memoryCOMMONLIBRARYCODE
Download Yara Rule
Control-flow Graph
| C-Code - Quality: 88% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Control-flow Graph
| C-Code - Quality: 97% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009A3C20 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 142memoryCOMMON
Download Yara Rule
Control-flow Graph
| C-Code - Quality: 78% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009A47D0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 104synchronizationCOMMON
Download Yara Rule
Control-flow Graph
| C-Code - Quality: 81% |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Control-flow Graph
| C-Code - Quality: 92% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Control-flow Graph
| C-Code - Quality: 89% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009BE5F2 Relevance: 12.0, APIs: 8, Instructions: 39COMMON
Download Yara Rule
Control-flow Graph
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Control-flow Graph
| C-Code - Quality: 77% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009B333D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 78registryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Control-flow Graph
| C-Code - Quality: 24% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009C9BDB Relevance: 9.1, APIs: 6, Instructions: 72windowCOMMON
Download Yara Rule
Control-flow Graph
| C-Code - Quality: 96% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 71% |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009A2150 Relevance: 7.6, APIs: 5, Instructions: 60COMMON
Download Yara Rule
| C-Code - Quality: 82% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009A44B0 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35sleepCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 100% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 84% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009AA59B Relevance: 4.5, APIs: 3, Instructions: 35COMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 78% |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009B39FE Relevance: 3.1, APIs: 2, Instructions: 117windowCOMMON
Download Yara Rule
| C-Code - Quality: 84% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009A927E Relevance: 3.1, APIs: 2, Instructions: 88windowCOMMON
Download Yara Rule
| C-Code - Quality: 75% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009A950A Relevance: 3.1, APIs: 2, Instructions: 70windowCOMMON
Download Yara Rule
| C-Code - Quality: 96% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009A5F60 Relevance: 3.1, APIs: 2, Instructions: 66COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009A19D0 Relevance: 3.1, APIs: 2, Instructions: 56COMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009A70AD Relevance: 3.1, APIs: 2, Instructions: 54windowCOMMON
Download Yara Rule
| C-Code - Quality: 83% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009AB5AF Relevance: 3.0, APIs: 2, Instructions: 35COMMON
Download Yara Rule
| C-Code - Quality: 79% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00AAC8B2 Relevance: 3.0, APIs: 2, Instructions: 32COMMON
Download Yara Rule
| C-Code - Quality: 89% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009AED3F Relevance: 3.0, APIs: 2, Instructions: 32threadCOMMON
Download Yara Rule
| C-Code - Quality: 91% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009AA646 Relevance: 3.0, APIs: 2, Instructions: 28COMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009AB76B Relevance: 3.0, APIs: 2, Instructions: 24libraryCOMMON
Download Yara Rule
| C-Code - Quality: 79% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009B30E9 Relevance: 3.0, APIs: 2, Instructions: 15threadCOMMON
Download Yara Rule
| C-Code - Quality: 86% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009AEEF6 Relevance: 1.8, APIs: 1, Instructions: 285COMMON
Download Yara Rule
| C-Code - Quality: 38% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009B528B Relevance: 1.7, APIs: 1, Instructions: 151COMMON
Download Yara Rule
| C-Code - Quality: 94% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009C9C9A Relevance: 1.6, APIs: 1, Instructions: 85COMMON
Download Yara Rule
| C-Code - Quality: 97% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009A1CE0 Relevance: 1.6, APIs: 1, Instructions: 79COMMON
Download Yara Rule
| C-Code - Quality: 87% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009AD57A Relevance: 1.6, APIs: 1, Instructions: 77COMMON
Download Yara Rule
| C-Code - Quality: 93% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009A2200 Relevance: 1.6, APIs: 1, Instructions: 73COMMON
Download Yara Rule
| C-Code - Quality: 88% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009A5590 Relevance: 1.6, APIs: 1, Instructions: 68COMMON
Download Yara Rule
| C-Code - Quality: 44% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009A2BE0 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
Download Yara Rule
| C-Code - Quality: 54% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009A11D0 Relevance: 1.6, APIs: 1, Instructions: 59memoryCOMMON
Download Yara Rule
| C-Code - Quality: 95% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00ABB065 Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMONLIBRARYCODE
Download Yara Rule
| C-Code - Quality: 86% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 96% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009AD67F Relevance: 1.5, APIs: 1, Instructions: 31COMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009A705A Relevance: 1.5, APIs: 1, Instructions: 30windowCOMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 88% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009AFB60 Relevance: 1.5, APIs: 1, Instructions: 21COMMON
Download Yara Rule
| C-Code - Quality: 86% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009A6C30 Relevance: 1.5, APIs: 1, Instructions: 15COMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 63% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00A539D2 Relevance: 26.6, APIs: 13, Strings: 2, Instructions: 340COMMONCrypto
Download Yara Rule
| C-Code - Quality: 87% |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 98% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 97% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009B1AD1 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73libraryCOMMON
