Windows
Analysis Report
TEKujpTgCK.exe
Overview
General Information
Sample name: | TEKujpTgCK.exerenamed because original name is a hash value |
Original sample name: | c84ddc7daab32f1835872b0afe99f3691d7ced32cbd253af31ea8a2f121afc15.exe |
Analysis ID: | 1558461 |
MD5: | 65c23b196d8c066197b3d6e9fc3282a2 |
SHA1: | 7a2412047c4c9d9bd3648600240482122173cb44 |
SHA256: | c84ddc7daab32f1835872b0afe99f3691d7ced32cbd253af31ea8a2f121afc15 |
Tags: | 27-124-18-16exeuser-JAMESWT_MHT |
Infos: | |
Detection
Score: | 48 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Classification
- System is w10x64
- TEKujpTgCK.exe (PID: 7640 cmdline:
"C:\Users\ user\Deskt op\TEKujpT gCK.exe" MD5: 65C23B196D8C066197B3D6E9FC3282A2) - cmd.exe (PID: 7864 cmdline:
"C:\Window s\System32 \cmd.exe" /c start C :\Users\Pu blic\Downl oads\progr am\ShellEx perienceHo sts.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 7872 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - ShellExperienceHosts.exe (PID: 7916 cmdline:
C:\Users\P ublic\Down loads\prog ram\ShellE xperienceH osts.exe MD5: 0922B22053A6D5D9516EA910D34A4771) - WerFault.exe (PID: 8012 cmdline:
C:\Windows \SysWOW64\ WerFault.e xe -u -p 7 916 -s 956 MD5: C31336C1EFC2CCB44B4326EA793040F2)
- cleanup
System Summary |
---|
Source: | Author: Florian Roth (Nextron Systems), Tim Shelton: |
Click to jump to signature section
AV Detection |
---|
Source: | Integrated Neural Analysis Model: |
Source: | Code function: | 5_2_6CA94E30 | |
Source: | Code function: | 5_2_6CA94F50 | |
Source: | Code function: | 5_2_6CA952A0 |
Source: | Static PE information: |
Source: | Binary string: | ||
Source: | Binary string: |
Source: | Code function: | 5_2_6CAA6130 |
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: |
Source: | Code function: | 5_2_6CAB834F |
Source: | Code function: | 5_2_6CA952A0 |
Source: | Code function: | 0_2_00502858 | |
Source: | Code function: | 5_2_6CC1CED0 | |
Source: | Code function: | 5_2_6CAEE837 | |
Source: | Code function: | 5_2_6CC18A54 | |
Source: | Code function: | 5_2_6CAB8A35 | |
Source: | Code function: | 5_2_6CB6EBD1 | |
Source: | Code function: | 5_2_6CC30428 | |
Source: | Code function: | 5_2_6CAA00A0 | |
Source: | Code function: | 5_2_6CC26000 | |
Source: | Code function: | 5_2_6CC3C378 | |
Source: | Code function: | 5_2_6CB6BD12 | |
Source: | Code function: | 5_2_6CC23FCB | |
Source: | Code function: | 5_2_6CC21B54 | |
Source: | Code function: | 5_2_6CBF1501 | |
Source: | Code function: | 5_2_6CA9D680 | |
Source: | Code function: | 5_2_6CC217F5 |
Source: | Process created: |
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: |
Source: | Static PE information: |
Source: | Static PE information: |
Source: | Classification label: |
Source: | Code function: | 5_2_6CAA7560 |
Source: | Code function: | 5_2_6CAA7850 |
Source: | Code function: | 5_2_6CBFEBAE |
Source: | File created: | Jump to behavior |
Source: | Mutant created: | ||
Source: | Mutant created: |
Source: | File created: | Jump to behavior |
Source: | Static PE information: |
Source: | File read: | Jump to behavior |
Source: | Key opened: | Jump to behavior |
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: |
Source: | File read: | Jump to behavior |
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior |
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior |
Source: | Key value queried: | Jump to behavior |
Source: | LNK file: |
Source: | Static file information: |
Source: | Binary string: | ||
Source: | Binary string: |
Source: | Static PE information: |
Source: | Static PE information: |
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: |
Source: | Code function: | 5_2_6CAAAC79 | |
Source: | Code function: | 5_2_6CAAAD25 | |
Source: | Code function: | 5_2_6CAAAE40 | |
Source: | Code function: | 5_2_6CAAAF04 | |
Source: | Code function: | 5_2_6CAAA93D | |
Source: | Code function: | 5_2_6CAAAA19 | |
Source: | Code function: | 5_2_6CAAAB18 | |
Source: | Code function: | 5_2_6CAAA451 | |
Source: | Code function: | 5_2_6CAAA5EB | |
Source: | Code function: | 5_2_6CAAA691 | |
Source: | Code function: | 5_2_6CAAA7E4 | |
Source: | Code function: | 5_2_6CC18193 | |
Source: | Code function: | 5_2_6CAAA211 | |
Source: | Code function: | 5_2_6CAAA35A | |
Source: | Code function: | 5_2_6CAAB806 | |
Source: | Code function: | 5_2_6CAAB57B | |
Source: | Code function: | 5_2_6CAAB6BB | |
Source: | Code function: | 5_2_6CAAB095 | |
Source: | Code function: | 5_2_6CAAB1E6 | |
Source: | Code function: | 5_2_6CAAB2AA | |
Source: | Code function: | 5_2_6CAAB35B |
Source: | Static PE information: | ||
Source: | Static PE information: |
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file |
Source: | Code function: | 5_2_6CAC400C | |
Source: | Code function: | 5_2_6CAC400C | |
Source: | Code function: | 5_2_6CB3A161 | |
Source: | Code function: | 5_2_6CAA9DE0 | |
Source: | Code function: | 5_2_6CAB9A46 | |
Source: | Code function: | 5_2_6CAC741B | |
Source: | Code function: | 5_2_6CB3935C | |
Source: | Code function: | 5_2_6CB3935C | |
Source: | Code function: | 5_2_6CB3935C |
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior |
Source: | Dropped PE file which has not been started: | Jump to dropped file |
Source: | API coverage: |
Source: | Thread sleep time: | Jump to behavior |
Source: | Last function: | ||
Source: | Last function: |
Source: | Thread delayed: | Jump to behavior |
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: |
Source: | Process information queried: | Jump to behavior |
Source: | Process queried: | Jump to behavior |
Source: | Code function: | 5_2_004A152F |
Source: | Code function: | 5_2_6CC18D8D |
Source: | Code function: | 5_2_6CAB479B |
Source: | Code function: | 5_2_6CC18D8D | |
Source: | Code function: | 5_2_6CC22A72 | |
Source: | Code function: | 5_2_6CC184AC |
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior |
Source: | Code function: | 5_2_6CC3EEAC | |
Source: | Code function: | 5_2_6CC3602C | |
Source: | Code function: | 5_2_6CC3F821 | |
Source: | Code function: | 5_2_6CC35AC0 | |
Source: | Code function: | 5_2_6CC3F51C | |
Source: | Code function: | 5_2_6CC3F645 | |
Source: | Code function: | 5_2_6CC3F74B | |
Source: | Code function: | 5_2_6CC3F0B1 | |
Source: | Code function: | 5_2_6CC3F1A3 | |
Source: | Code function: | 5_2_6CC3F158 | |
Source: | Code function: | 5_2_6CC3F2C9 | |
Source: | Code function: | 5_2_6CC3F23E |
Source: | Queries volume information: | Jump to behavior |
Source: | Code function: | 5_2_6CC18EAA |
Source: | Code function: | 5_2_6CB4666D |
Source: | Key value queried: | Jump to behavior |
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: |
Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 2 Command and Scripting Interpreter | 1 DLL Side-Loading | 11 Process Injection | 1 Masquerading | 1 Input Capture | 1 System Time Discovery | Remote Services | 1 Input Capture | 2 Encrypted Channel | Exfiltration Over Other Network Medium | 1 Data Encrypted for Impact |
Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | 1 DLL Side-Loading | 21 Virtualization/Sandbox Evasion | LSASS Memory | 41 Security Software Discovery | Remote Desktop Protocol | 11 Archive Collected Data | 1 Ingress Tool Transfer | Exfiltration Over Bluetooth | Network Denial of Service |
Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | 11 Process Injection | Security Account Manager | 21 Virtualization/Sandbox Evasion | SMB/Windows Admin Shares | Data from Network Shared Drive | Steganography | Automated Exfiltration | Data Encrypted for Impact |
Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 1 Deobfuscate/Decode Files or Information | NTDS | 2 Process Discovery | Distributed Component Object Model | Input Capture | Protocol Impersonation | Traffic Duplication | Data Destruction |
Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 3 Obfuscated Files or Information | LSA Secrets | 1 Application Window Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 2 Software Packing | Cached Domain Credentials | 1 File and Directory Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 1 DLL Side-Loading | DCSync | 24 System Information Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
3% | ReversingLabs |
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
0% | ReversingLabs | |||
3% | ReversingLabs | |||
0% | ReversingLabs |
Name | Source | Malicious | Antivirus Detection | Reputation |
---|---|---|---|---|
false | high | |||
false | high |
Joe Sandbox version: | 41.0.0 Charoite |
Analysis ID: | 1558461 |
Start date and time: | 2024-11-19 13:52:40 +01:00 |
Joe Sandbox product: | CloudBasic |
Overall analysis duration: | 0h 6m 28s |
Hypervisor based Inspection enabled: | false |
Report type: | full |
Cookbook file name: | default.jbs |
Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
Number of analysed new started processes analysed: | 15 |
Number of new started drivers analysed: | 0 |
Number of existing processes analysed: | 0 |
Number of existing drivers analysed: | 0 |
Number of injected processes analysed: | 0 |
Technologies: |
|
Analysis Mode: | default |
Analysis stop reason: | Timeout |
Sample name: | TEKujpTgCK.exerenamed because original name is a hash value |
Original Sample Name: | c84ddc7daab32f1835872b0afe99f3691d7ced32cbd253af31ea8a2f121afc15.exe |
Detection: | MAL |
Classification: | mal48.evad.winEXE@7/10@0/0 |
EGA Information: |
|
HCA Information: |
|
Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 52.168.117.173
- Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, otelrules.azureedge.net, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, time.windows.com
- Execution Graph export aborted for target TEKujpTgCK.exe, PID 7640 because there are no executed function
- Not all processes where analyzed, report is missing behavior information
- Report size getting too big, too many NtOpenKeyEx calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
- VT rate limit hit for: TEKujpTgCK.exe
Time | Type | Description |
---|---|---|
07:53:48 | API Interceptor |
Process: | C:\Windows\SysWOW64\WerFault.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 62556 |
Entropy (8bit): | 1.8604897137674887 |
Encrypted: | false |
SSDEEP: | 192:g1IAZX3/PRQEjPgTDFHvO3SrIbGGqASotG1SflNQRKabqsPNq9cQB5MhrNh:6Io/POEjPgTpGEIbfSq0q6QENr |
MD5: | 5FED066DD5D01EB481162D02BA1ECA51 |
SHA1: | 4FDEEEF9E1D43989520B23DBC96B0A0A5B176357 |
SHA-256: | 8E997B5BE7B2CDB17BF03A8934A56C63280D030C578DCE56CD7418097BF80C9C |
SHA-512: | 513044C6F61202237D5DDD0AFFE7F780A27444F5B8A439F5F9C5589EB4F26A1A3901C25160A6E8FE3DCC039B4FCA4731C88AE58341261EFC55EEF80EF89D2103 |
Malicious: | false |
Reputation: | low |
Preview: |
Process: | C:\Windows\SysWOW64\WerFault.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 6390 |
Entropy (8bit): | 3.7243875135570494 |
Encrypted: | false |
SSDEEP: | 96:RSIU6o7wVetbbO6ax5Y1QE/fzLhR5aM4U+89b23sf7ym:R6l7wVeJbO6afY19fpr+89b23sf7ym |
MD5: | F07929784D1810F5BE78D77DB07B44A8 |
SHA1: | FEBB48EBBE8F39180953D867B9DC08DA611DF707 |
SHA-256: | 5DACA65A8DEAEF63FAF8A05B2D9C61DC2C134CBCE2F44C9710067F65CEC1E667 |
SHA-512: | 859C6A75F62AED7E04265410FA4BA859C80B8EC2227715765E4425B8739E748D90878FCE024AA9DE717F0A2704E1E3021DF065A0C308069B13521201CA0A1C51 |
Malicious: | false |
Reputation: | low |
Preview: |
Process: | C:\Windows\SysWOW64\WerFault.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 4685 |
Entropy (8bit): | 4.501133163114477 |
Encrypted: | false |
SSDEEP: | 48:cvIwWl8zsQJg77aI9kpWjI3WpW8VYOYm8M4JAtPztrF0G+q8AtztBy4LKuhDed:uIjfWI7KgIG7VqJAtLt+GBtztM4uuted |
MD5: | ADF3C9809CF72EAC545CBF247516C8C0 |
SHA1: | 285D136D95AF895D09DD5CCD517AD10C194E1CDE |
SHA-256: | 4EE006C25F7CFA017DA1FA1B398014686CD88B6D0015D21B7C13B73B46F00F5F |
SHA-512: | FDE73A3F622FCEC3AF238DDD30094A91716CEF65B13147F7717359EB22518FB590BD27B88E8C034B2DCFEC604CCBC2F340B66760B51F0A840650EF5160975DE3 |
Malicious: | false |
Reputation: | low |
Preview: |
Process: | C:\Users\user\Desktop\TEKujpTgCK.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 56 |
Entropy (8bit): | 5.173251796980338 |
Encrypted: | false |
SSDEEP: | 3:iqk94GNUUxkiuNS8:ilNNJH8 |
MD5: | 3534422D0B85476052455B2D51291AED |
SHA1: | AA9DBBE75FAB93AFD7E830EE8E743D9F9E12794F |
SHA-256: | BB6EB6543FF1435FD5259ACEDAA08EBDE27A53418F55464BAA9D160197D67364 |
SHA-512: | E7599A845308EB7CEA6978F4FA9F6C837ECFF373C5D9AACC96573087163380E6B112AF125E6195868A3B8AE5E67C6C1F1C588D2364FBD9F723788392B5ECD62D |
Malicious: | false |
Reputation: | low |
Preview: |
Process: | C:\Users\user\Desktop\TEKujpTgCK.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 649416 |
Entropy (8bit): | 6.182028963232553 |
Encrypted: | false |
SSDEEP: | 12288:zohLz8nnnnntnnnnnnnnnnnnnnnxnMvnnnnPZnnnnPxnnnnnnnnqshJSLnk41mCL:zshQmC5Bz5CLgBFqGI1yi/UQeZndsqro |
MD5: | 0922B22053A6D5D9516EA910D34A4771 |
SHA1: | 784D3ED35D040091AE209792E2FA8FC97EE6A071 |
SHA-256: | 41F413DEBFE785B95D852A396AEFE1C814F3C13BDEDF85526F2DC4E83127D6CA |
SHA-512: | 909EC8B2C1045CC11C03C6B82B7ED6AD96BC8E93F9C98CB8A668572C84CBBCE778C12365B2B2EB547218783A830BE41458E0AE21939E99339F54921D98D944D8 |
Malicious: | true |
Antivirus: |
|
Reputation: | low |
Preview: |
Process: | C:\Users\user\Desktop\TEKujpTgCK.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 2934784 |
Entropy (8bit): | 6.677264152867375 |
Encrypted: | false |
SSDEEP: | 49152:JCeuTwfSCMj8ctcrWLGFt3cai8e8jRJVJmfrO0jbjjeDXjRD6i+uSwZPSCdDS+Ok:JCeuEKCMj8XrW6z3caiYRJArO0jLeDXb |
MD5: | BBC7F7FACC3667AF1B57D80FD6D12839 |
SHA1: | 6CAC9DA94670F0A04ED7A4539C8FC2E71BD93563 |
SHA-256: | C8E901576C91D2CE6821B4F807E3ACE7F28A81E5491C7779B89171E8187B76C6 |
SHA-512: | 928F7EF931D4B6F12717C42031C3B82E2594A38909DE5D2D1E9CD0F5314959AEF6BB123941A0C37CCB04799C3EFF6FED0E0BACEC1F2D0A69F5DF34CC1C85FBD5 |
Malicious: | false |
Antivirus: |
|
Reputation: | low |
Preview: |
Process: | C:\Users\user\Desktop\TEKujpTgCK.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 45728224 |
Entropy (8bit): | 7.9979617231953934 |
Encrypted: | true |
SSDEEP: | 786432:nDiGFUGfCK7mtYVMprAcknQyI1PnRbKPkBE25MmXeVYg9n:n1CLtYVMdAcYjGPnpfi25Mj5 |
MD5: | 45177991CB1978D5CB3C06461AE8BE12 |
SHA1: | C2AA0581C86EAE32CC3D7DA720BF5E7B6E019E0E |
SHA-256: | B9C5F836DCBEF426B53B882FA4CD0CBEBD9C43F1734FC20B5001AB9823B8A318 |
SHA-512: | 1B56141CE39B0CBE585574B7C314ACBD7011B4352BF481B80D3C24863198974E885D61E4B92F9E26429E02AF5D3E8D467AF117EA38A2ACB22E8A836E5E7219A7 |
Malicious: | false |
Antivirus: |
|
Joe Sandbox View: |
|
Reputation: | low |
Preview: |
Process: | C:\Users\Public\Downloads\program\ShellExperienceHosts.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 1138 |
Entropy (8bit): | 4.686076011074673 |
Encrypted: | false |
SSDEEP: | 24:8fmGOMlsZgDue/IUAUbSRkCDMbgTJkTJUwqygm:8fmGOpFe/IjDkATJkTJmyg |
MD5: | CEC37821AE6293B3C0450556FE301B4B |
SHA1: | E944A70A89B10FE5EA96ACD6A3B24B294F41AF0D |
