Edit tour
Windows
Analysis Report
SecuriteInfo.com.FileRepMalware.16016.24947.exe
Overview
General Information
| Sample name: | SecuriteInfo.com.FileRepMalware.16016.24947.exe |
| Analysis ID: | 1538271 |
| MD5: | 59a1f2c02e1ad06450edb6a3e66b0b16 |
| SHA1: | d97989ae75a7edf861e3bff3564b6889a09e14f6 |
| SHA256: | 55697f96abab3e4d633d3a505f6546d41b3550ea985aa9871df59b68d860f495 |
| Tags: | exe |
| Infos: | |
 | |
Detection
| Score: | 60 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
AI detected suspicious sample
Machine Learning detection for sample
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
AV process strings found (often used to terminate AV products)
Contains functionality for read data from the clipboard
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to communicate with device drivers
Contains functionality to delete services
Contains functionality to dynamically determine API calls
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected potential crypto function
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
One or more processes crash
Potential key logger detected (key state polling based)
Classification
- System is w10x64
SecuriteInfo.com.FileRepMalware.16016.24947.exe (PID: 524 cmdline: "C:\Users\ user\Deskt op\Securit eInfo.com. FileRepMal ware.16016 .24947.exe " MD5: 59A1F2C02E1AD06450EDB6A3E66B0B16) 
conhost.exe (PID: 5328 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
WerFault.exe (PID: 5656 cmdline: C:\Windows \system32\ WerFault.e xe -u -p 5 24 -s 1520 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)
- cleanup
⊘No configs have been found
⊘No yara matches
⊘No Sigma rule has matched
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | ReversingLabs: | ||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Binary or memory string: | memstr_6862268b-2 | |
| Source: | HTTPS traffic detected: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | IP Address: | ||
| Source: | JA3 fingerprint: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | Code function: | 0_2_00007FF6E0FBB980 | |
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_00007FF6E0F58630 | |
| Source: | Code function: | 0_2_00007FF6E0F58790 | |
| Source: | Code function: | 0_2_00007FF6E0F58630 | |
| Source: | Code function: | 0_2_00007FF6E0F333E0 | |
| Source: | Code function: | 0_2_00007FF6E0F703A0 | |
| Source: | Code function: | 0_2_00007FF6E0F36360 | |
| Source: | Code function: | 0_2_00007FF6E0F3E990 | |
| Source: | Code function: | 0_2_00007FF6E0F34940 | |
| Source: | Code function: | 0_2_00007FF6E0F36360 | |
| Source: | Code function: | 0_2_00007FF6E0F34FE0 | |
| Source: | Code function: | 0_2_00007FF6E0F5B260 | |
| Source: | Code function: | 0_2_00007FF6E0FB1280 | |
| Source: | Code function: | 0_2_00007FF6E0F8EAE0 | |
| Source: | Code function: | 0_2_00007FF6E0F252E0 | |
| Source: | Code function: | 0_2_00007FF6E0F612F0 | |
| Source: | Code function: | 0_2_00007FF6E0FBC300 | |
| Source: | Code function: | 0_2_00007FF6E0F29940 | |
| Source: | Code function: | 0_2_00007FF6E0F5C940 | |
| Source: | Code function: | 0_2_00007FF6E0F769B0 | |
| Source: | Code function: | 0_2_00007FF6E0F5D9E0 | |
| Source: | Code function: | 0_2_00007FF6E0F749F0 | |
| Source: | Code function: | 0_2_00007FF6E0F6EA10 | |
| Source: | Code function: | 0_2_00007FF6E0F60210 | |
| Source: | Code function: | 0_2_00007FF6E0F6F440 | |
| Source: | Code function: | 0_2_00007FF6E0FB0460 | |
| Source: | Code function: | 0_2_00007FF6E0F5F470 | |
| Source: | Code function: | 0_2_00007FF6E0F674B0 | |
| Source: | Code function: | 0_2_00007FF6E0F5FCB0 | |
| Source: | Code function: | 0_2_00007FF6E0F854D0 | |
| Source: | Code function: | 0_2_00007FF6E0FA04F0 | |
| Source: | Code function: | 0_2_00007FF6E0F8B510 | |
| Source: | Code function: | 0_2_00007FF6E0F50360 | |
| Source: | Code function: | 0_2_00007FF6E0F21390 | |
| Source: | Code function: | 0_2_00007FF6E0F703A0 | |
| Source: | Code function: | 0_2_00007FF6E0FBEBE0 | |
| Source: | Code function: | 0_2_00007FF6E0F8A3E0 | |
| Source: | Code function: | 0_2_00007FF6E0F6ABF0 | |
| Source: | Code function: | 0_2_00007FF6E0F49430 | |
| Source: | Code function: | 0_2_00007FF6E0F72E50 | |
| Source: | Code function: | 0_2_00007FF6E0F4EE60 | |
| Source: | Code function: | 0_2_00007FF6E0F62E60 | |
| Source: | Code function: | 0_2_00007FF6E0F52E80 | |
| Source: | Code function: | 0_2_00007FF6E0F726C0 | |
| Source: | Code function: | 0_2_00007FF6E0F6B6E0 | |
| Source: | Code function: | 0_2_00007FF6E0F29F00 | |
| Source: | Code function: | 0_2_00007FF6E0F55F00 | |
| Source: | Code function: | 0_2_00007FF6E0F2AF10 | |
| Source: | Code function: | 0_2_00007FF6E0F6FD50 | |
| Source: | Code function: | 0_2_00007FF6E0F77DC0 | |
| Source: | Code function: | 0_2_00007FF6E0F60DD0 | |