Download Yara Rule
| C-Code - Quality: 78% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00AC2663 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54COMMONLIBRARYCODE
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 85% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 88% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009B508E Relevance: 4.5, APIs: 3, Instructions: 39COMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009A836B Relevance: 3.0, APIs: 2, Instructions: 37windowCOMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009A96B5 Relevance: 37.2, APIs: 19, Strings: 2, Instructions: 451windowstringCOMMON
Download Yara Rule
| C-Code - Quality: 97% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009A41D0 Relevance: 37.0, APIs: 11, Strings: 10, Instructions: 205comCOMMON
Download Yara Rule
| C-Code - Quality: 28% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00A37EA2 Relevance: 31.8, APIs: 15, Strings: 3, Instructions: 263windowCOMMON
Download Yara Rule
| C-Code - Quality: 77% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009AC2D5 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 191windowCOMMON
Download Yara Rule
| C-Code - Quality: 78% |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009B269A Relevance: 31.7, APIs: 5, Strings: 13, Instructions: 157stringCOMMON
Download Yara Rule
| C-Code - Quality: 93% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009EA5AF Relevance: 26.3, APIs: 7, Strings: 8, Instructions: 73libraryloaderCOMMON
Download Yara Rule
| C-Code - Quality: 96% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009B1BA3 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 130libraryloaderCOMMON
Download Yara Rule
| C-Code - Quality: 73% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 95% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 97% |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 100% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009B4DF8 Relevance: 16.6, APIs: 11, Instructions: 139COMMON
Download Yara Rule
| C-Code - Quality: 94% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00A3991B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 240windowCOMMON
Download Yara Rule
| C-Code - Quality: 85% |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009ACD40 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 191libraryloaderCOMMON
Download Yara Rule
| C-Code - Quality: 55% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 81% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 54% |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009AE4BA Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 69windowCOMMON
Download Yara Rule
| C-Code - Quality: 93% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 95% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 90% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009BCB7A Relevance: 13.6, APIs: 9, Instructions: 96memoryCOMMONLIBRARYCODE
Download Yara Rule
| C-Code - Quality: 83% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009B4386 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 115threadwindowCOMMON
Download Yara Rule
| C-Code - Quality: 81% |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 92% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 97% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 93% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 67% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009C94FB Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 127stringCOMMON
Download Yara Rule
| C-Code - Quality: 87% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 92% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009D70FC Relevance: 10.6, APIs: 7, Instructions: 111COMMON
Download Yara Rule
| C-Code - Quality: 96% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 98% |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009ACA5F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 110windowCOMMON
Download Yara Rule
| C-Code - Quality: 96% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009B3D0B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 106registryCOMMON
Download Yara Rule
| C-Code - Quality: 45% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009B3ED7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 105registryCOMMON
Download Yara Rule
| C-Code - Quality: 78% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 97% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 95% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009ACC36 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 79libraryloaderCOMMON
Download Yara Rule
| C-Code - Quality: 65% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009AA887 Relevance: 10.6, APIs: 7, Instructions: 73COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009BBBB9 Relevance: 10.6, APIs: 7, Instructions: 73COMMON
Download Yara Rule
| C-Code - Quality: 63% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009B1888 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 53libraryloaderCOMMON
Download Yara Rule
| C-Code - Quality: 55% |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009ABB2C Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 53libraryloaderCOMMON
Download Yara Rule
| C-Code - Quality: 58% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009B181C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMON
Download Yara Rule
| C-Code - Quality: 58% |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009BE5AC Relevance: 10.5, APIs: 7, Instructions: 30COMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00A0F545 Relevance: 9.2, APIs: 6, Instructions: 241stringCOMMON
Download Yara Rule
| C-Code - Quality: 68% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009B4C39 Relevance: 9.1, APIs: 6, Instructions: 138COMMON
Download Yara Rule
| C-Code - Quality: 91% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009B78CF Relevance: 9.1, APIs: 6, Instructions: 113windowCOMMON
Download Yara Rule
| C-Code - Quality: 97% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00A39D16 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON
Download Yara Rule
| C-Code - Quality: 82% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009B42D4 Relevance: 9.1, APIs: 6, Instructions: 69COMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009A95B6 Relevance: 9.1, APIs: 6, Instructions: 67windowCOMMON