SHA-256: | 7277D2559334295B464D11C94E2BAD114446343D8B34D6975248FDD4ACA4804E |
SHA-512: | BBD9C0AA78116932D091EE4A59CF6094B29522E148A203C766475ACA261A786E706C5517252C6638A6CA11F96BF5FA527CBF3FDB5071A65B60FF025CF05CA7AD |
Malicious: | false |
Preview: |
Process: | C:\Windows\SysWOW64\WerFault.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 1835008 |
Entropy (8bit): | 4.417097518177966 |
Encrypted: | false |
SSDEEP: | 6144:ycifpi6ceLPL9skLmb0moSWSPtaJG8nAgex285i2MMhA20X4WABlGuNK5+9:fi58oSWIZBk2MM6AFBko9 |
MD5: | 8284D54DCDCC6AA37183FAE05856A8A1 |
SHA1: | 875E8F8D587B9D575FD7A38C67D98365CE45EB95 |
SHA-256: | 1BF73A2EDF27FF599B790829D96C0F8FC5D7AFB1271EF29768E7FD446271BBFE |
SHA-512: | D5A6A8738F590099F2A1B3A88FE29D988C6693E4E082456A2D303593EEEA6CFB2BF163585CFB499335D2C85F342023FF355F3FDD9A16203C8E12228707724CCA |
Malicious: | false |
Preview: |
Process: | C:\Windows\SysWOW64\WerFault.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 1740800 |
Entropy (8bit): | 4.577765358929387 |
Encrypted: | false |
SSDEEP: | 6144:Qcifpi6ceLPL9skLmb0moSWSPDaJG8nAgex285i2MMhA20X4WABlGuNK5+9:1i58oSWSZBk2MM6AFBko9 |
MD5: | 33BFF25CFFFEBC782F09CF422F3BD85B |
SHA1: | 7ED2042068C74A2AC01693748180EE28829F435F |
SHA-256: | 672095AB29CF28011948CEB7851CEAC355637A52036C06D723CB654DD0F7C526 |
SHA-512: | 09B7D506E1D04F900EF030AED333F247A9C88EBC7550A0E174FDCB9B2CCDCCD4A3DDDAD2C6E82F618159C2C58A99ED0AE5166964BE4B8EFC0B42BB39E708A1AC |
Malicious: | false |
Preview: |
File type: | |
Entropy (8bit): | 7.999165933604983 |
TrID: |
|
File name: | TEKujpTgCK.exe |
File size: | 47'407'259 bytes |
MD5: | 65c23b196d8c066197b3d6e9fc3282a2 |
SHA1: | 7a2412047c4c9d9bd3648600240482122173cb44 |
SHA256: | c84ddc7daab32f1835872b0afe99f3691d7ced32cbd253af31ea8a2f121afc15 |
SHA512: | 1c98f3ee1262af666c22411c18e08b0175887468bf1c186e19fa5ddd845083f36006ded99e11878f303910547bee3324dcc730628cd1b3214d382c37042831f2 |
SSDEEP: | 786432:pOq/jN3x1O1e7yR4mUsc4dtCO6eZST5u3TzmFIlgkAAXSo8K2ZdTq87JEE+cL1QE:L/ZB17y+tVq6eAc3T6FpkAjozKdTDlxR |
TLSH: | 42A733283398F069E27AC875C75342FE0C526D1AC926F4AA62753E4E7AF8D44F17B341 |
File Content Preview: | MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L...~.&L.....................................0....@..........................p.......,.......................................P............................. |
Icon Hash: | 55497933cc61714d |
Entrypoint: | 0x411def |
Entrypoint Section: | .text |
Digitally signed: | false |
Imagebase: | 0x400000 |
Subsystem: | windows gui |
Image File Characteristics: | RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE |
DLL Characteristics: | |
Time Stamp: | 0x4C26F87E [Sun Jun 27 07:06:38 2010 UTC] |
TLS Callbacks: | |
CLR (.Net) Version: | |
OS Version Major: | 4 |
OS Version Minor: | 0 |
File Version Major: | 4 |
File Version Minor: | 0 |
Subsystem Version Major: | 4 |
Subsystem Version Minor: | 0 |
Import Hash: | b5a014d7eeb4c2042897567e1288a095 |
Instruction |
---|
push ebp |
mov ebp, esp |
push FFFFFFFFh |
push 00414C50h |
push 00411F80h |
mov eax, dword ptr fs:[00000000h] |
push eax |
mov dword ptr fs:[00000000h], esp |
sub esp, 68h |
push ebx |
push esi |
push edi |
mov dword ptr [ebp-18h], esp |
xor ebx, ebx |
mov dword ptr [ebp-04h], ebx |
push 00000002h |
call dword ptr [00413184h] |
pop ecx |
or dword ptr [00419924h], FFFFFFFFh |
or dword ptr [00419928h], FFFFFFFFh |
call dword ptr [00413188h] |
mov ecx, dword ptr [0041791Ch] |
mov dword ptr [eax], ecx |
call dword ptr [0041318Ch] |
mov ecx, dword ptr [00417918h] |
mov dword ptr [eax], ecx |
mov eax, dword ptr [00413190h] |
mov eax, dword ptr [eax] |
mov dword ptr [00419920h], eax |
call 00007F5088507EA2h |
cmp dword ptr [00417710h], ebx |
jne 00007F5088507D8Eh |
push 00411F78h |
call dword ptr [00413194h] |
pop ecx |
call 00007F5088507E74h |
push 00417048h |
push 00417044h |
call 00007F5088507E5Fh |
mov eax, dword ptr [00417914h] |
mov dword ptr [ebp-6Ch], eax |
lea eax, dword ptr [ebp-6Ch] |
push eax |
push dword ptr [00417910h] |
lea eax, dword ptr [ebp-64h] |
push eax |
lea eax, dword ptr [ebp-70h] |
push eax |
lea eax, dword ptr [ebp-60h] |
push eax |
call dword ptr [0041319Ch] |
push 00417040h |
push 00417000h |
call 00007F5088507E2Ch |
Name | Virtual Address | Virtual Size | Is in Section |
---|---|---|---|
IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_IMPORT | 0x150dc | 0xb4 | .rdata |
IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x1a000 | 0x6cb00 | .rsrc |
IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_IAT | 0x13000 | 0x310 | .rdata |
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
---|---|---|---|---|---|---|---|---|---|
.text | 0x1000 | 0x11317 | 0x11400 | 797279c5ab1a163aed1f2a528f9fe3ce | False | 0.6174988677536232 | data | 6.576987441854239 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
.rdata | 0x13000 | 0x30ea | 0x3200 | 1359639b02bcb8f0a8743e6ead1c0030 | False | 0.43828125 | data | 5.549434098115495 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
.data | 0x17000 | 0x292c | 0x800 | 9415c9c8dea3245d6d73c23393e27d8e | False | 0.431640625 | data | 3.6583182363171756 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
.rsrc | 0x1a000 | 0x6cb00 | 0x6cc00 | bbd437e4641c3885ad89fc27ee6f1626 | False | 0.14299119971264368 | data | 5.721209360114448 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
---|---|---|---|---|---|---|
RT_CURSOR | 0x1c600 | 0x134 | Targa image data - Mono - RLE 64 x 65536 x 1 +32 "\001" | 0.35714285714285715 | ||
RT_CURSOR | 0x1c734 | 0x134 | data | 0.44155844155844154 | ||
RT_CURSOR | 0x1c868 | 0x134 | Targa image data - Mono 64 x 65536 x 1 +32 "\001" | 0.40584415584415584 | ||
RT_CURSOR | 0x1c99c | 0x134 | Targa image data 64 x 65536 x 1 +32 "\001" | 0.5746753246753247 | ||
RT_CURSOR | 0x1cad0 | 0x134 | AmigaOS bitmap font "(", fc_YSize 4294966287, 3840 elements, 2nd "\376\017\340\377\377\017\341\377\377\217\343\377\377\337\367\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd | 0.4642857142857143 | ||
RT_CURSOR | 0x1cc04 | 0x134 | Targa image data - Map - RLE 64 x 65536 x 1 +32 "\001" | 0.32142857142857145 | ||
RT_CURSOR | 0x1cd38 | 0x134 | data | 0.3409090909090909 | ||
RT_CURSOR | 0x1ce6c | 0x134 | Targa image data - Map - RLE 64 x 65536 x 1 +32 "\001" | 0.4837662337662338 | ||
RT_CURSOR | 0x1cfa0 | 0x134 | AmigaOS bitmap font "(", fc_YSize 4294935297, 3840 elements, 2nd "\200\003\377\201\300\007\377\203\300\017\377\003\340\037\376\007\360\037\370\017\370\003\300\037\374", 3rd | 0.711038961038961 | ||
RT_CURSOR | 0x1d0d4 | 0x134 | data | 0.6038961038961039 | ||
RT_CURSOR | 0x1d208 | 0x134 | Targa image data 64 x 65536 x 1 +32 "\001" | 0.36038961038961037 | ||
RT_CURSOR | 0x1d33c | 0x134 | Targa image data 64 x 65536 x 1 +32 "\001" | 0.3474025974025974 | ||
RT_CURSOR | 0x1d470 | 0x134 | AmigaOS bitmap font "(", fc_YSize 4294967040, 3840 elements, 2nd "\376", 3rd | 0.4383116883116883 | ||
RT_CURSOR | 0x1d5a4 | 0x134 | Targa image data - RLE 64 x 65536 x 1 +32 "\001" | 0.35064935064935066 | ||
RT_CURSOR | 0x1d6d8 | 0x134 | Targa image data - Mono 64 x 65536 x 1 +32 "\001" | 0.4512987012987013 | ||
RT_CURSOR | 0x1d80c | 0x134 | Targa image data - Mono 64 x 65536 x 1 +32 "\001" | 0.39285714285714285 | ||
RT_CURSOR | 0x1d940 | 0x134 | Targa image data - Mono 64 x 65536 x 1 +32 "\001" | 0.4967532467532468 | ||
RT_CURSOR | 0x1da74 | 0x134 | Targa image data - Map - RLE 64 x 65536 x 1 +32 "\001" | 0.32142857142857145 | ||