| Source: | Code function: | 0_2_00007FF6E0F695F0 | |
| Source: | Code function: | 0_2_00007FF6E0F82DF0 | |
| Source: | Code function: | 0_2_00007FF6E0F93E00 | |
| Source: | Code function: | 0_2_00007FF6E0F5EE30 | |
| Source: | Code function: | 0_2_00007FF6E0F6E840 | |
| Source: | Code function: | 0_2_00007FF6E0F61060 | |
| Source: | Code function: | 0_2_00007FF6E0F45080 | |
| Source: | Code function: | 0_2_00007FF6E0F440A0 | |
| Source: | Code function: | 0_2_00007FF6E0F228A0 | |
| Source: | Code function: | 0_2_00007FF6E0F738D0 | |
| Source: | Code function: | 0_2_00007FF6E0F81130 | |
| Source: | Code function: | 0_2_00007FF6E0F9C750 | |
| Source: | Code function: | 0_2_00007FF6E0F4AF50 | |
| Source: | Code function: | 0_2_00007FF6E0F90F60 | |
| Source: | Code function: | 0_2_00007FF6E0F6CF70 | |
| Source: | Code function: | 0_2_00007FF6E0F7FFC0 | |
| Source: | Code function: | 0_2_00007FF6E0F44000 | |
| Source: | Code function: | 0_2_00007FF6E0F78810 | |
| Source: | Code function: | ||
| Source: | Process created: | ||
| Source: | Binary string: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 0_2_00007FF6E0F3E990 | |
| Source: | Code function: | 0_2_00007FF6E0F36360 | |
| Source: | Code function: | 0_2_00007FF6E0F3E8F0 | |
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | ReversingLabs: | ||
| Source: | String found in binary or memory: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static file information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_00007FF6E0F6FA40 | |
| Source: | Code function: | 0_2_00007FF6E0F3E8F0 | |
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | API coverage: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Code function: | 0_2_00007FF6E104FA78 | |
| Source: | Code function: | 0_2_00007FF6E104FA78 | |
| Source: | Code function: | 0_2_00007FF6E0F6FA40 | |
| Source: | Code function: | 0_2_00007FF6E0F21B20 | |
| Source: | Code function: | 0_2_00007FF6E104F3F0 | |
| Source: | Code function: | 0_2_00007FF6E104E9B8 | |
| Source: | Code function: | 0_2_00007FF6E104F8F0 | |
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Code function: | 0_2_00007FF6E0FBB980 | |
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 2 Command and Scripting Interpreter | 12 Windows Service | 12 Windows Service | 1 Process Injection | 21 Input Capture | 1 System Time Discovery | Remote Services | 21 Input Capture | 11 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | 12 Service Execution | 1 DLL Side-Loading | 1 Process Injection | 1 Deobfuscate/Decode Files or Information | LSASS Memory | 141 Security Software Discovery | Remote Desktop Protocol | 11 Archive Collected Data | 2 Ingress Tool Transfer | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | 1 Native API | Logon Script (Windows) | 1 DLL Side-Loading | 1 Obfuscated Files or Information | Security Account Manager | 2 Process Discovery | SMB/Windows Admin Shares | 3 Clipboard Data | 2 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 1 DLL Side-Loading | NTDS | 13 System Information Discovery | Distributed Component Object Model | Input Capture | 3 Application Layer Protocol | Traffic Duplication | Data Destruction |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 55% | ReversingLabs | Win64.Trojan.Generic | ||
| 100% | Joe Sandbox ML |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| keyauth.win | 172.67.72.57 | true | false | unknown |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false | unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false | unknown | |||
| false |
| unknown | ||
| false | unknown | |||
| false | unknown | |||
| false | unknown | |||
| false |
| unknown | ||
| false | unknown | |||
| false | unknown | |||
| false | unknown | |||
| false | unknown | |||
| false | unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 172.67.72.57 | keyauth.win | United States | 13335 | CLOUDFLARENETUS | false |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1538271 |
| Start date and time: | 2024-10-20 23:29:36 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 6m 10s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Run name: | Run with higher sleep bypass |
| Number of analysed new started processes analysed: | 12 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | SecuriteInfo.com.FileRepMalware.16016.24947.exe |
| Detection: | MAL |
| Classification: | mal60.evad.winEXE@3/6@1/1 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 20.189.173.21
- Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, tile-service.weather.microsoft.com, onedsblobprdwus16.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, www.msftconnecttest.com, fe3cr.delivery.mp.microsoft.com
- Not all processes where analyzed, report is missing behavior information
- Report size getting too big, too many NtQueryValueKey calls found.
- VT rate limit hit for: SecuriteInfo.com.FileRepMalware.16016.24947.exe
⊘No simulations
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 172.67.72.57 | Get hash | malicious | Unknown | Browse | ||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| keyauth.win | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| CLOUDFLARENETUS | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| a0e9f5d64349fb13191bc781f81f42e1 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
|
⊘No context
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_eb2620f6d3d187daf5b73e6fffe3728eece36b_6212d8dd_29dd5dd9-70d6-47d5-a508-1794b1875975\Report.wer
Download File
| Process: | C:\Windows\System32\WerFault.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 65536 |
| Entropy (8bit): | 1.0343550834427397 |
| Encrypted: | false |
| SSDEEP: | 96:v/F9zOZ6Zs8hPGhiXSKQXIDcQNc6kcE6cw39L6X+HbHg/8BRTf3KoVaSWOUfuNwY:XHzg6ZE0Dgwl68jy5bdzuiFwZ24lO80 |
| MD5: | 38E4931CC23169A17C5B73D5F52E9BF5 |
| SHA1: | 4A752F9AD42213EADFAD76EF0F0BA56341E2A995 |
| SHA-256: | A253361A6375CFE1CB17312569B3521AC51C65A5249A639C926ACB8500FBECF6 |
| SHA-512: | 9DD24FCB53B382F29B3404B64E80CBFA1F2A7BE8DB1470BCD30747218382F2C5A160E0EF25E37E7B339C0664CD81B1012729FC84F9F902BCCD5D133AFEBD4995 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Windows\System32\WerFault.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 190468 |
| Entropy (8bit): | 1.425057085234611 |
| Encrypted: | false |
| SSDEEP: | 384:jlTjTraQBcvh/I4xgFDQI6RoPrUlrSD/csC6sQJLQpjsRpitcMGW2iFkg:hLaQBdrUlWD/csC6sQJLQhsR5kFkg |
| MD5: | 9F0E122C5D056AC7D3C1D88D152D1A66 |
| SHA1: | CC1FDE296F6CAD45AF7C3FB57C517D9F29AC00AC |
| SHA-256: | 8521593AE7DABE4712E14CC6AFF3A80B10196ABA78F3D8A1549D388677FA4303 |
| SHA-512: | 9DDD6247ACC7B351150E00536B9367953AF9777743D38089329313212F98B6A67FAE1D47DC1BE533CA48EB4FDB02003FA2DA9D72D43E2B1D80F603A7F3EF8C1A |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Windows\System32\WerFault.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 8948 |
| Entropy (8bit): | 3.69966806722499 |
| Encrypted: | false |
| SSDEEP: | 192:R6l7wVeJrmM6Y2DxZbgmfkJFQqG6cpDd89bA9kfkAm:R6lXJ6M6YcZbgmfkbE6LA+fS |
| MD5: | B98B7411D09556A962734390BAEE5D3A |
| SHA1: | 617A34DC19DF8D6C493813EB164B7A12DB02D971 |
| SHA-256: | 38E20FA401EFE1D60867DF22E195006C48461D1F39EB91683ABABF36CA7D35B3 |
| SHA-512: | 92500314972C75AA0878C2D5ABC5EC4A7973F94A38FA1E767BED7FCEBCC6AAA74B5F89DC04AFD44033520E97FA7A71C8DF6DD0A47F9C8B12B26914D9EABF0333 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Windows\System32\WerFault.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 4931 |
| Entropy (8bit): | 4.510792999518627 |
| Encrypted: | false |
| SSDEEP: | 48:cvIwWl8zseJg771I9ITWpW8VY43NYm8M4J0tJsFy9yq8vytJaovuE+xwd:uIjfUI7ri7VBcJ0Z9WymovuE+xwd |
| MD5: | 07F225712B6D097CCEA30B71392D4D89 |
| SHA1: | 73B397773600A1B306A170F24D76E00C7B75D60A |
| SHA-256: | CD9CFE5D2A904341B1321B16E270F61B9772E31703DAC36F7DC768E11315D3B1 |
| SHA-512: | A26357C92387A30DA9AE12650B314B9F250F8D4099171B4BC69468A11A15120797C03043DD775471CE418CA191994B34237F1FF69A917934CB6F940C9909A431 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Windows\System32\WerFault.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1835008 |
| Entropy (8bit): | 4.468912472888815 |
| Encrypted: | false |
| SSDEEP: | 6144:mzZfpi6ceLPx9skLmb0f9ZWSP3aJG8nAgeiJRMMhA2zX4WABluuNvjDH5S:oZHt9ZWOKnMM6bFpNj4 |
| MD5: | 08BE87E532FB560BC4C4A2E31C9E0A93 |
| SHA1: | 7522028493EF855D71995783EEA56C43981CC0A5 |
| SHA-256: | 14B4EEA77C0F5BB9FE7C7D09D8895DAD5F7625556CD7B5239CCFF14E926648E8 |
| SHA-512: | 0895FE8FA8E7F3A9993A4BCDA432E4CC2ED76854C7517773FCB341CAA80B66DBEA93188F53A2EAA617AE5163D622CF4686394C55D012D7DAAB4016F1A4951006 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16016.24947.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 208 |
| Entropy (8bit): | 2.4305258110308814 |
| Encrypted: | false |
| SSDEEP: | 3:rRRqmIEaGj3F/9Dqa+I4AuGLXmuLx:H041lVuGLWm |
| MD5: | FC51E3860D2A83AD586811F10DFB46C0 |
| SHA1: | 14CCE86E0918FA8ED1191D7D7425E44F0EF4138D |
| SHA-256: | 0B1E88DE9B81FA2187463C8465A4C5863402A66AD134CE7CC46E5970FD759BEA |
| SHA-512: | EFBC52214A547A11EBD8A751EE50CBC1315959A1145538439AF98BB0D4E718ABFB84AB02397386890FC36AC9262C5B3A1A608A85A072F943EDD01C61D61B4026 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| File type: | |
| Entropy (8bit): | 6.675048815541203 |
| TrID: |
|
| File name: | SecuriteInfo.com.FileRepMalware.16016.24947.exe |
| File size: | 1'971'712 bytes |
| MD5: | 59a1f2c02e1ad06450edb6a3e66b0b16 |
| SHA1: | d97989ae75a7edf861e3bff3564b6889a09e14f6 |
| SHA256: | 55697f96abab3e4d633d3a505f6546d41b3550ea985aa9871df59b68d860f495 |
| SHA512: | e7b094f5e9f433a47fbe075f7731a98cdd4cf695dce1e0efe6c62b9d55c0ac3cad9cce828f3bf44f3cfd9ded775a707827275eb78d4cc2b971fd0884b491799c |
| SSDEEP: | 24576:DLRpkeEUG0EwMIuAiEplGbOcjKc0LH0+kDNaNCvLU0oh1g5Lt82gspwyZw66n1Du:JpJ6dx3BU/NCTog5y2gtHTnSsLm |
| TLSH: | 0E95BF43A3A502EDC16791388257D707E77274051B109BCB67E84AA96FA3BE12F7F390 |
| File Content Preview: | MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......8...|...|...|...u.D.j...z&*.u...z&..v...z&..x...z&..Z...z&..z.......f...............~.......~...7...Y...|...^....&..v....&(.}.. |
 | |
| Icon Hash: | 00928e8e8686b000 |
| Entrypoint: | 0x14012f1bc |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x140000000 |
| Subsystem: | windows cui |
| Image File Characteristics: | EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE |
| DLL Characteristics: | HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x670DC9D0 [Tue Oct 15 01:48:00 2024 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 6 |
| OS Version Minor: | 0 |
| File Version Major: | 6 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 6 |
| Subsystem Version Minor: | 0 |
| Import Hash: | 36df9176191cadc47b96522ce524f4bc |
| Instruction |
|---|
| dec eax |
| sub esp, 28h |
| call 00007FACD9614AD0h |
| dec eax |
| add esp, 28h |
| jmp 00007FACD9614217h |
| int3 |
| int3 |
| dec eax |
| sub esp, 28h |
| dec ebp |
| mov eax, dword ptr [ecx+38h] |
| dec eax |
| mov ecx, edx |
| dec ecx |
| mov edx, ecx |
| call 00007FACD96143B2h |
| mov eax, 00000001h |
| dec eax |
| add esp, 28h |
| ret |
| int3 |
| int3 |
| int3 |
| inc eax |
| push ebx |
| inc ebp |
| mov ebx, dword ptr [eax] |
| dec eax |
| mov ebx, edx |
| inc ecx |
| and ebx, FFFFFFF8h |
| dec esp |
| mov ecx, ecx |
| inc ecx |
| test byte ptr [eax], 00000004h |
| dec esp |
| mov edx, ecx |
| je 00007FACD96143B5h |
| inc ecx |
| mov eax, dword ptr [eax+08h] |
| dec ebp |
| arpl word ptr [eax+04h], dx |
| neg eax |
| dec esp |
| add edx, ecx |
| dec eax |
| arpl ax, cx |
| dec esp |
| and edx, ecx |
| dec ecx |
| arpl bx, ax |
| dec edx |
| mov edx, dword ptr [eax+edx] |
| dec eax |
| mov eax, dword ptr [ebx+10h] |
| mov ecx, dword ptr [eax+08h] |
| dec eax |
| mov eax, dword ptr [ebx+08h] |
| test byte ptr [ecx+eax+03h], 0000000Fh |
| je 00007FACD96143ADh |
| movzx eax, byte ptr [ecx+eax+03h] |
| and eax, FFFFFFF0h |
| dec esp |
| add ecx, eax |
| dec esp |
| xor ecx, edx |
| dec ecx |
| mov ecx, ecx |
| pop ebx |
| jmp 00007FACD961443Ah |
| int3 |
| dec eax |
| mov eax, esp |
| dec eax |
| mov dword ptr [eax+08h], ebx |
| dec eax |
| mov dword ptr [eax+10h], ebp |
| dec eax |
| mov dword ptr [eax+18h], esi |
| dec eax |
| mov dword ptr [eax+20h], edi |
| inc ecx |
| push esi |
| dec eax |
| sub esp, 20h |
| dec ecx |
| mov ebx, dword ptr [ecx+38h] |
| dec eax |
| mov esi, edx |
| dec ebp |
| mov esi, eax |
| dec eax |
| mov ebp, ecx |
| dec ecx |
| mov edx, ecx |
| dec eax |
| mov ecx, esi |
| dec ecx |
| mov edi, ecx |
| dec esp |
| lea eax, dword ptr [ebx+04h] |
| call 00007FACD9614311h |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x17b0f0 | 0x258 | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x1e4000 | 0x1e8 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x1d6000 | 0xd2b4 | .pdata |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x1e5000 | 0x13c0 | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x166370 | 0x70 | .rdata |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x166400 | 0x28 | .rdata |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x166230 | 0x140 | .rdata |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x133000 | 0xe48 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x131230 | 0x131400 | 70530707e15bedacb71ae1ff17142b8b | False | 0.5417682419635544 | data | 6.49663991165523 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x133000 | 0x4b918 | 0x4ba00 | ef71dd1e3351f1cc41a8055d44ecbc08 | False | 0.4512138429752066 | data | 6.241916934424716 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0x17f000 | 0x56c18 | 0x55a00 | f5faac2a3098287b6964b07cd09c04f7 | False | 0.4868099908759124 | data | 6.343440381373287 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .pdata | 0x1d6000 | 0xd2b4 | 0xd400 | 2b6a29574f58bbdfc8ca0dd660fcb80c | False | 0.47689416273584906 | data | 6.183872917228116 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .rsrc | 0x1e4000 | 0x1e8 | 0x200 | 6c94243ac11a20caa150e2383dfc7606 | False | 0.541015625 | data | 4.772037401703051 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0x1e5000 | 0x13c0 | 0x1400 | 742753df8f255e9c979ffd7a00d02867 | False | 0.4158203125 | data | 5.40694428061472 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_MANIFEST | 0x1e4060 | 0x188 | XML 1.0 document, ASCII text, with CRLF line terminators | English | United States | 0.5892857142857143 |
| DLL | Import |
|---|---|
| d3d11.dll | D3D11CreateDeviceAndSwapChain |
| D3DCOMPILER_47.dll | D3DCompile |
| KERNEL32.dll | ReadFile, PeekNamedPipe, WaitForMultipleObjects, GetFileSizeEx, CreateFileMappingA, GetEnvironmentVariableA, WaitForSingleObjectEx, MoveFileExA, GetTickCount, GetModuleFileNameA, GetModuleHandleW, QueryFullProcessImageNameW, SetLastError, FormatMessageA, LocalFree, EnterCriticalSection, LeaveCriticalSection, QueryPerformanceCounter, VerifyVersionInfoA, ReleaseSRWLockExclusive, CreateFileMappingW, WakeAllConditionVariable, SleepConditionVariableSRW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, IsDebuggerPresent, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, OutputDebugStringW, FreeLibrary, VerSetConditionMask, GetProcAddress, QueryPerformanceFrequency, LoadLibraryA, GetModuleHandleA, GlobalUnlock, GlobalLock, GlobalFree, GlobalAlloc, GetLastError, GetFileAttributesW, lstrcmpiW, GetConsoleWindow, WideCharToMultiByte, CreateThread, CloseHandle, Process32FirstW, CreateFileA, CreateFileW, HeapDestroy, HeapAlloc, HeapReAlloc, HeapFree, HeapSize, GetProcessHeap, GetFileType, InitializeCriticalSectionEx, DeleteCriticalSection, GetCurrentProcess, MapViewOfFile, Process32NextW, GetSystemDirectoryA, Sleep, MultiByteToWideChar, CreateToolhelp32Snapshot, SetConsoleWindowInfo, TerminateProcess, DeviceIoControl, GetStdHandle, SetConsoleScreenBufferSize, SetConsoleTitleA, SetConsoleTextAttribute, VirtualProtect, AcquireSRWLockExclusive, SleepEx, UnmapViewOfFile |
| USER32.dll | SetCursor, SetCursorPos, OpenClipboard, ScreenToClient, GetCursorPos, CloseClipboard, UpdateWindow, FindWindowA, GetClientRect, FindWindowW, TranslateMessage, SetLayeredWindowAttributes, GetForegroundWindow, PeekMessageW, ClientToScreen, DispatchMessageW, LoadCursorW, GetAsyncKeyState, ShowWindow, EmptyClipboard, GetClipboardData, SetClipboardData, GetKeyState, GetWindow, DestroyWindow, SetWindowPos, SetWindowLongPtrW, GetSystemMetrics, GetWindowLongPtrW, MessageBoxA |
| ADVAPI32.dll | ControlService, StartServiceW, DeleteService, OpenSCManagerW, CloseServiceHandle, QueryServiceStatus, CreateServiceW, OpenProcessToken, AddAccessAllowedAce, GetLengthSid, GetTokenInformation, InitializeAcl, IsValidSid, SetSecurityInfo, CopySid, CryptEncrypt, CryptImportKey, CryptDestroyKey, CryptDestroyHash, CryptHashData, CryptCreateHash, CryptGenRandom, CryptGetHashParam, CryptReleaseContext, CryptAcquireContextA, ConvertSidToStringSidA, OpenServiceW |
| MSVCP140.dll | ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ, ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z, ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ, ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z, ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ, ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z, ??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ, ??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z, ?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z, ?always_noconv@codecvt_base@std@@QEBA_NXZ, ?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z, ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ, ?_Incref@facet@locale@std@@UEAAXXZ, ??Bid@locale@std@@QEAA_KXZ, ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z, ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ, ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z, ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z, ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ, ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z, ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z, ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z, ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z, ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z, ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ, ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ, ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z, ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z, ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ, ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ, ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ, ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ, ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ, ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ, ??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z, ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z, ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z, ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ, ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z, _Mtx_unlock, _Thrd_join, ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ, _Xtime_get_ticks, _Query_perf_counter, _Thrd_id, _Thrd_sleep, _Cnd_do_broadcast_at_thread_exit, _Mtx_init_in_situ, _Mtx_lock, _Mtx_destroy_in_situ, ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A, ?_Xlength_error@std@@YAXPEBD@Z, ?id@?$ctype@D@std@@2V0locale@2@A, ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z, ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ, ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ, ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z, ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z, ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z, ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A, ?_Xbad_function_call@std@@YAXXZ, ?_Xout_of_range@std@@YAXPEBD@Z, ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A, _Query_perf_frequency, ??1_Lockit@std@@QEAA@XZ, ??0_Lockit@std@@QEAA@H@Z, ?_Throw_Cpp_error@std@@YAXH@Z, ?uncaught_exceptions@std@@YAHXZ, ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z, ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ, ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z |
| dwmapi.dll | DwmExtendFrameIntoClientArea |
| WINHTTP.dll | WinHttpSendRequest, WinHttpCloseHandle, WinHttpOpenRequest, WinHttpOpen, WinHttpReceiveResponse, WinHttpConnect, WinHttpQueryOption |
| CRYPT32.dll | CertCreateCertificateChainEngine, CryptQueryObject, CertGetNameStringA, CertFindExtension, CertAddCertificateContextToStore, CryptDecodeObjectEx, PFXImportCertStore, CertFreeCertificateChainEngine, CryptStringToBinaryA, CertFindCertificateInStore, CertEnumCertificatesInStore, CertCloseStore, CertOpenStore, CertGetCertificateChain, CertGetCertificateContextProperty, CertFreeCertificateChain, CertFreeCertificateContext |
| IMM32.dll | ImmReleaseContext, ImmSetCompositionWindow, ImmGetContext, ImmSetCandidateWindow |
| Normaliz.dll | IdnToAscii |
| WLDAP32.dll | |
| WS2_32.dll | ntohs, ntohl, closesocket, gethostname, sendto, recvfrom, freeaddrinfo, recv, send, WSAGetLastError, getaddrinfo, select, __WSAFDIsSet, ioctlsocket, listen, htonl, bind, WSACleanup, WSAStartup, WSAIoctl, WSASetLastError, connect, socket, setsockopt, accept, htons, getsockopt, getsockname, getpeername |
| RPCRT4.dll | UuidCreate, UuidToStringA, RpcStringFreeA |
| PSAPI.DLL | GetModuleInformation |
| USERENV.dll | UnloadUserProfile |
| VCRUNTIME140_1.dll | __CxxFrameHandler4 |
| VCRUNTIME140.dll | __current_exception_context, __current_exception, longjmp, strrchr, strchr, memset, memmove, __intrinsic_setjmp, memcmp, memchr, _CxxThrowException, strstr, __std_terminate, __std_exception_copy, __std_exception_destroy, memcpy, __C_specific_handler |
| api-ms-win-crt-runtime-l1-1-0.dll | exit, _invalid_parameter_noinfo, strerror, __sys_nerr, _resetstkoflw, _errno, terminate, system, _beginthreadex, _getpid, _register_thread_local_exe_atexit_callback, _c_exit, __p___argv, __p___argc, _exit, _initterm_e, _initterm, _get_initial_narrow_environment, _set_app_type, _seh_filter_exe, _cexit, _crt_atexit, _register_onexit_function, _initialize_onexit_table, _initialize_narrow_environment, _configure_narrow_argv, _invalid_parameter_noinfo_noreturn |
| api-ms-win-crt-stdio-l1-1-0.dll | __stdio_common_vsprintf_s, fgetc, __p__commode, _lseeki64, __stdio_common_vfprintf, _read, fputc, fwrite, feof, fputs, fopen, _close, _open, __stdio_common_vsprintf, _write, fclose, _popen, _pclose, fgets, fgetpos, setvbuf, __stdio_common_vsscanf, _wfopen, ungetc, fflush, fseek, ftell, _get_stream_buffer_pointers, _set_fmode, _fseeki64, fread, fsetpos, __acrt_iob_func |
| api-ms-win-crt-heap-l1-1-0.dll | calloc, _callnewh, realloc, free, malloc, _set_new_mode |
| api-ms-win-crt-math-l1-1-0.dll | asinf, atanf, ceilf, acosf, _dclass, cosf, fmodf, tanf, cos, powf, sin, sinf, sqrtf, __setusermatherr |
| api-ms-win-crt-string-l1-1-0.dll | strncmp, _strdup, tolower, strpbrk, isupper, strcmp, strcspn, strspn, strncpy |
| api-ms-win-crt-convert-l1-1-0.dll | atoi, atof, strtoll, strtod, strtoul, strtol, strtoull |
| api-ms-win-crt-utility-l1-1-0.dll | qsort, rand |
| api-ms-win-crt-filesystem-l1-1-0.dll | _unlink, _stat64, _fstat64, _lock_file, _access, _unlock_file |
| api-ms-win-crt-locale-l1-1-0.dll | _configthreadlocale, localeconv |
| api-ms-win-crt-time-l1-1-0.dll | _time64, _gmtime64 |
| SHELL32.dll | ShellExecuteA |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | United States |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Oct 20, 2024 23:30:35.104823112 CEST | 49715 | 443 | 192.168.2.6 | 172.67.72.57 |
| Oct 20, 2024 23:30:35.104883909 CEST | 443 | 49715 | 172.67.72.57 | 192.168.2.6 |
| Oct 20, 2024 23:30:35.104950905 CEST | 49715 | 443 | 192.168.2.6 | 172.67.72.57 |
| Oct 20, 2024 23:30:35.106821060 CEST | 49715 | 443 | 192.168.2.6 | 172.67.72.57 |
| Oct 20, 2024 23:30:35.106842041 CEST | 443 | 49715 | 172.67.72.57 | 192.168.2.6 |
| Oct 20, 2024 23:30:35.879642010 CEST | 443 | 49715 | 172.67.72.57 | 192.168.2.6 |
| Oct 20, 2024 23:30:35.879841089 CEST | 49715 | 443 | 192.168.2.6 | 172.67.72.57 |
| Oct 20, 2024 23:30:35.891351938 CEST | 49715 | 443 | 192.168.2.6 | 172.67.72.57 |
| Oct 20, 2024 23:30:35.891376972 CEST | 443 | 49715 | 172.67.72.57 | 192.168.2.6 |
| Oct 20, 2024 23:30:35.891664028 CEST | 443 | 49715 | 172.67.72.57 | 192.168.2.6 |
| Oct 20, 2024 23:30:35.936005116 CEST | 49715 | 443 | 192.168.2.6 | 172.67.72.57 |
| Oct 20, 2024 23:30:36.295541048 CEST | 49715 | 443 | 192.168.2.6 | 172.67.72.57 |
| Oct 20, 2024 23:30:36.339426994 CEST | 443 | 49715 | 172.67.72.57 | 192.168.2.6 |
| Oct 20, 2024 23:30:36.470427990 CEST | 443 | 49715 | 172.67.72.57 | 192.168.2.6 |
| Oct 20, 2024 23:30:36.470482111 CEST | 443 | 49715 | 172.67.72.57 | 192.168.2.6 |
| Oct 20, 2024 23:30:36.470506907 CEST | 443 | 49715 | 172.67.72.57 | 192.168.2.6 |
| Oct 20, 2024 23:30:36.470531940 CEST | 443 | 49715 | 172.67.72.57 | 192.168.2.6 |
| Oct 20, 2024 23:30:36.470556974 CEST | 443 | 49715 | 172.67.72.57 | 192.168.2.6 |
| Oct 20, 2024 23:30:36.470585108 CEST | 443 | 49715 | 172.67.72.57 | 192.168.2.6 |
| Oct 20, 2024 23:30:36.470596075 CEST | 49715 | 443 | 192.168.2.6 | 172.67.72.57 |
| Oct 20, 2024 23:30:36.470635891 CEST | 443 | 49715 | 172.67.72.57 | 192.168.2.6 |
| Oct 20, 2024 23:30:36.470680952 CEST | 49715 | 443 | 192.168.2.6 | 172.67.72.57 |
| Oct 20, 2024 23:30:36.471353054 CEST | 443 | 49715 | 172.67.72.57 | 192.168.2.6 |
| Oct 20, 2024 23:30:36.471450090 CEST | 443 | 49715 | 172.67.72.57 | 192.168.2.6 |
| Oct 20, 2024 23:30:36.471493006 CEST | 49715 | 443 | 192.168.2.6 | 172.67.72.57 |
| Oct 20, 2024 23:30:36.471502066 CEST | 443 | 49715 | 172.67.72.57 | 192.168.2.6 |
| Oct 20, 2024 23:30:36.475470066 CEST | 49715 | 443 | 192.168.2.6 | 172.67.72.57 |
| Oct 20, 2024 23:30:36.547420979 CEST | 49715 | 443 | 192.168.2.6 | 172.67.72.57 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Oct 20, 2024 23:30:35.087404966 CEST | 57124 | 53 | 192.168.2.6 | 1.1.1.1 |
| Oct 20, 2024 23:30:35.094230890 CEST | 53 | 57124 | 1.1.1.1 | 192.168.2.6 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Oct 20, 2024 23:30:35.087404966 CEST | 192.168.2.6 | 1.1.1.1 | 0xfa0a | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Oct 20, 2024 23:30:35.094230890 CEST | 1.1.1.1 | 192.168.2.6 | 0xfa0a | No error (0) | 172.67.72.57 | A (IP address) | IN (0x0001) | false | ||
| Oct 20, 2024 23:30:35.094230890 CEST | 1.1.1.1 | 192.168.2.6 | 0xfa0a | No error (0) | 104.26.0.5 | A (IP address) | IN (0x0001) | false | ||
| Oct 20, 2024 23:30:35.094230890 CEST | 1.1.1.1 | 192.168.2.6 | 0xfa0a | No error (0) | 104.26.1.5 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.6 | 49715 | 172.67.72.57 | 443 | 524 | C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16016.24947.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-20 21:30:36 UTC | 95 | OUT | |
| 2024-10-20 21:30:36 UTC | 1124 | IN | |
| 2024-10-20 21:30:36 UTC | 245 | IN | |
| 2024-10-20 21:30:36 UTC | 1369 | IN | |
| 2024-10-20 21:30:36 UTC | 1369 | IN | |
| 2024-10-20 21:30:36 UTC | 1369 | IN | |
| 2024-10-20 21:30:36 UTC | 1369 | IN | |
| 2024-10-20 21:30:36 UTC | 1369 | IN | |
| 2024-10-20 21:30:36 UTC | 1369 | IN | |
| 2024-10-20 21:30:36 UTC | 1369 | IN | |
| 2024-10-20 21:30:36 UTC | 1369 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 17:30:33 |
| Start date: | 20/10/2024 |
| Path: | C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16016.24947.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff6e0f20000 |
| File size: | 1'971'712 bytes |
| MD5 hash: | 59A1F2C02E1AD06450EDB6A3E66B0B16 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Has exited: | true |
| Target ID: | 1 |
| Start time: | 17:30:33 |
| Start date: | 20/10/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff66e660000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 5 |
| Start time: | 17:30:36 |
| Start date: | 20/10/2024 |
| Path: | C:\Windows\System32\WerFault.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff6f72a0000 |
| File size: | 570'736 bytes |
| MD5 hash: | FD27D9F6D02763BDE32511B5DF7FF7A0 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
Execution Graph
| Execution Coverage: | 1.8% |
| Dynamic/Decrypted Code Coverage: | 0% |
| Signature Coverage: | 38.3% |
| Total number of Nodes: | 345 |
| Total number of Limit Nodes: | 15 |
Graph
Function 00007FF6E0F36360 Relevance: 149.5, APIs: 70, Strings: 15, Instructions: 786sleepprocessfileCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F34FE0 Relevance: 77.5, APIs: 3, Strings: 41, Instructions: 502processCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F34940 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 257encryptionCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E104E9B8 Relevance: 4.6, APIs: 3, Instructions: 127COMMONLIBRARYCODE
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F34DD0 Relevance: 87.6, APIs: 7, Strings: 43, Instructions: 125COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F90F60 Relevance: 58.7, APIs: 21, Strings: 12, Instructions: 908windowthreadCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0FA04F0 Relevance: 58.5, APIs: 14, Strings: 19, Instructions: 793stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F45080 Relevance: 48.3, APIs: 15, Strings: 12, Instructions: 1085fileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F228A0 Relevance: 46.6, APIs: 1, Strings: 29, Instructions: 1625COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F3E990 Relevance: 42.1, APIs: 22, Strings: 2, Instructions: 130servicesleepCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0FB0460 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 191libraryloadernetworkCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F2AF10 Relevance: 36.1, APIs: 2, Strings: 17, Instructions: 2897sleepCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F8A3E0 Relevance: 32.0, APIs: 13, Strings: 5, Instructions: 483COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F8B510 Relevance: 32.0, APIs: 13, Strings: 5, Instructions: 472COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F333E0 Relevance: 29.8, APIs: 8, Strings: 9, Instructions: 97windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F8EAE0 Relevance: 28.4, APIs: 13, Strings: 3, Instructions: 358COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F6FA40 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 96libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0FBB980 Relevance: 24.1, APIs: 16, Instructions: 127networkCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F674B0 Relevance: 23.7, APIs: 12, Strings: 1, Instructions: 901COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F6F440 Relevance: 21.3, APIs: 3, Strings: 9, Instructions: 267COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F7FFC0 Relevance: 20.5, APIs: 1, Strings: 12, Instructions: 962COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0FBEBE0 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 422stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F703A0 Relevance: 16.7, APIs: 11, Instructions: 192keyboardCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F58790 Relevance: 15.0, APIs: 10, Instructions: 50clipboardmemoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F58630 Relevance: 13.6, APIs: 9, Instructions: 96clipboardCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F93E00 Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 399COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F3E8F0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44serviceCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F81130 Relevance: 10.3, APIs: 2, Strings: 4, Instructions: 1329COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E104FA78 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F50360 Relevance: 6.4, APIs: 2, Strings: 2, Instructions: 356COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E104F8F0 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F738D0 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 601COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F29940 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 328COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F29F00 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 328COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F726C0 Relevance: .5, Instructions: 493COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0FB1280 Relevance: .5, Instructions: 462COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F612F0 Relevance: .4, Instructions: 438COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F6FD50 Relevance: .4, Instructions: 430COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F77DC0 Relevance: .4, Instructions: 421COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F4EE60 Relevance: .4, Instructions: 399COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F5EE30 Relevance: .4, Instructions: 367COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F854D0 Relevance: .4, Instructions: 361COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F749F0 Relevance: .3, Instructions: 292COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F52E80 Relevance: .3, Instructions: 272COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F55F00 Relevance: .3, Instructions: 270COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F5D9E0 Relevance: .2, Instructions: 219COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F5B260 Relevance: .2, Instructions: 179COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F6E840 Relevance: .1, Instructions: 117COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F6CF70 Relevance: .1, Instructions: 117COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F440A0 Relevance: .1, Instructions: 104COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F44000 Relevance: .0, Instructions: 41COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F35DD0 Relevance: 47.3, APIs: 21, Strings: 6, Instructions: 88processCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F3E560 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 207COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F9B520 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 284COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F35F90 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 204sleepCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F94610 Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 361COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0FA1EF0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 154COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0FB0140 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128librarystringloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F8F0B0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 282COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F2AE10 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 54COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F3EE00 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 488COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F935C0 Relevance: 16.1, APIs: 1, Strings: 8, Instructions: 335COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F33840 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 173COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F94B90 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 217COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0FA1B70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 161fileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F8FF10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 131processCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0FBCB60 Relevance: 10.7, APIs: 7, Instructions: 242sleepnetworkCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F9BEF0 Relevance: 10.7, APIs: 4, Strings: 3, Instructions: 217stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F94ED0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 209COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0FBE820 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 165stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F386A0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F58860 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 42COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F75AD0 Relevance: 9.4, APIs: 1, Strings: 5, Instructions: 405COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F4D760 Relevance: 9.3, APIs: 3, Strings: 3, Instructions: 280COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F68500 Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 263COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F42C70 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 230COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F43960 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 227COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F92490 Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 219COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F885F0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 102COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F83300 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 206COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0FBC6B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 206COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F2AB40 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 175COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F226D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 113threadCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0FAD5E0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77fileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0FD9260 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F6C6C0 Relevance: 6.4, APIs: 2, Strings: 2, Instructions: 403COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F3FF30 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 85COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F59790 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 39COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F599F0 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 38COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F59540 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 38COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F59DF0 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 38COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F59BA0 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 37COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F4A370 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 424COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F2E0E0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 278COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F75820 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F2A930 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E0F40FA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|