Download Yara Rule
| C-Code - Quality: 67% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009A653C Relevance: 9.1, APIs: 6, Instructions: 65COMMON
Download Yara Rule
| C-Code - Quality: 92% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 71% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009BBC7B Relevance: 9.1, APIs: 6, Instructions: 52windowCOMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 80% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009C9ABA Relevance: 9.0, APIs: 6, Instructions: 45windowCOMMONLIBRARYCODE
Download Yara Rule
| C-Code - Quality: 91% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 94% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009B07EF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 94windowCOMMON
Download Yara Rule
| C-Code - Quality: 80% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 100% |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 83% |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009C83CA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 46libraryfileloaderCOMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009A30CD Relevance: 7.7, APIs: 5, Instructions: 209COMMON
Download Yara Rule
| C-Code - Quality: 78% |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009ABEBE Relevance: 7.6, APIs: 5, Instructions: 81windowCOMMON
Download Yara Rule
| C-Code - Quality: 67% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009ADA0E Relevance: 7.6, APIs: 5, Instructions: 80windowCOMMON
Download Yara Rule
| C-Code - Quality: 97% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009A6EE5 Relevance: 7.6, APIs: 5, Instructions: 70windowCOMMON
Download Yara Rule
| C-Code - Quality: 68% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 94% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009A77B8 Relevance: 7.6, APIs: 5, Instructions: 66windowCOMMON
Download Yara Rule
| C-Code - Quality: 65% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009B91C1 Relevance: 7.6, APIs: 5, Instructions: 65windowCOMMONLIBRARYCODE
Download Yara Rule
| C-Code - Quality: 91% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009BB926 Relevance: 7.6, APIs: 5, Instructions: 54stringCOMMON
Download Yara Rule
| C-Code - Quality: 75% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00A39DE8 Relevance: 7.6, APIs: 5, Instructions: 51COMMON
Download Yara Rule
| C-Code - Quality: 87% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009A6D4B Relevance: 7.5, APIs: 5, Instructions: 48windowCOMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 77% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 83% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 57% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 75% |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009BE955 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72windowCOMMON
Download Yara Rule
| C-Code - Quality: 79% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009AE2AD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43libraryloaderCOMMON
Download Yara Rule
| C-Code - Quality: 89% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 83% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009B32BB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009B39AA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMON
Download Yara Rule
| C-Code - Quality: 18% |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009B3262 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009C8488 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33libraryloaderCOMMON
Download Yara Rule
| C-Code - Quality: 18% |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009D2C51 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009C843E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 29libraryloaderCOMMON
Download Yara Rule
| C-Code - Quality: 37% |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00AAC4C3 Relevance: 6.1, APIs: 4, Instructions: 130COMMON
Download Yara Rule
| C-Code - Quality: 96% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009A8C8F Relevance: 6.1, APIs: 4, Instructions: 106COMMON
Download Yara Rule
| C-Code - Quality: 97% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 100% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009B1011 Relevance: 6.1, APIs: 4, Instructions: 96windowCOMMON
Download Yara Rule
| C-Code - Quality: 97% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009D2F8C Relevance: 6.1, APIs: 4, Instructions: 63timeCOMMON
Download Yara Rule
| C-Code - Quality: 97% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009B210A Relevance: 6.1, APIs: 4, Instructions: 61threadCOMMON
Download Yara Rule
| C-Code - Quality: 95% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009B4B50 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
Download Yara Rule
| C-Code - Quality: 90% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009AB2F2 Relevance: 6.1, APIs: 4, Instructions: 57COMMON
Download Yara Rule
| C-Code - Quality: 92% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 94% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009B586E Relevance: 6.1, APIs: 4, Instructions: 56COMMON
Download Yara Rule
| C-Code - Quality: 91% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009AEE78 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009B0672 Relevance: 6.1, APIs: 4, Instructions: 54windowCOMMON
Download Yara Rule
| C-Code - Quality: 94% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009A7674 Relevance: 6.1, APIs: 4, Instructions: 52fileCOMMON
Download Yara Rule
| C-Code - Quality: 74% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009AD893 Relevance: 6.0, APIs: 4, Instructions: 50COMMON
Download Yara Rule
| C-Code - Quality: 78% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009AD018 Relevance: 6.0, APIs: 4, Instructions: 49COMMON
Download Yara Rule
| C-Code - Quality: 91% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009D3912 Relevance: 6.0, APIs: 4, Instructions: 49memoryCOMMON
Download Yara Rule
| C-Code - Quality: 34% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009B1FB0 Relevance: 6.0, APIs: 4, Instructions: 49memoryCOMMON
Download Yara Rule