RT_CURSOR | 0x1dba8 | 0x134 | Targa image data - Map 64 x 65536 x 1 +32 "\001" | 0.38636363636363635 | ||
RT_CURSOR | 0x1dcdc | 0x134 | data | 0.4642857142857143 | ||
RT_CURSOR | 0x1de10 | 0x134 | data | 0.4805194805194805 | ||
RT_CURSOR | 0x1df44 | 0x134 | data | 0.38311688311688313 | ||
RT_CURSOR | 0x1e078 | 0x134 | data | 0.36038961038961037 | ||
RT_CURSOR | 0x1e1ac | 0x134 | data | 0.4090909090909091 | ||
RT_CURSOR | 0x1e2e0 | 0x134 | Targa image data - RGB 64 x 65536 x 1 +32 "\001" | 0.4967532467532468 | ||
RT_BITMAP | 0x1e414 | 0x1d0 | Device independent bitmap graphic, 36 x 18 x 4, image size 360 | 0.43103448275862066 | ||
RT_BITMAP | 0x1e5e4 | 0x1e4 | Device independent bitmap graphic, 36 x 19 x 4, image size 380 | 0.46487603305785125 | ||
RT_BITMAP | 0x1e7c8 | 0x1d0 | Device independent bitmap graphic, 36 x 18 x 4, image size 360 | 0.43103448275862066 | ||
RT_BITMAP | 0x1e998 | 0x1d0 | Device independent bitmap graphic, 36 x 18 x 4, image size 360 | 0.39870689655172414 | ||
RT_BITMAP | 0x1eb68 | 0x1d0 | Device independent bitmap graphic, 36 x 18 x 4, image size 360 | 0.4245689655172414 | ||
RT_BITMAP | 0x1ed38 | 0x1d0 | Device independent bitmap graphic, 36 x 18 x 4, image size 360 | 0.5021551724137931 | ||
RT_BITMAP | 0x1ef08 | 0x1d0 | Device independent bitmap graphic, 36 x 18 x 4, image size 360 | 0.5064655172413793 | ||
RT_BITMAP | 0x1f0d8 | 0x1d0 | Device independent bitmap graphic, 36 x 18 x 4, image size 360 | 0.39655172413793105 | ||
RT_BITMAP | 0x1f2a8 | 0x1d0 | Device independent bitmap graphic, 36 x 18 x 4, image size 360 | 0.5344827586206896 | ||
RT_BITMAP | 0x1f478 | 0x1d0 | Device independent bitmap graphic, 36 x 18 x 4, image size 360 | 0.39655172413793105 | ||
RT_BITMAP | 0x1f648 | 0xc0 | Device independent bitmap graphic, 11 x 11 x 4, image size 88 | Russian | Russia | 0.40625 |
RT_BITMAP | 0x1f708 | 0xc0 | Device independent bitmap graphic, 11 x 11 x 4, image size 88 | Russian | Russia | 0.40625 |
RT_BITMAP | 0x1f7c8 | 0xa8 | Device independent bitmap graphic, 10 x 8 x 4, image size 64 | 0.49404761904761907 | ||
RT_BITMAP | 0x1f870 | 0x134 | Device independent bitmap graphic, 18 x 17 x 4, image size 204 | 0.37337662337662336 | ||
RT_BITMAP | 0x1f9a4 | 0xb8 | Device independent bitmap graphic, 10 x 10 x 4, image size 80 | Russian | Russia | 0.41304347826086957 |
RT_BITMAP | 0x1fa5c | 0xb8 | Device independent bitmap graphic, 11 x 10 x 4, image size 80 | Russian | Russia | 0.45652173913043476 |
RT_BITMAP | 0x1fb14 | 0xb8 | Device independent bitmap graphic, 10 x 10 x 4, image size 80 | Russian | Russia | 0.42391304347826086 |
RT_BITMAP | 0x1fbcc | 0xb8 | Device independent bitmap graphic, 11 x 10 x 4, image size 80 | Russian | Russia | 0.44565217391304346 |
RT_BITMAP | 0x1fc84 | 0x90 | Device independent bitmap graphic, 8 x 10 x 4, image size 40 | 0.4861111111111111 | ||
RT_BITMAP | 0x1fd14 | 0x11c | Device independent bitmap graphic, 38 x 9 x 4, image size 180 | 0.4507042253521127 | ||
RT_BITMAP | 0x1fe30 | 0xc0 | Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors | 0.5208333333333334 | ||
RT_BITMAP | 0x1fef0 | 0xe0 | Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors | 0.42857142857142855 | ||
RT_BITMAP | 0x1ffd0 | 0xe0 | Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors | 0.4955357142857143 | ||
RT_BITMAP | 0x200b0 | 0x8c | Device independent bitmap graphic, 5 x 9 x 4, image size 36 | 0.5285714285714286 | ||
RT_BITMAP | 0x2013c | 0xc8 | Device independent bitmap graphic, 12 x 12 x 4, image size 96 | Russian | Russia | 0.41 |
RT_BITMAP | 0x20204 | 0xc8 | Device independent bitmap graphic, 12 x 12 x 4, image size 96 | Russian | Russia | 0.39 |
RT_BITMAP | 0x202cc | 0x8c | Device independent bitmap graphic, 5 x 9 x 4, image size 36 | 0.45 | ||
RT_BITMAP | 0x20358 | 0x238 | Device independent bitmap graphic, 29 x 29 x 4, image size 464 | 0.25 | ||
RT_BITMAP | 0x20590 | 0x238 | Device independent bitmap graphic, 29 x 29 x 4, image size 464 | 0.20950704225352113 | ||
RT_BITMAP | 0x207c8 | 0x8c | Device independent bitmap graphic, 5 x 9 x 4, image size 36 | 0.5071428571428571 | ||
RT_BITMAP | 0x20854 | 0x8c | Device independent bitmap graphic, 5 x 9 x 4, image size 36 | 0.5142857142857142 | ||
RT_BITMAP | 0x208e0 | 0x8c | Device independent bitmap graphic, 5 x 9 x 4, image size 36 | 0.4857142857142857 | ||
RT_BITMAP | 0x2096c | 0x238 | Device independent bitmap graphic, 29 x 29 x 4, image size 464 | 0.21654929577464788 | ||
RT_BITMAP | 0x20ba4 | 0xe8 | Device independent bitmap graphic, 16 x 16 x 4, image size 128 | 0.3232758620689655 | ||
RT_BITMAP | 0x20c8c | 0xe8 | Device independent bitmap graphic, 16 x 16 x 4, image size 128 | 0.28448275862068967 | ||
RT_BITMAP | 0x20d74 | 0xe8 | Device independent bitmap graphic, 16 x 16 x 4, image size 128 | 0.2629310344827586 | ||
RT_BITMAP | 0x20e5c | 0xe8 | Device independent bitmap graphic, 16 x 16 x 4, image size 128 | 0.33189655172413796 | ||
RT_BITMAP | 0x20f44 | 0x4ac | Device independent bitmap graphic, 11 x 11 x 8, image size 132 | 0.4498327759197324 | ||
RT_BITMAP | 0x213f0 | 0x4ac | Device independent bitmap graphic, 11 x 11 x 8, image size 132 | 0.459866220735786 | ||
RT_BITMAP | 0x2189c | 0x528 | Device independent bitmap graphic, 16 x 16 x 8, image size 256 | 0.5280303030303031 | ||
RT_BITMAP | 0x21dc4 | 0xe0 | Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors | 0.38392857142857145 | ||
RT_BITMAP | 0x21ea4 | 0xc0 | Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors | 0.4947916666666667 | ||
RT_BITMAP | 0x21f64 | 0xc0 | Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors | 0.484375 | ||
RT_BITMAP | 0x22024 | 0xe0 | Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors | 0.42410714285714285 | ||
RT_BITMAP | 0x22104 | 0xc0 | Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors | 0.5104166666666666 | ||
RT_BITMAP | 0x221c4 | 0xe0 | Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors | 0.5 | ||
RT_BITMAP | 0x222a4 | 0xe8 | Device independent bitmap graphic, 16 x 16 x 4, image size 128 | 0.4870689655172414 | ||
RT_BITMAP | 0x2238c | 0xc0 | Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors | 0.4895833333333333 | ||
RT_BITMAP | 0x2244c | 0x378 | Device independent bitmap graphic, 110 x 14 x 4, image size 784 | German | Germany | 0.23085585585585586 |
RT_BITMAP | 0x227c4 | 0xd8 | Device independent bitmap graphic, 15 x 14 x 4, image size 112, resolution 2834 x 2834 px/m | Serbian | Cyrillic | 0.4675925925925926 |
RT_BITMAP | 0x2289c | 0xe0 | Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors | 0.3794642857142857 | ||
RT_ICON | 0x2297c | 0x668 | Device independent bitmap graphic, 48 x 96 x 4, image size 0 | 0.21341463414634146 | ||
RT_ICON | 0x22fe4 | 0x2e8 | Device independent bitmap graphic, 32 x 64 x 4, image size 0 | 0.34139784946236557 | ||
RT_ICON | 0x232cc | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 0 | 0.5202702702702703 | ||
RT_ICON | 0x233f4 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 0 | 0.47334754797441364 | ||
RT_ICON | 0x2429c | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 0 | 0.6101083032490975 | ||
RT_ICON | 0x24b44 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 0 | 0.596820809248555 | ||
RT_ICON | 0x250ac | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 0 | 0.2932572614107884 | ||
RT_ICON | 0x27654 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 0 | 0.4343339587242026 | ||
RT_ICON | 0x286fc | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 0 | 0.7198581560283688 | ||
RT_DIALOG | 0x28b64 | 0x52 | data | 0.7682926829268293 | ||
RT_STRING | 0x28bb8 | 0x6c | data | 0.6851851851851852 | ||
RT_STRING | 0x28c24 | 0x2d0 | data | 0.46111111111111114 | ||
RT_STRING | 0x28ef4 | 0x250 | data | 0.49155405405405406 | ||
RT_STRING | 0x29144 | 0x214 | data | 0.4567669172932331 | ||
RT_STRING | 0x29358 | 0x180 | data | 0.5286458333333334 | ||
RT_STRING | 0x294d8 | 0x1a4 | data | 0.5428571428571428 | ||
RT_STRING | 0x2967c | 0x3c0 | data | 0.3489583333333333 | ||
RT_STRING | 0x29a3c | 0x6a4 | data | 0.36 | ||
RT_STRING | 0x2a0e0 | 0x48c | data | 0.38230240549828176 | ||
RT_STRING | 0x2a56c | 0x19c | data | 0.5145631067961165 | ||
RT_STRING | 0x2a708 | 0xec | data | 0.597457627118644 | ||
RT_STRING | 0x2a7f4 | 0x1a8 | data | 0.5 | ||
RT_STRING | 0x2a99c | 0x2b8 | data | 0.4454022988505747 | ||
RT_STRING | 0x2ac54 | 0x414 | data | 0.36398467432950193 | ||
RT_STRING | 0x2b068 | 0x3b4 | data | 0.37658227848101267 | ||
RT_STRING | 0x2b41c | 0x340 | data | 0.3762019230769231 | ||
RT_STRING | 0x2b75c | 0x354 | data | 0.35563380281690143 | ||
RT_STRING | 0x2bab0 | 0x2d0 | data | 0.4513888888888889 | ||
RT_STRING | 0x2bd80 | 0xd8 | data | 0.5694444444444444 | ||
RT_STRING | 0x2be58 | 0xf0 | data | 0.55 | ||
RT_STRING | 0x2bf48 | 0x350 | data | 0.4033018867924528 | ||
RT_STRING | 0x2c298 | 0x384 | data | 0.37444444444444447 | ||
RT_STRING | 0x2c61c | 0x2d8 | data | 0.375 | ||
RT_RCDATA | 0x2c8f4 | 0x10 | data | 1.5 | ||
RT_RCDATA | 0x2c904 | 0x590 | data | 0.6327247191011236 | ||
RT_RCDATA | 0x2ce94 | 0x133db | Delphi compiled form 'TCreatePluginForm' | 0.09238558069305046 | ||
RT_RCDATA | 0x40270 | 0x2f1a | Delphi compiled form 'TdxBarCustomizingForm' | 0.25543207828827336 | ||
RT_RCDATA | 0x4318c | 0x4b0 | Delphi compiled form 'TdxBarItemAddEditor' | 0.4608333333333333 | ||
RT_RCDATA | 0x4363c | 0x287 | Delphi compiled form 'TdxBarNameEd' | 0.6058732612055642 | ||
RT_RCDATA | 0x438c4 | 0x171 | Delphi compiled form 'TdxBarSubMenuEditor' | 0.7100271002710027 | ||
RT_RCDATA | 0x43a38 | 0x1491 | Delphi compiled form 'TFindForm' | 0.2641975308641975 | ||
RT_RCDATA | 0x44ecc | 0x49c | Delphi compiled form 'TfrmAddGroupItems' | 0.4610169491525424 | ||
RT_RCDATA | 0x45368 | 0x1595 | Delphi compiled form 'THintForm' | 0.11782805429864253 | ||
RT_RCDATA | 0x46900 | 0x1aaf | Delphi compiled form 'TInputStringForm' | 0.2577953447518665 | ||
RT_RCDATA | 0x483b0 | 0x36a23 | Delphi compiled form 'TMainForm' | 0.09694832848479974 | ||
RT_RCDATA | 0x7edd4 | 0x751e | Delphi compiled form 'TPageForm' | 0.1721032619571743 | ||
RT_GROUP_CURSOR | 0x862f4 | 0x14 | data | 1.35 | ||
RT_GROUP_CURSOR | 0x86308 | 0x14 | data | 1.3 | ||
RT_GROUP_CURSOR | 0x8631c | 0x14 | data | 1.4 | ||
RT_GROUP_CURSOR | 0x86330 | 0x14 | data | 1.4 | ||
RT_GROUP_CURSOR | 0x86344 | 0x14 | data | 1.4 | ||
RT_GROUP_CURSOR | 0x86358 | 0x14 | data | 1.4 | ||
RT_GROUP_CURSOR | 0x8636c | 0x14 | data | 1.4 | ||
RT_GROUP_CURSOR | 0x86380 | 0x14 | data | 1.4 | ||
RT_GROUP_CURSOR | 0x86394 | 0x14 | data | 1.4 | ||
RT_GROUP_CURSOR | 0x863a8 | 0x14 | data | 1.4 | ||
RT_GROUP_CURSOR | 0x863bc | 0x14 | data | 1.4 | ||
RT_GROUP_CURSOR | 0x863d0 | 0x14 | data | 1.4 | ||
RT_GROUP_CURSOR | 0x863e4 | 0x14 | data | 1.4 | ||
RT_GROUP_CURSOR | 0x863f8 | 0x14 | data | 1.4 | ||
RT_GROUP_CURSOR | 0x8640c | 0x14 | data | 1.4 | ||
RT_GROUP_CURSOR | 0x86420 | 0x14 | data | 1.4 | ||
RT_GROUP_CURSOR | 0x86434 | 0x14 | data | 1.4 | ||
RT_GROUP_CURSOR | 0x86448 | 0x14 | data | 1.4 | ||
RT_GROUP_CURSOR | 0x8645c | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | 1.3 | ||
RT_GROUP_CURSOR | 0x86470 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | 1.3 | ||
RT_GROUP_CURSOR | 0x86484 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | 1.3 | ||
RT_GROUP_CURSOR | 0x86498 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | 1.3 | ||
RT_GROUP_CURSOR | 0x864ac | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | 1.3 | ||
RT_GROUP_CURSOR | 0x864c0 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | 1.3 | ||
RT_GROUP_CURSOR | 0x864d4 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | 1.3 | ||
RT_GROUP_ICON | 0x864e8 | 0x84 | data | 0.6363636363636364 | ||
RT_VERSION | 0x8656c | 0x350 | data | English | United States | 0.47523584905660377 |
RT_MANIFEST | 0x868bc | 0x244 | XML 1.0 document, ASCII text, with CRLF line terminators | Chinese | China | 0.453448275862069 |
DLL | Import |
---|---|
COMCTL32.dll | |
KERNEL32.dll | GetFileAttributesW, CreateDirectoryW, WriteFile, GetStdHandle, VirtualFree, GetModuleHandleW, GetProcAddress, LoadLibraryA, LockResource, LoadResource, SizeofResource, FindResourceExA, MulDiv, GlobalFree, GlobalAlloc, lstrcmpiA, GetSystemDefaultLCID, GetSystemDefaultUILanguage, GetUserDefaultUILanguage, MultiByteToWideChar, GetLocaleInfoW, lstrlenA, lstrcmpiW, GetEnvironmentVariableW, lstrcmpW, GlobalMemoryStatusEx, VirtualAlloc, WideCharToMultiByte, ExpandEnvironmentStringsW, RemoveDirectoryW, FindClose, FindNextFileW, DeleteFileW, FindFirstFileW, SetThreadLocale, GetLocalTime, GetSystemTimeAsFileTime, lstrlenW, GetTempPathW, SetEnvironmentVariableW, CloseHandle, CreateFileW, GetDriveTypeW, SetCurrentDirectoryW, GetModuleFileNameW, GetCommandLineW, GetVersionExW, CreateEventW, SetEvent, ResetEvent, InitializeCriticalSection, TerminateThread, ResumeThread, SuspendThread, IsBadReadPtr, LocalFree, lstrcpyW, FormatMessageW, GetSystemDirectoryW, DeleteCriticalSection, GetFileSize, SetFilePointer, ReadFile, SetFileTime, SetEndOfFile, EnterCriticalSection, LeaveCriticalSection, WaitForMultipleObjects, GetModuleHandleA, SystemTimeToFileTime, GetLastError, CreateThread, WaitForSingleObject, GetExitCodeThread, Sleep, SetLastError, SetFileAttributesW, GetDiskFreeSpaceExW, lstrcatW, ExitProcess, CompareFileTime, GetStartupInfoA |
USER32.dll | CharUpperW, EndDialog, DestroyWindow, KillTimer, ReleaseDC, DispatchMessageW, GetMessageW, SetTimer, CreateWindowExW, ScreenToClient, GetWindowRect, wsprintfW, GetParent, GetSystemMenu, EnableMenuItem, EnableWindow, MessageBeep, LoadIconW, LoadImageW, wvsprintfW, IsWindow, DefWindowProcW, CallWindowProcW, DrawIconEx, DialogBoxIndirectParamW, GetWindow, ClientToScreen, GetDC, DrawTextW, ShowWindow, SystemParametersInfoW, SetFocus, SetWindowLongW, GetSystemMetrics, GetClientRect, GetDlgItem, GetKeyState, MessageBoxA, wsprintfA, SetWindowTextW, GetSysColor, GetWindowTextLengthW, GetWindowTextW, GetClassNameA, GetWindowLongW, GetMenu, SetWindowPos, CopyImage, SendMessageW, GetWindowDC |
GDI32.dll | GetCurrentObject, StretchBlt, SetStretchBltMode, CreateCompatibleBitmap, SelectObject, CreateCompatibleDC, GetObjectW, GetDeviceCaps, DeleteObject, CreateFontIndirectW, DeleteDC |
SHELL32.dll | SHGetFileInfoW, SHBrowseForFolderW, SHGetPathFromIDListW, SHGetMalloc, ShellExecuteExW, SHGetSpecialFolderPathW, ShellExecuteW |
ole32.dll | CoInitialize, CreateStreamOnHGlobal, CoCreateInstance |
OLEAUT32.dll | VariantClear, OleLoadPicture, SysAllocString |
MSVCRT.dll | __set_app_type, __p__fmode, __p__commode, _adjust_fdiv, __setusermatherr, _initterm, __getmainargs, _acmdln, exit, _XcptFilter, _exit, ??1type_info@@UAE@XZ, _onexit, __dllonexit, _CxxThrowException, _beginthreadex, _EH_prolog, memset, _wcsnicmp, strncmp, malloc, memmove, _wtol, memcpy, free, memcmp, _purecall, ??2@YAPAXI@Z, ??3@YAXPAX@Z, _except_handler3, _controlfp |
Language of compilation system | Country where language is spoken | Map |
---|---|---|
Russian | Russia | |
German | Germany | |
Serbian | Cyrillic | |
English | United States | |
Chinese | China |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
Target ID: | 0 |
Start time: | 07:53:39 |
Start date: | 19/11/2024 |
Path: | C:\Users\user\Desktop\TEKujpTgCK.exe |
Wow64 process (32bit): | true |
Commandline: | |
Imagebase: | 0x400000 |
File size: | 47'407'259 bytes |
MD5 hash: | 65C23B196D8C066197B3D6E9FC3282A2 |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | low |
Has exited: | true |
Target ID: | 3 |
Start time: | 07:53:48 |
Start date: | 19/11/2024 |
Path: | C:\Windows\SysWOW64\cmd.exe |
Wow64 process (32bit): | true |
Commandline: | |
Imagebase: | 0x410000 |
File size: | 236'544 bytes |
MD5 hash: | D0FCE3AFA6AA1D58CE9FA336CC2B675B |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | high |
Has exited: | true |
Target ID: | 4 |
Start time: | 07:53:48 |
Start date: | 19/11/2024 |
Path: | C:\Windows\System32\conhost.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x7ff75da10000 |
File size: | 862'208 bytes |
MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | high |
Has exited: | true |
Target ID: | 5 |
Start time: | 07:53:48 |
Start date: | 19/11/2024 |
Path: | C:\Users\Public\Downloads\program\ShellExperienceHosts.exe |
Wow64 process (32bit): | true |
Commandline: | |
Imagebase: | 0x400000 |
File size: | 649'416 bytes |
MD5 hash: | 0922B22053A6D5D9516EA910D34A4771 |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Antivirus matches: |
|
Reputation: | low |
Has exited: | false |
Target ID: | 8 |
Start time: | 07:53:48 |
Start date: | 19/11/2024 |
Path: | C:\Windows\SysWOW64\WerFault.exe |
Wow64 process (32bit): | true |
Commandline: | |
Imagebase: | 0x290000 |
File size: | 483'680 bytes |
MD5 hash: | C31336C1EFC2CCB44B4326EA793040F2 |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | high |
Has exited: | false |
Function 00502858 Relevance: .6, Instructions: 617COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Execution Graph
Execution Coverage: | 3.4% |
Dynamic/Decrypted Code Coverage: | 0.1% |
Signature Coverage: | 8.5% |
Total number of Nodes: | 1234 |
Total number of Limit Nodes: | 27 |
Graph
Function 6CA94E30 Relevance: 31.6, APIs: 2, Strings: 16, Instructions: 98encryptionCOMMON
Control-flow Graph
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAA7850 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 377comCOMMON
Control-flow Graph
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CA952A0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 142encryptionCOMMON
Control-flow Graph
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CA94F50 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 66encryptionCOMMON
Control-flow Graph
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAC004E Relevance: 68.6, APIs: 34, Strings: 5, Instructions: 356stringCOMMON
Control-flow Graph
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAC056D Relevance: 64.8, APIs: 43, Instructions: 298COMMON
Control-flow Graph
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAA8130 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 267threadsynchronizationwindowCOMMON
Control-flow Graph
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAA72B0 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 410sleepprocessfileCOMMON
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB48711 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25libraryloaderCOMMON
Control-flow Graph
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CABFAB5 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CC356D3 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 63COMMONLIBRARYCODE
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CC37420 Relevance: 4.5, APIs: 3, Instructions: 17fileCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CA97A80 Relevance: 3.2, APIs: 2, Instructions: 194COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CC17E64 Relevance: 3.1, APIs: 2, Instructions: 76COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CC31598 Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAA6D30 Relevance: 1.7, APIs: 1, Instructions: 204COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CC2E7C9 Relevance: 1.7, APIs: 1, Instructions: 157COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CABECCF Relevance: 1.6, APIs: 1, Instructions: 96COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CC3BA22 Relevance: 1.6, APIs: 1, Instructions: 59COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CC347AC Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CABE03F Relevance: 1.5, APIs: 1, Instructions: 8COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAA72A0 Relevance: 1.3, APIs: 1, Instructions: 4sleepCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB3A161 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 213windowCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAA6130 Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 378networkmemoryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CBFEBAE Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 133memoryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB3935C Relevance: 13.6, APIs: 9, Instructions: 88windowCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAEE837 Relevance: 9.4, APIs: 6, Instructions: 438COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CC3F645 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CC3EEAC Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 254COMMONLIBRARYCODE
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB4666D Relevance: 6.1, APIs: 4, Instructions: 84threadCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAC400C Relevance: 6.1, APIs: 4, Instructions: 52windowCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CC18EAA Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CC3F2C9 Relevance: 4.7, APIs: 3, Instructions: 205COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAA9DE0 Relevance: 3.1, APIs: 2, Instructions: 101windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAC741B Relevance: 3.0, APIs: 2, Instructions: 36windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CC3F51C Relevance: 1.6, APIs: 1, Instructions: 83COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CC3F74B Relevance: 1.5, APIs: 1, Instructions: 48COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CC3F0B1 Relevance: 1.5, APIs: 1, Instructions: 43COMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAB9A46 Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CA943E0 Relevance: 45.8, APIs: 3, Strings: 23, Instructions: 317windowCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CACFB41 Relevance: 44.1, APIs: 24, Strings: 1, Instructions: 327fileCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CA916B7 Relevance: 42.0, APIs: 12, Strings: 12, Instructions: 42registryclipboardCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAA3470 Relevance: 40.5, APIs: 3, Strings: 20, Instructions: 278windowCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB452B5 Relevance: 40.5, APIs: 18, Strings: 5, Instructions: 228registryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAB677E Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 179windowCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAAC117 Relevance: 28.6, APIs: 19, Instructions: 80COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAA4EC0 Relevance: 24.3, APIs: 16, Instructions: 303COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB6BB09 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 131windowCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAB6E50 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 118windowCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAB5ED2 Relevance: 15.5, APIs: 10, Instructions: 482COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAD07AC Relevance: 15.2, APIs: 10, Instructions: 200COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAA62B0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 195networkmemoryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB45112 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 144registrylibraryloaderCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAB77C9 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 65windowCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB633EA Relevance: 13.7, APIs: 9, Instructions: 202COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB4A030 Relevance: 13.6, APIs: 9, Instructions: 137COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAC1D84 Relevance: 13.6, APIs: 9, Instructions: 89windowCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CACDE35 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 261windowCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAB8046 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 209libraryloaderCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAC3762 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 121windowCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB94F3D Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49libraryloaderCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAAFCC9 Relevance: 12.1, APIs: 8, Instructions: 123COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAD0044 Relevance: 12.1, APIs: 8, Instructions: 85memoryCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CABFC21 Relevance: 12.1, APIs: 8, Instructions: 65COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB6538C Relevance: 12.1, APIs: 8, Instructions: 57COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAC1F5D Relevance: 12.0, APIs: 8, Instructions: 49memoryCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB82040 Relevance: 12.0, APIs: 8, Instructions: 34COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB2938C Relevance: 10.9, APIs: 7, Instructions: 414COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAAF4DD Relevance: 10.8, APIs: 7, Instructions: 310COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB55DCD Relevance: 10.6, APIs: 7, Instructions: 142COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAB48CE Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 118libraryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB49274 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 102registryCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAB8907 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 101libraryloaderCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAA3F40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAB349D Relevance: 10.6, APIs: 7, Instructions: 82windowCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CC35C8D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAAB990 Relevance: 10.6, APIs: 7, Instructions: 71windowCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAB9769 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 70libraryloaderCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB95CA2 Relevance: 10.6, APIs: 7, Instructions: 66COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAB5C13 Relevance: 10.6, APIs: 7, Instructions: 65COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB94DD2 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB95622 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 35libraryloaderCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB94EE1 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33libraryloaderCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB9521A Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33libraryloaderCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB94E8C Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 29libraryloaderCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB94E37 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 29libraryloaderCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB954C1 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 29libraryloaderCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB81FEE Relevance: 10.5, APIs: 7, Instructions: 25COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CACA58C Relevance: 9.3, APIs: 6, Instructions: 297COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB6FD99 Relevance: 9.3, APIs: 6, Instructions: 263COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB39D9B Relevance: 9.3, APIs: 6, Instructions: 257windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CBF4508 Relevance: 9.2, APIs: 6, Instructions: 203COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAA3210 Relevance: 9.2, APIs: 6, Instructions: 179windowCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CC1A56B Relevance: 9.2, APIs: 6, Instructions: 177COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB6E2C6 Relevance: 9.1, APIs: 6, Instructions: 147windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAAC918 Relevance: 9.1, APIs: 6, Instructions: 131COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CBF1AEA Relevance: 9.1, APIs: 6, Instructions: 108windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB364E9 Relevance: 9.1, APIs: 6, Instructions: 105COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAB9BD8 Relevance: 9.1, APIs: 6, Instructions: 86windowCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CBB5DD1 Relevance: 9.1, APIs: 6, Instructions: 84windowCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CABF67A Relevance: 9.1, APIs: 6, Instructions: 84windowCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAC2A4A Relevance: 9.1, APIs: 6, Instructions: 71COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CBF03FC Relevance: 9.1, APIs: 6, Instructions: 63windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CC1CFE6 Relevance: 9.1, APIs: 6, Instructions: 60COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAB83BD Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 215windowCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAA5770 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 94windowCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB30AEB Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 77windowCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CC27E2C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB9508F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35libraryloaderCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB95033 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 33libraryloaderCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CA9F910 Relevance: 7.9, APIs: 5, Instructions: 420COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB57166 Relevance: 7.8, APIs: 5, Instructions: 266COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CA926E0 Relevance: 7.7, APIs: 5, Instructions: 222COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CBE0046 Relevance: 7.7, APIs: 5, Instructions: 220windowCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB6D2A1 Relevance: 7.7, APIs: 5, Instructions: 218windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CA9AD80 Relevance: 7.7, APIs: 5, Instructions: 188COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CA94A00 Relevance: 7.7, APIs: 5, Instructions: 180windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB39034 Relevance: 7.7, APIs: 5, Instructions: 178windowCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB3C6FB Relevance: 7.7, APIs: 5, Instructions: 168windowCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB48B39 Relevance: 7.7, APIs: 5, Instructions: 164stringCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAA9F10 Relevance: 7.6, APIs: 5, Instructions: 132windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB1E4E5 Relevance: 7.6, APIs: 5, Instructions: 117COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CBF5C75 Relevance: 7.6, APIs: 5, Instructions: 116COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAADB9A Relevance: 7.6, APIs: 5, Instructions: 109COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CA9A960 Relevance: 7.6, APIs: 5, Instructions: 104COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CA9B640 Relevance: 7.6, APIs: 5, Instructions: 104COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CA9B0F0 Relevance: 7.6, APIs: 5, Instructions: 104COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CBA1329 Relevance: 7.6, APIs: 5, Instructions: 100windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CACACF0 Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CABA104 Relevance: 7.6, APIs: 5, Instructions: 81windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAB3078 Relevance: 7.6, APIs: 5, Instructions: 68COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB65480 Relevance: 7.6, APIs: 5, Instructions: 67windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAC289E Relevance: 7.6, APIs: 5, Instructions: 61COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAC236C Relevance: 7.6, APIs: 5, Instructions: 61COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAB3BD6 Relevance: 7.6, APIs: 5, Instructions: 56COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CBE35A4 Relevance: 7.5, APIs: 5, Instructions: 43COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB309E8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91timewindowCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAB599D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46libraryloaderCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB45A3E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43libraryloaderCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB45A9D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40libraryloaderCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CC1E132 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAD149C Relevance: 6.4, APIs: 4, Instructions: 433COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAB2BEF Relevance: 6.4, APIs: 4, Instructions: 380windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB25E7A Relevance: 6.2, APIs: 4, Instructions: 230windowCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CBF10A3 Relevance: 6.2, APIs: 4, Instructions: 198comCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAAF8C6 Relevance: 6.2, APIs: 4, Instructions: 194COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB307AF Relevance: 6.2, APIs: 4, Instructions: 190COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB63025 Relevance: 6.2, APIs: 4, Instructions: 178COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAD0D7B Relevance: 6.2, APIs: 4, Instructions: 177COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB49D40 Relevance: 6.2, APIs: 4, Instructions: 159COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CACA40E Relevance: 6.1, APIs: 4, Instructions: 145windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CA94790 Relevance: 6.1, APIs: 4, Instructions: 137windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAF3AAC Relevance: 6.1, APIs: 4, Instructions: 130COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAC32E6 Relevance: 6.1, APIs: 4, Instructions: 112windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CABEEFC Relevance: 6.1, APIs: 4, Instructions: 108windowCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAB78F2 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CABC9BD Relevance: 6.1, APIs: 4, Instructions: 101windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAAE4AC Relevance: 6.1, APIs: 4, Instructions: 98COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB9402B Relevance: 6.1, APIs: 4, Instructions: 96COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAB3E8F Relevance: 6.1, APIs: 4, Instructions: 81COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CC2DE9E Relevance: 6.1, APIs: 4, Instructions: 75COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CBFED31 Relevance: 6.1, APIs: 4, Instructions: 74COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAB9482 Relevance: 6.1, APIs: 4, Instructions: 71windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB394DD Relevance: 6.1, APIs: 4, Instructions: 65windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CA91F30 Relevance: 6.1, APIs: 4, Instructions: 64COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB944C5 Relevance: 6.1, APIs: 4, Instructions: 63COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB977B6 Relevance: 6.1, APIs: 4, Instructions: 63COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB95A11 Relevance: 6.1, APIs: 4, Instructions: 62stringCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAB01FB Relevance: 6.1, APIs: 4, Instructions: 58COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAC3F6E Relevance: 6.1, APIs: 4, Instructions: 58windowCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAB773F Relevance: 6.1, APIs: 4, Instructions: 56COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CA94AE0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAA3920 Relevance: 6.0, APIs: 4, Instructions: 48COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAAD667 Relevance: 6.0, APIs: 4, Instructions: 48COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAB9CF7 Relevance: 6.0, APIs: 4, Instructions: 46COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CAB7223 Relevance: 6.0, APIs: 4, Instructions: 45COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB62EF1 Relevance: 6.0, APIs: 4, Instructions: 42COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CABCB47 Relevance: 6.0, APIs: 4, Instructions: 41windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CBDFA9E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 130registryCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB4576F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47registryCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB4588E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41registryCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6CB45809 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40registryCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|