| C-Code - Quality: 37% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009B0230 Relevance: 6.0, APIs: 4, Instructions: 45COMMON
Download Yara Rule
| C-Code - Quality: 85% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009B0E11 Relevance: 6.0, APIs: 4, Instructions: 39windowCOMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009B1147 Relevance: 6.0, APIs: 4, Instructions: 38stringCOMMON
Download Yara Rule
| C-Code - Quality: 80% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009B4FF7 Relevance: 6.0, APIs: 4, Instructions: 38COMMON
Download Yara Rule
| C-Code - Quality: 73% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009B4F63 Relevance: 6.0, APIs: 4, Instructions: 32COMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009B3218 Relevance: 6.0, APIs: 4, Instructions: 19COMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 100% |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 67% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 100% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 009C2683 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48libraryloaderCOMMON
Download Yara Rule
| C-Code - Quality: 43% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 66% |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Execution Graph
| Execution Coverage: | 3.2% |
| Dynamic/Decrypted Code Coverage: | 0% |
| Signature Coverage: | 1.3% |
| Total number of Nodes: | 1126 |
| Total number of Limit Nodes: | 28 |
Graph
Function 0040610C Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 186registrystringlibraryCOMMON
Download Yara Rule
Control-flow Graph
| C-Code - Quality: 65% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Control-flow Graph
| C-Code - Quality: 93% |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00406217 Relevance: 15.1, APIs: 10, Instructions: 101stringlibrarythreadCOMMON
Download Yara Rule
Control-flow Graph
| C-Code - Quality: 61% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00450214 Relevance: 1.5, APIs: 1, Instructions: 34COMMON
Download Yara Rule
| C-Code - Quality: 77% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 004637A8 Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON
Download Yara Rule
| C-Code - Quality: 37% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 6ED91000 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 187stringcomCOMMON
Download Yara Rule
Control-flow Graph
| C-Code - Quality: 67% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 6ED91B50 Relevance: 23.0, APIs: 9, Strings: 4, Instructions: 231stringsleepmemoryCOMMON
Download Yara Rule
Control-flow Graph
| C-Code - Quality: 77% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 004632B0 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 132windowregistryCOMMON
Download Yara Rule
Control-flow Graph
| C-Code - Quality: 42% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0044FFC4 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 103registrylibraryloaderCOMMON
Download Yara Rule
Control-flow Graph
| C-Code - Quality: 86% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 004622CC Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 140registryCOMMON
Download Yara Rule
Control-flow Graph
| C-Code - Quality: 79% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00462F94 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 130windowCOMMON
Download Yara Rule
Control-flow Graph
| C-Code - Quality: 94% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00465F6C Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 67windowCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Control-flow Graph
| C-Code - Quality: 84% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Control-flow Graph
| C-Code - Quality: 84% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0046268C Relevance: 10.6, APIs: 7, Instructions: 89COMMON
Download Yara Rule
Control-flow Graph
| C-Code - Quality: 89% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00401C1C Relevance: 6.1, APIs: 4, Instructions: 54memoryCOMMON
Download Yara Rule
Control-flow Graph
| C-Code - Quality: 69% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 6ED96310 Relevance: 6.0, APIs: 4, Instructions: 46COMMON
Download Yara Rule
Control-flow Graph
| C-Code - Quality: 89% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 58% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 6EDA2910 Relevance: 4.6, APIs: 3, Instructions: 74COMMON
Download Yara Rule
| C-Code - Quality: 86% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 53% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00402478 Relevance: 3.1, APIs: 2, Instructions: 125COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 6ED91A60 Relevance: 3.0, APIs: 2, Instructions: 50COMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00462164 Relevance: 3.0, APIs: 2, Instructions: 37COMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 89% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0040167C Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 6ED94600 Relevance: 1.6, APIs: 1, Instructions: 93COMMON
Download Yara Rule
| C-Code - Quality: 87% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 6ED9D81F Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMONLIBRARYCODE
Download Yara Rule
| C-Code - Quality: 86% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00407B24 Relevance: 1.5, APIs: 1, Instructions: 43COMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 6ED96F19 Relevance: 1.5, APIs: 1, Instructions: 34COMMON
Download Yara Rule
| C-Code - Quality: 93% |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00405E78 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 63% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 6ED96A1F Relevance: 1.5, APIs: 1, Instructions: 10COMMON
Download Yara Rule
| C-Code - Quality: 25% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00401820 Relevance: 1.3, APIs: 1, Instructions: 71memoryCOMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00423758 Relevance: 1.3, APIs: 1, Instructions: 70memoryCOMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00430384 Relevance: 166.5, APIs: 48, Strings: 47, Instructions: 266libraryloaderCOMMON
Download Yara Rule
| C-Code - Quality: 90% |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00405F34 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 144stringlibraryfileCOMMON
Download Yara Rule
| C-Code - Quality: 53% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 84% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0044B468 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 64windowCOMMON
Download Yara Rule
| C-Code - Quality: 75% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 91% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 92% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 38% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 46% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0044AB44 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON
Download Yara Rule
| C-Code - Quality: 85% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 72% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 79% |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0043EDE4 Relevance: 6.0, APIs: 4, Instructions: 46sleepCOMMON
Download Yara Rule
| C-Code - Quality: 58% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 100% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 91% |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00426E50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
Download Yara Rule
| C-Code - Quality: 58% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 100% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00462D8C Relevance: 4.5, APIs: 3, Instructions: 33synchronizationthreadCOMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00445BB4 Relevance: 1.6, APIs: 1, Instructions: 129COMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 004099C2 Relevance: 1.6, APIs: 1, Instructions: 52COMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0043AFAC Relevance: 1.5, APIs: 1, Instructions: 41nativeCOMMON
Download Yara Rule
| C-Code - Quality: 53% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 004273EC Relevance: 1.5, APIs: 1, Instructions: 37COMMON
Download Yara Rule
| C-Code - Quality: 94% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0044FBC8 Relevance: 49.1, APIs: 15, Strings: 13, Instructions: 95libraryloaderCOMMON
Download Yara Rule
| C-Code - Quality: 83% |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 100% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 6ED98473 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 109libraryloadermemoryCOMMONLIBRARYCODE
Download Yara Rule
| C-Code - Quality: 62% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 52% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 51% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 65% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0043D70C Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 454windowCOMMON
Download Yara Rule
| C-Code - Quality: 89% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0047AED0 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 238windowCOMMON
Download Yara Rule
| C-Code - Quality: 83% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 78% |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 68% |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0042F52C Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 198memoryCOMMON
Download Yara Rule
| C-Code - Quality: 69% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 71% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 51% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0044BFB0 Relevance: 19.7, APIs: 13, Instructions: 224COMMON
Download Yara Rule
| C-Code - Quality: 55% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00407B7C Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 61registryclipboardwindowCOMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 004314F8 Relevance: 18.1, APIs: 12, Instructions: 142COMMON
Download Yara Rule
| C-Code - Quality: 57% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 88% |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 004492C0 Relevance: 16.6, APIs: 11, Instructions: 133COMMON
Download Yara Rule
| C-Code - Quality: 83% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 57% |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0047261C Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 121windowCOMMON
Download Yara Rule
| C-Code - Quality: 76% |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 86% |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00403080 Relevance: 15.1, APIs: 10, Instructions: 129fileCOMMON
Download Yara Rule
| C-Code - Quality: 70% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00479AF4 Relevance: 15.1, APIs: 10, Instructions: 104COMMON
Download Yara Rule
| C-Code - Quality: 62% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 47% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 42% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00438258 Relevance: 13.7, APIs: 9, Instructions: 172COMMON
Download Yara Rule
| C-Code - Quality: 93% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00444544 Relevance: 13.6, APIs: 9, Instructions: 150COMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 37% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0040DD64 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201threadCOMMON
Download Yara Rule
| C-Code - Quality: 72% |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 004547EC Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 187windowCOMMON
Download Yara Rule
| C-Code - Quality: 87% |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 77% |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 004480E8 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 134registryCOMMON
Download Yara Rule
| C-Code - Quality: 84% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 004647C4 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 132windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00429304 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 122fileCOMMON
Download Yara Rule
| C-Code - Quality: 94% |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0042202C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 109threadCOMMON
Download Yara Rule
| C-Code - Quality: 69% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00422474 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 73synchronizationthreadCOMMON
Download Yara Rule
| C-Code - Quality: 44% |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0042D868 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 68stringCOMMON
Download Yara Rule
| C-Code - Quality: 67% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00406B5D Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41threadCOMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00404838 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON
Download Yara Rule
| C-Code - Quality: 79% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00451E94 Relevance: 12.2, APIs: 8, Instructions: 170COMMON
Download Yara Rule
| C-Code - Quality: 39% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 74% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0044916C Relevance: 12.1, APIs: 8, Instructions: 123COMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00427444 Relevance: 12.1, APIs: 8, Instructions: 79COMMON
Download Yara Rule
| C-Code - Quality: 26% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00402D2C Relevance: 11.4, APIs: 9, Instructions: 151COMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 69% |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00476988 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 163windowCOMMON
Download Yara Rule
| C-Code - Quality: 86% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 58% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0044C7D0 Relevance: 10.7, APIs: 7, Instructions: 156COMMON
Download Yara Rule
| C-Code - Quality: 69% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 70% |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00452C50 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 80libraryloaderCOMMON
Download Yara Rule
| C-Code - Quality: 54% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 100% |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0042D93C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68stringCOMMON
Download Yara Rule
| C-Code - Quality: 47% |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0042DA10 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68stringCOMMON
Download Yara Rule
| C-Code - Quality: 47% |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00429F3C Relevance: 10.6, APIs: 7, Instructions: 66COMMON
Download Yara Rule
| C-Code - Quality: 67% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 94% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00437AD0 Relevance: 9.3, APIs: 6, Instructions: 286windowCOMMON
Download Yara Rule
| C-Code - Quality: 87% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0045E044 Relevance: 9.2, APIs: 6, Instructions: 150COMMON
Download Yara Rule
| C-Code - Quality: 89% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0042794C Relevance: 9.1, APIs: 6, Instructions: 84COMMON
Download Yara Rule
| C-Code - Quality: 68% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00401CF4 Relevance: 9.1, APIs: 6, Instructions: 72COMMON
Download Yara Rule
| C-Code - Quality: 74% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00427DD8 Relevance: 9.1, APIs: 6, Instructions: 65COMMON
Download Yara Rule
| C-Code - Quality: 45% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00441700 Relevance: 9.1, APIs: 6, Instructions: 60COMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 004275F4 Relevance: 9.1, APIs: 6, Instructions: 55COMMON
Download Yara Rule
| C-Code - Quality: 87% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00426CCC Relevance: 9.0, APIs: 6, Instructions: 43COMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 51% |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0045E820 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 148windowCOMMON
Download Yara Rule
| C-Code - Quality: 91% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 48% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0047AA10 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 76libraryloaderCOMMON
Download Yara Rule
| C-Code - Quality: 75% |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0042384C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59registryCOMMON
Download Yara Rule
| C-Code - Quality: 93% |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00403A5C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON
Download Yara Rule
| C-Code - Quality: 65% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0045D2A0 Relevance: 7.7, APIs: 5, Instructions: 176COMMON
Download Yara Rule
| C-Code - Quality: 90% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00454D8C Relevance: 7.7, APIs: 5, Instructions: 162COMMON
Download Yara Rule
| C-Code - Quality: 85% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00442288 Relevance: 7.6, APIs: 5, Instructions: 139threadCOMMON
Download Yara Rule
| C-Code - Quality: 92% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 004871F8 Relevance: 7.6, APIs: 5, Instructions: 131COMMON
Download Yara Rule
| C-Code - Quality: 37% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00434EEC Relevance: 7.6, APIs: 5, Instructions: 110COMMON
Download Yara Rule
| C-Code - Quality: 77% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00448DE4 Relevance: 7.6, APIs: 5, Instructions: 104COMMON
Download Yara Rule
| C-Code - Quality: 85% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 82% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00435F10 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON
Download Yara Rule
| C-Code - Quality: 76% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00464288 Relevance: 7.6, APIs: 5, Instructions: 73windowCOMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0044CB24 Relevance: 7.6, APIs: 5, Instructions: 73COMMON
Download Yara Rule
| C-Code - Quality: 22% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0042B1A8 Relevance: 7.6, APIs: 5, Instructions: 66windowCOMMON
Download Yara Rule
| C-Code - Quality: 78% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0046176C Relevance: 7.6, APIs: 5, Instructions: 63COMMON
Download Yara Rule
| C-Code - Quality: 62% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0042755C Relevance: 7.6, APIs: 5, Instructions: 55COMMON
Download Yara Rule
| C-Code - Quality: 40% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0040C6A8 Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON
Download Yara Rule
| C-Code - Quality: 64% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00462EA0 Relevance: 7.5, APIs: 5, Instructions: 25synchronizationthreadCOMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0040C758 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148threadCOMMON
Download Yara Rule
| C-Code - Quality: 82% |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 73% |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00472AF8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 106windowCOMMON
Download Yara Rule
| C-Code - Quality: 76% |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 77% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 59% |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0045801C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58windowCOMMON
Download Yara Rule
| C-Code - Quality: 93% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 58% |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0040E31C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0042CF40 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13libraryloaderCOMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00442838 Relevance: 6.2, APIs: 4, Instructions: 204COMMON
Download Yara Rule
| C-Code - Quality: 92% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00437E98 Relevance: 6.1, APIs: 4, Instructions: 146windowCOMMON
Download Yara Rule
| C-Code - Quality: 66% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 004102EC Relevance: 6.1, APIs: 4, Instructions: 115COMMON
Download Yara Rule
| C-Code - Quality: 82% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0040C98C Relevance: 6.1, APIs: 4, Instructions: 108COMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0040C98A Relevance: 6.1, APIs: 4, Instructions: 107COMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0040DBEC Relevance: 6.1, APIs: 4, Instructions: 97threadCOMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00470604 Relevance: 6.1, APIs: 4, Instructions: 92COMMON
Download Yara Rule
| C-Code - Quality: 80% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00429D84 Relevance: 6.1, APIs: 4, Instructions: 83COMMON
Download Yara Rule
| C-Code - Quality: 64% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 004586A4 Relevance: 6.1, APIs: 4, Instructions: 72windowCOMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00463530 Relevance: 6.1, APIs: 4, Instructions: 57COMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0041CBBC Relevance: 6.1, APIs: 4, Instructions: 51COMMON
Download Yara Rule
| C-Code - Quality: 82% |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00442678 Relevance: 6.0, APIs: 4, Instructions: 37threadCOMMON
Download Yara Rule
| C-Code - Quality: 87% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 004417EC Relevance: 6.0, APIs: 4, Instructions: 35threadCOMMON
Download Yara Rule
| C-Code - Quality: 87% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00462E2C Relevance: 6.0, APIs: 4, Instructions: 34threadCOMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0042C654 Relevance: 6.0, APIs: 4, Instructions: 29COMMON
Download Yara Rule
| C-Code - Quality: 68% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00407A4C Relevance: 6.0, APIs: 4, Instructions: 11memoryCOMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 79% |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 87% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 64% |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 73% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 75% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00457EF8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 84keyboardCOMMON
Download Yara Rule
| C-Code - Quality: 73% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00472C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 76windowCOMMON
Download Yara Rule
| C-Code - Quality: 73% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0040B16C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74threadCOMMON
Download Yara Rule
| C-Code - Quality: 72% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 63% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 63% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 100% |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 100% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 64% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 68% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 72% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 68% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| C-Code - Quality: 48% |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0043CF58 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30windowCOMMON
Download Yara Rule
| C-Code - Quality: 100% |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Execution Graph
| Execution Coverage: | 2.8% |
| Dynamic/Decrypted Code Coverage: | 0% |
| Signature Coverage: | 1.6% |
| Total number of Nodes: | 381 |
| Total number of Limit Nodes: | 9 |
Graph
Control-flow Graph
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B43A47 Relevance: 1.5, APIs: 1, Instructions: 40networkCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B4CE76 Relevance: 26.7, APIs: 12, Strings: 3, Instructions: 424sleepthreadCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B5758B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73sleepCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B5199B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71synchronizationCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B5B8F7 Relevance: 4.5, APIs: 3, Instructions: 34threadCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B5B8EB Relevance: 4.5, APIs: 3, Instructions: 29threadCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B46BB0 Relevance: 3.9, APIs: 3, Instructions: 164COMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B5B95C Relevance: 3.1, APIs: 2, Instructions: 63threadCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B4F86B Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 46sleepCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B51943 Relevance: 3.0, APIs: 2, Instructions: 28networkCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B43AE9 Relevance: 3.0, APIs: 2, Instructions: 15COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B593FA Relevance: 1.6, APIs: 1, Instructions: 58memoryCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B43A98 Relevance: 1.5, APIs: 1, Instructions: 40networkCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B438D3 Relevance: 1.5, APIs: 1, Instructions: 24networkCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B458CC Relevance: 1.5, APIs: 1, Instructions: 24threadCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B5E948 Relevance: 1.5, APIs: 1, Instructions: 10memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B4F8FF Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101processCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B4B9B9 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 171encryptionCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B4BC1E Relevance: 9.1, APIs: 6, Instructions: 63memoryCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B67E91 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B64DAD Relevance: 6.2, APIs: 4, Instructions: 155COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B4BCAA Relevance: 57.9, APIs: 17, Strings: 16, Instructions: 106libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B50E66 Relevance: 43.7, APIs: 29, Instructions: 243networksleepthreadCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B69CCF Relevance: 38.6, APIs: 16, Strings: 6, Instructions: 134libraryloaderCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B5EE5B Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 109libraryloadermemoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B5162A Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 245pipeCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B53C18 Relevance: 24.8, APIs: 2, Strings: 12, Instructions: 347fileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B4BE04 Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 208memoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0300C6EE Relevance: 21.3, APIs: 14, Instructions: 256COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B6A715 Relevance: 18.5, APIs: 12, Instructions: 494COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B4FF9A Relevance: 18.1, APIs: 12, Instructions: 93filesynchronizationpipeCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0300EEB9 Relevance: 16.8, APIs: 11, Instructions: 301COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B5375A Relevance: 16.6, APIs: 11, Instructions: 95networksleepsynchronizationCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 03010AFB Relevance: 15.3, APIs: 10, Instructions: 277COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B50808 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 102filesynchronizationpipeCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B4FF10 Relevance: 13.6, APIs: 9, Instructions: 56threadCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B4C529 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 35libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0300C174 Relevance: 10.7, APIs: 7, Instructions: 229COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 03006C44 Relevance: 9.2, APIs: 6, Instructions: 164COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B500ED Relevance: 9.1, APIs: 6, Instructions: 79filesynchronizationpipeCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0300685B Relevance: 9.1, APIs: 6, Instructions: 65COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B5077F Relevance: 9.0, APIs: 6, Instructions: 48filesynchronizationpipeCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B4C0E0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 229libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B50807 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92filesynchronizationpipeCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B4DD6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0300CF0A Relevance: 7.9, APIs: 5, Instructions: 424COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B5A86F Relevance: 7.7, APIs: 5, Instructions: 210COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0300BE98 Relevance: 7.7, APIs: 5, Instructions: 208COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 03003E7F Relevance: 7.6, APIs: 5, Instructions: 93COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B666EC Relevance: 7.6, APIs: 5, Instructions: 72COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0301BB57 Relevance: 7.6, APIs: 5, Instructions: 66COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 03002370 Relevance: 7.6, APIs: 5, Instructions: 51COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 03004538 Relevance: 7.6, APIs: 5, Instructions: 51COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 030045C7 Relevance: 7.6, APIs: 5, Instructions: 51COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0301D7A7 Relevance: 7.5, APIs: 5, Instructions: 49COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B514DE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93processCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B5200A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74threadsleepCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0301E130 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B5B5BB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 030135A6 Relevance: 6.2, APIs: 4, Instructions: 161COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B564B8 Relevance: 6.1, APIs: 4, Instructions: 90networkCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B5EC2B Relevance: 6.0, APIs: 4, Instructions: 45threadCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 03002055 Relevance: 6.0, APIs: 4, Instructions: 39COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0301B98B Relevance: 6.0, APIs: 4, Instructions: 34COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B5EDED Relevance: 6.0, APIs: 4, Instructions: 34COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0301BAF2 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B50731 Relevance: 6.0, APIs: 4, Instructions: 30threadCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0301BAFE Relevance: 6.0, APIs: 4, Instructions: 29COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B514DD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83processCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0301DEA9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 04B4B841 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21registryCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |