Edit tour
Windows
Analysis Report
conhost.exe
Overview
General Information
| Sample Name: | conhost.exe |
| Analysis ID: | 599739 |
| MD5: | 0d698af330fd17bee3bf90011d49251d |
| SHA1: | 52a7274a0b4f9493632060fe25993a2ef24fe827 |
| SHA256: | 3c1c6d813d2b031d988204155fc198fe4f32ff56c05dabbcfcd5486131f4fb9d |
| Infos: | |
 | |
Detection
| Score: | 5 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 80% |
Signatures
Sample file is different than original file name gathered from version info
PE file contains strange resources
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Uses code obfuscation techniques (call, push, ret)
PE file contains sections with non-standard names
Detected potential crypto function
Found potential string decryption / allocating functions
Contains functionality to call native functions
Contains functionality to communicate with device drivers
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Program does not show much activity (idle)
Classification
- System is w10x64
conhost.exe (PID: 6744 cmdline: "C:\Users\ user\Deskt op\conhost .exe" -ins tall MD5: 0D698AF330FD17BEE3BF90011D49251D)
- conhost.exe (PID: 6904 cmdline:
"C:\Users\ user\Deskt op\conhost .exe" /ins tall MD5: 0D698AF330FD17BEE3BF90011D49251D)
- conhost.exe (PID: 7008 cmdline:
"C:\Users\ user\Deskt op\conhost .exe" /loa d MD5: 0D698AF330FD17BEE3BF90011D49251D)
- cleanup
⊘No configs have been found
⊘No yara matches
⊘No Sigma rule has matched
Click to jump to signature section
Show All Signature Results
There are no malicious signatures, click here to show all signatures.
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary or memory string: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_00007FF6A8D5C9D4 | |
| Source: | Code function: | 0_2_00007FF6A8CD8B00 | |
| Source: | Code function: | 0_2_00007FF6A8CDAC10 | |
| Source: | Code function: | 0_2_00007FF6A8D4ED00 | |
| Source: | Code function: | 0_2_00007FF6A8CDA190 | |
| Source: | Code function: | 0_2_00007FF6A8CD82B0 | |
| Source: | Code function: | 0_2_00007FF6A8D62794 | |
| Source: | Code function: | 0_2_00007FF6A8CE8930 | |
| Source: | Code function: | 0_2_00007FF6A8D2C880 | |
| Source: | Code function: | 0_2_00007FF6A8D23C14 | |
| Source: | Code function: | 0_2_00007FF6A8D69B90 | |
| Source: | Code function: | 0_2_00007FF6A8CD9B70 | |
| Source: | Code function: | 0_2_00007FF6A8D2DDF0 | |
| Source: | Code function: | 0_2_00007FF6A8CE7ED0 | |
| Source: | Code function: | 0_2_00007FF6A8D5DE7C | |
| Source: | Code function: | 0_2_00007FF6A8D53FF8 | |
| Source: | Code function: | 0_2_00007FF6A8D6A000 | |
| Source: | Code function: | 0_2_00007FF6A8D09FBC | |
| Source: | Code function: | 0_2_00007FF6A8CDB140 | |
| Source: | Code function: | 0_2_00007FF6A8D55140 | |
| Source: | Code function: | 0_2_00007FF6A8CD7300 | |
| Source: | Code function: | 0_2_00007FF6A8D23290 | |
| Source: | Code function: | 0_2_00007FF6A8D69418 | |
| Source: | Code function: | 0_2_00007FF6A8D2D3A8 | |
| Source: | Code function: | 0_2_00007FF6A8D494E4 | |
| Source: | Code function: | 0_2_00007FF6A8CD5600 | |
| Source: | Code function: | 0_2_00007FF6A8CE7544 | |
| Source: | Code function: | 0_2_00007FF6A8CE76D8 | |
| Source: | Code function: | 0_2_00007FF6A8D417F0 | |
| Source: | Code function: | 0_2_00007FF6A8D53764 | |
| Source: | Code function: | 0_2_00007FF6A8D56C78 | |
| Source: | Code function: | 0_2_00007FF6A8CEC30C | |
| Source: | Code function: | 0_2_00007FF6A8D563D8 | |
| Source: | Code function: | 0_2_00007FF6A8CEAF14 | |
| Source: | Static PE information: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Code function: | 0_2_00007FF6A8D288B8 | |
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Binary string: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 0_2_00007FF6A8CD2C54 | |
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_00007FF6A8D9F332 | |
| Source: | Static PE information: | ||
| Source: | Thread injection, dropped files, key value created, disk infection and DNS query: | ||
| Source: | Code function: | 0_2_00007FF6A8CDCEC8 | |
| Source: | Code function: | 0_2_00007FF6A8D069FC | |
| Source: | Thread injection, dropped files, key value created, disk infection and DNS query: | ||
| Source: | Code function: | 0_2_00007FF6A8CEE848 | |
| Source: | Code function: | 0_2_00007FF6A8CEF440 | |
| Source: | Code function: | 0_2_00007FF6A8CEF638 | |
| Source: | Code function: | 0_2_00007FF6A8CEF2DC | |
| Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Exfiltration | Command and Control | Network Effects | Remote Service Effects | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Valid Accounts | 2 Command and Scripting Interpreter | Path Interception | 1 Process Injection | 1 Process Injection | OS Credential Dumping | 1 System Time Discovery | Remote Services | 1 Archive Collected Data | Exfiltration Over Other Network Medium | 1 Encrypted Channel | Eavesdrop on Insecure Network Communication | Remotely Track Device Without Authorization | Modify System Partition |
| Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | Boot or Logon Initialization Scripts | 1 Deobfuscate/Decode Files or Information | LSASS Memory | 2 Security Software Discovery | Remote Desktop Protocol | Data from Removable Media | Exfiltration Over Bluetooth | Junk Data | Exploit SS7 to Redirect Phone Calls/SMS | Remotely Wipe Data Without Authorization | Device Lockout |
| Domain Accounts | At (Linux) | Logon Script (Windows) | Logon Script (Windows) | 2 Obfuscated Files or Information | Security Account Manager | 2 System Information Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | Automated Exfiltration | Steganography | Exploit SS7 to Track Device Location | Obtain Device Cloud Backups | Delete Device Data |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Metadefender | Browse | ||
| 0% | ReversingLabs |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Joe Sandbox Version: | 34.0.0 Boulder Opal |
| Analysis ID: | 599739 |
| Start date and time: | 2022-03-30 00:27:41 +02:00 |
| Joe Sandbox Product: | CloudBasic |
| Overall analysis duration: | 0h 5m 41s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Sample file name: | conhost.exe |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211 |
| Run name: | Cmdline fuzzy |
| Number of analysed new started processes analysed: | 27 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Detection: | CLEAN |
| Classification: | clean5.winEXE@3/0@0/0 |
| EGA Information: | Failed |
| HDC Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Excluded IPs from analysis (whitelisted): 23.211.6.115
- Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, ctldl.windowsupdate.com, settings-win.data.microsoft.com, store-images.s-microsoft.com-c.edgekey.net, arc.msn.com, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, go.microsoft.com, store-images.s-microsoft.com, sls.update.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net
- Execution Graph export aborted for target conhost.exe, PID 6744 because there are no executed function
- Not all processes where analyzed, report is missing behavior information
- VT rate limit hit for: conhost.exe
⊘No simulations
⊘No created / dropped files found
| File type: | |
| Entropy (8bit): | 6.389554828127213 |
| TrID: |
|
| File name: | conhost.exe |
| File size: | 862208 |
| MD5: | 0d698af330fd17bee3bf90011d49251d |
| SHA1: | 52a7274a0b4f9493632060fe25993a2ef24fe827 |
| SHA256: | 3c1c6d813d2b031d988204155fc198fe4f32ff56c05dabbcfcd5486131f4fb9d |
| SHA512: | 298ec9d63b9bfa84c07bd32827ab5d3985da8d955cf4f36018ce6994768e37715df3603edd4eca2c68a80089d4a4ed184550ec4936b7ddc55e100ff6e4d67c71 |
| SSDEEP: | 12288:ac4SbTjKm3X608EWSEa9oTGdVgmq2h6vYpz6wJapK:8cpa08VS5/VVh8YpzbJeK |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PWg..6...6...6...N..p6...]...6...]...6...6...3...]...6...]...6...]..26...]...6...]...6...]...6..Rich.6..........PE..d....K.V... |
 | |
| Icon Hash: | b0ef7ac32101a5a0 |
| Entrypoint: | 0x14001e7f0 |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x140000000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE |
| DLL Characteristics: | GUARD_CF, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA |
| Time Stamp: | 0x56B24BE3 [Wed Feb 3 18:50:11 2016 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 10 |
| OS Version Minor: | 0 |
| File Version Major: | 10 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 10 |
| Subsystem Version Minor: | 0 |
| Import Hash: | c21b297aeb85cef1bcce8d72106bbdd0 |
| Instruction |
|---|
| dec eax |
| sub esp, 28h |
| call 00007FF7C4726B58h |
| dec eax |
| add esp, 28h |
| jmp 00007FF7C4725EE3h |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| nop word ptr [eax+eax+00000000h] |
| dec eax |
| cmp ecx, dword ptr [000A2A51h] |
| jne 00007FF7C4726085h |
| dec eax |
| rol ecx, 10h |
| test cx, FFFFh |
| jne 00007FF7C4726075h |
| ret |
| dec eax |
| ror ecx, 10h |
| jmp 00007FF7C47260E4h |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| inc eax |
| push ebx |
| dec eax |
| sub esp, 20h |
| dec eax |
| mov ebx, ecx |
| call dword ptr [0007F6F9h] |
| mov ecx, 00000001h |
| mov dword ptr [000A311Eh], eax |
| call 00007FF7C4726C3Eh |
| xor ecx, ecx |
| call dword ptr [0007F721h] |
| dec eax |
| mov ecx, ebx |
| call dword ptr [0007F720h] |
| cmp dword ptr [000A3101h], 00000000h |
| jne 00007FF7C472607Ch |
| mov ecx, 00000001h |
| call 00007FF7C4726C1Ah |
| call dword ptr [0007F937h] |
| dec eax |
| mov ecx, eax |
| mov edx, C0000409h |
| dec eax |
| add esp, 20h |
| pop ebx |
| dec eax |
| jmp dword ptr [0007F943h] |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| dec eax |
| mov dword ptr [esp+08h], ecx |
| dec eax |
| sub esp, 00000000h |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0xbc1c8 | 0x3e8 | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0xd0000 | 0x86a0 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0xc5000 | 0x9678 | .pdata |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0xd9000 | 0xd9c | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0xa30d0 | 0x70 | .rdata |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x9d180 | 0x28 | .rdata |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x9c8f0 | 0x118 | .rdata |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x9df10 | 0xa30 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0xba580 | 0x6c0 | .rdata |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x99390 | 0x99400 | False | 0.515809798124 | data | 6.32206951087 | IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ |
| .rdata | 0x9b000 | 0x24562 | 0x24600 | False | 0.407854112973 | data | 5.69606443901 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0xc0000 | 0x48a8 | 0x1400 | False | 0.2412109375 | data | 3.23312444263 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ |
| .pdata | 0xc5000 | 0x9678 | 0x9800 | False | 0.510665090461 | data | 5.99032109009 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .didat | 0xcf000 | 0x608 | 0x800 | False | 0.224609375 | Dyalog APL DFS component file 64-bit level 3 journaled checksummed version 2.64 | 2.45356820095 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ |
| .rsrc | 0xd0000 | 0x86a0 | 0x8800 | False | 0.285874310662 | data | 4.38933989252 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0xd9000 | 0xd9c | 0xe00 | False | 0.364397321429 | data | 5.41339750422 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country |
|---|---|---|---|---|---|
| MUI | 0xd85c8 | 0xd8 | data | English | United States |
| RT_ICON | 0xd09b0 | 0x668 | data | English | United States |
| RT_ICON | 0xd1018 | 0x2e8 | dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 356432, next used block 458800 | English | United States |
| RT_ICON | 0xd1300 | 0x128 | GLS_BINARY_LSB_FIRST | English | United States |
| RT_ICON | 0xd1428 | 0xea8 | data | English | United States |
| RT_ICON | 0xd22d0 | 0x8a8 | dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 0, next used block 0 | English | United States |
| RT_ICON | 0xd2b78 | 0x568 | GLS_BINARY_LSB_FIRST | English | United States |
| RT_ICON | 0xd30e0 | 0x169e | PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced | English | United States |
| RT_ICON | 0xd4780 | 0x25a8 | data | English | United States |
| RT_ICON | 0xd6d28 | 0x10a8 | data | English | United States |
| RT_ICON | 0xd7dd0 | 0x468 | GLS_BINARY_LSB_FIRST | English | United States |
| RT_GROUP_ICON | 0xd8238 | 0x92 | data | English | United States |
| RT_VERSION | 0xd0620 | 0x38c | data | English | United States |
| RT_MANIFEST | 0xd0380 | 0x29d | XML 1.0 document, ASCII text, with CRLF line terminators | English | United States |
| RT_MANIFEST | 0xd82d0 | 0x2f4 | XML 1.0 document, ASCII text, with CRLF line terminators | English | United States |
| DLL | Import |
|---|---|
| msvcp_win.dll | ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ, ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z, ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ, ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ, ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ, ?width@ios_base@std@@QEBA_JXZ, ?width@ios_base@std@@QEAA_J_J@Z, ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z, ?good@ios_base@std@@QEBA_NXZ, ?uncaught_exception@std@@YA_NXZ, ?flags@ios_base@std@@QEBAHXZ, ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ, ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z, ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ, ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ, ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ, ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z, ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ, ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ, ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ, ?_Xlength_error@std@@YAXPEBD@Z, ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z, ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z, ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z, ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z, ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z, ?setf@ios_base@std@@QEAAHHH@Z, ?setf@ios_base@std@@QEAAHH@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@F@Z, ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z, ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z, ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z, ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z, ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z, ?_Xout_of_range@std@@YAXPEBD@Z, ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ, ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z, ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ, ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ, ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ, ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ, ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ, ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z, ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ, ?_Xbad_function_call@std@@YAXXZ, ?_Xinvalid_argument@std@@YAXPEBD@Z, ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z, _Mtx_destroy_in_situ, _Mtx_unlock, ?_Throw_C_error@std@@YAXH@Z, _Mtx_lock, _Mtx_init_in_situ, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ |
| api-ms-win-crt-time-l1-1-0.dll | _time64 |
| api-ms-win-crt-runtime-l1-1-0.dll | _initterm, _initterm_e, _register_thread_local_exe_atexit_callback, _c_exit |
| api-ms-win-crt-private-l1-1-0.dll | _o__get_wide_winmain_command_line, _o__initialize_onexit_table, _o__initialize_wide_environment, _o__invalid_parameter_noinfo, _o__invalid_parameter_noinfo_noreturn, _o__itoa_s, _o__purecall, _o__register_onexit_function, _o__seh_filter_exe, _o__set_app_type, _o__set_fmode, _o__set_new_mode, memmove, _o__wcsicmp, _o__wcsnicmp, _o_calloc, _o_exit, _o_floor, _o_free, _o_iswdigit, _o_iswspace, _o_malloc, _o_roundf, _o_sqrt, _o_terminate, _o_towlower, _o_towupper, _o_wcscpy_s, _o_wcstol, _o_wcstoul, __C_specific_handler, __CxxFrameHandler3, _CxxThrowException, _o__cexit, _o__callnewh, _o__exit, _o__errno, _o___stdio_common_vswprintf_s, _o___stdio_common_vswprintf, _o___stdio_common_vsprintf_s, _o___stdio_common_vsprintf, _o___stdio_common_vsnwprintf_s, _o___stdio_common_vsnprintf_s, _o___std_exception_destroy, _o___std_exception_copy, _o__crt_atexit, _o___p__commode, _o__configure_wide_argv, __std_terminate, __CxxFrameHandler4, _o__configthreadlocale, memcmp, memcpy, wcschr |
| api-ms-win-crt-string-l1-1-0.dll | wcsncmp, wcscmp, memset, wcsnlen |
| api-ms-win-core-libraryloader-l1-2-0.dll | LoadResource, FreeLibrary, GetModuleFileNameW, LockResource, GetModuleHandleExW, LoadLibraryExW, FindResourceExW, GetModuleHandleW, GetProcAddress, GetModuleFileNameA, LoadStringW |
| api-ms-win-core-synch-l1-1-0.dll | CreateEventW, InitializeCriticalSectionAndSpinCount, EnterCriticalSection, LeaveCriticalSection, TryEnterCriticalSection, DeleteCriticalSection, InitializeCriticalSection, CreateMutexExW, OpenSemaphoreW, WaitForSingleObjectEx, ResetEvent, ReleaseMutex, SetEvent, WaitForSingleObject, CreateSemaphoreExW, ReleaseSemaphore, CreateEventExW, ReleaseSRWLockShared, AcquireSRWLockShared, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, InitializeCriticalSectionEx |
| api-ms-win-core-heap-l1-1-0.dll | GetProcessHeap, HeapFree, HeapAlloc |
| api-ms-win-core-errorhandling-l1-1-0.dll | SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetLastError, SetLastError |
| api-ms-win-core-processthreads-l1-1-0.dll | GetCurrentProcessId, UpdateProcThreadAttribute, GetCurrentThread, DeleteProcThreadAttributeList, CreateProcessW, GetProcessTimes, GetStartupInfoW, GetCurrentThreadId, GetCurrentProcess, OpenProcessToken, SetProcessShutdownParameters, ExitThread, TerminateProcess, CreateThread, InitializeProcThreadAttributeList |
| api-ms-win-core-localization-l1-2-0.dll | FormatMessageW, GetACP, GetOEMCP, GetCPInfo, IsValidCodePage, GetUserDefaultLocaleName |
| api-ms-win-core-debug-l1-1-0.dll | DebugBreak, IsDebuggerPresent, OutputDebugStringW, OutputDebugStringA |
| api-ms-win-core-handle-l1-1-0.dll | DuplicateHandle, CloseHandle |
| api-ms-win-core-threadpool-legacy-l1-1-0.dll | DeleteTimerQueueTimer, CreateTimerQueueTimer, DeleteTimerQueueEx, CreateTimerQueue |
| api-ms-win-core-file-l1-1-0.dll | WriteFile, ReadFile |
| api-ms-win-core-sidebyside-l1-1-0.dll | CreateActCtxW |
| api-ms-win-core-processenvironment-l1-1-0.dll | GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, SearchPathW, GetStdHandle, SetEnvironmentVariableW |
| api-ms-win-core-registry-l1-1-0.dll | RegGetValueW, RegCloseKey, RegEnumValueW, RegOpenKeyExW, RegQueryValueExW, RegOpenCurrentUser |
| api-ms-win-core-string-l1-1-0.dll | MultiByteToWideChar, WideCharToMultiByte, GetStringTypeW, CompareStringOrdinal |
| api-ms-win-core-sysinfo-l1-1-0.dll | GetSystemTimeAsFileTime, GetWindowsDirectoryW, GetSystemDirectoryW |
| api-ms-win-core-threadpool-l1-2-0.dll | CreateThreadpoolTimer, SetThreadpoolTimer, WaitForThreadpoolTimerCallbacks, CloseThreadpoolTimer |
| api-ms-win-eventing-provider-l1-1-0.dll | EventWriteTransfer, EventActivityIdControl, EventSetInformation, EventRegister, EventUnregister |
| api-ms-win-core-psapi-l1-1-0.dll | QueryFullProcessImageNameW |
| api-ms-win-core-shlwapi-legacy-l1-1-0.dll | PathFileExistsW, PathFindFileNameW, PathIsSameRootW |
| api-ms-win-shcore-obsolete-l1-1-0.dll | CommandLineToArgvW |
| api-ms-win-core-heap-l2-1-0.dll | GlobalAlloc, GlobalFree, LocalFree |
| ntdll.dll | RtlFreeHeap, RtlAllocateHeap, RtlQueryPackageClaims, NtQueryVolumeInformationFile, CsrClientCallServer, NtAlpcSendWaitReceivePort, NtAlpcQueryInformationMessage, AlpcGetMessageAttribute, AlpcInitializeMessageAttribute, RtlCreateUnicodeString, NtAlpcConnectPort |
| api-ms-win-core-rtlsupport-l1-1-0.dll | RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind |
| api-ms-win-core-processthreads-l1-1-1.dll | IsProcessorFeaturePresent, OpenProcess |
| api-ms-win-core-profile-l1-1-0.dll | QueryPerformanceCounter |
| api-ms-win-core-interlocked-l1-1-0.dll | InitializeSListHead |
| api-ms-win-core-registry-l2-1-0.dll | RegCreateKeyW, RegOpenKeyW |
| api-ms-win-core-synch-l1-2-0.dll | SignalObjectAndWait, Sleep |
| api-ms-win-core-io-l1-1-0.dll | DeviceIoControl |
| api-ms-win-core-libraryloader-l1-2-1.dll | LoadLibraryW |
| api-ms-win-core-com-l1-1-0.dll | CoTaskMemFree, CoCreateInstance, CoInitializeEx, CoUninitialize |
| api-ms-win-core-heap-obsolete-l1-1-0.dll | GlobalSize, GlobalLock, GlobalUnlock |
| api-ms-win-core-io-l1-1-1.dll | CancelSynchronousIo |
| api-ms-win-core-util-l1-1-0.dll | Beep |
| api-ms-win-core-apiquery-l1-1-0.dll | ApiSetQueryApiSetPresence |
| api-ms-win-security-base-l1-1-0.dll | GetSidSubAuthority, GetTokenInformation, GetSidSubAuthorityCount |
| api-ms-win-core-path-l1-1-0.dll | PathCchRemoveExtension |
| api-ms-win-shell-shellcom-l1-1-0.dll | SHCoCreateInstance |
| api-ms-win-core-sysinfo-l1-2-0.dll | VerSetConditionMask |
| api-ms-win-core-kernel32-legacy-l1-1-1.dll | VerifyVersionInfoW |
| api-ms-win-core-largeinteger-l1-1-0.dll | MulDiv |
| api-ms-win-core-delayload-l1-1-1.dll | ResolveDelayLoadedAPI |
| api-ms-win-core-delayload-l1-1-0.dll | DelayLoadFailureHook |
| api-ms-win-crt-math-l1-1-0.dll | ceilf |
| Description | Data |
|---|---|
| LegalCopyright | Microsoft Corporation. All rights reserved. |
| InternalName | ConHost |
| FileVersion | 10.0.19041.1566 (WinBuild.160101.0800) |
| CompanyName | Microsoft Corporation |
| ProductName | Microsoft Windows Operating System |
| ProductVersion | 10.0.19041.1566 |
| FileDescription | Console Window Host |
| OriginalFilename | CONHOST.EXE |
| Translation | 0x0409 0x04b0 |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | United States |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node⊘No network behavior found
Click to jump to process
Click to jump to process
Click to jump to process
| Target ID: | 0 |
| Start time: | 02:28:44 |
| Start date: | 30/03/2022 |
| Path: | C:\Users\user\Desktop\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff6a8cd0000 |
| File size: | 862208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Target ID: | 3 |
| Start time: | 02:28:47 |
| Start date: | 30/03/2022 |
| Path: | C:\Users\user\Desktop\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff6a8cd0000 |
| File size: | 862208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Target ID: | 5 |
| Start time: | 02:28:49 |
| Start date: | 30/03/2022 |
| Path: | C:\Users\user\Desktop\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff6a8cd0000 |
| File size: | 862208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
Function 00007FF6A8D494E4 Relevance: 60.0, APIs: 28, Strings: 6, Instructions: 483COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CD8B00 Relevance: 54.2, APIs: 23, Strings: 7, Instructions: 1664COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CDA190 Relevance: 35.5, APIs: 13, Strings: 7, Instructions: 466COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CD9B70 Relevance: 30.3, APIs: 10, Strings: 7, Instructions: 560COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CDAC10 Relevance: 28.6, APIs: 6, Strings: 10, Instructions: 635COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CD7300 Relevance: 26.9, APIs: 9, Strings: 6, Instructions: 696COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CD82B0 Relevance: 21.7, APIs: 10, Strings: 2, Instructions: 719COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D2DDF0 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 346COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D53FF8 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 195libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CE8930 Relevance: 19.6, APIs: 9, Strings: 2, Instructions: 312COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CE7ED0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D563D8 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 133windownativeCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CE76D8 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 268COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D23290 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 243COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D69B90 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 190memorysleepCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CD5600 Relevance: 9.5, APIs: 3, Strings: 2, Instructions: 785COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D2D3A8 Relevance: 9.4, APIs: 2, Strings: 4, Instructions: 444COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CDB140 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 306COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D53764 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 213COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CEAF14 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CEC30C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23filenativeCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D417F0 Relevance: .7, Instructions: 656COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D09FBC Relevance: .3, Instructions: 315COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D6A000 Relevance: .2, Instructions: 244COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D4ED00 Relevance: .2, Instructions: 169COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D23C14 Relevance: .1, Instructions: 140COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CEF638 Relevance: .0, Instructions: 2COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CD335C Relevance: 31.6, APIs: 4, Strings: 14, Instructions: 99registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CEEE2C Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 141libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D06BA0 Relevance: 26.4, APIs: 2, Strings: 13, Instructions: 153windowthreadCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D5AEEC Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 145COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CDBF70 Relevance: 21.4, APIs: 5, Strings: 7, Instructions: 368COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CE4ED0 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 110registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CE1C60 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 123COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D256F8 Relevance: 17.9, APIs: 4, Strings: 6, Instructions: 421COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CE9630 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 312COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D46F38 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 105COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D66F94 Relevance: 16.2, APIs: 7, Strings: 2, Instructions: 459COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CD51B0 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 368COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D5453C Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 251memoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CE4BE0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 144memoryregistryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CE0910 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 105COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D06F40 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 96synchronizationCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CD3480 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 79COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CDC740 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 309COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CD7C10 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 254COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CE4FE8 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 169registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CD6D30 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 162COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D0C7AC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 108COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D12F38 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 106COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D56CD4 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 102filethreadCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CE1EA4 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 100COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CE1720 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 243COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CDE118 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 231COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CE027C Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 198COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CE9250 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 189COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CDA6C0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 161COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CDEBD8 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 130COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D0AACC Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CE4650 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 117threadCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CE1400 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 105COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D69844 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 85registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D67764 Relevance: 12.3, APIs: 7, Strings: 1, Instructions: 274COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CD7FF0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 209COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CD6F90 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 206COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D65034 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 195COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D48ED4 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 163COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CE10B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132timeCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CE044C Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 108COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CE1DE8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 102COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D33A10 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 75libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CEA810 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50synchronizationsleepCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D31EC4 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 48COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D5627C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D4A8B0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 382COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D637F8 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 329COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D2261C Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 273COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D20634 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 266COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D2E920 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 198COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CE62E8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 181COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CE4A40 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 147COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D3A038 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 119COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CE6B04 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 102synchronizationCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CD3924 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 89threadCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CD6EC0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 88COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D4DBF0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CE3F58 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 82COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D07C20 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CE44B8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 48registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CE7AB8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35libraryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D4D2E4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 34libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CD5024 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 189COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CE9A10 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 128COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CE92B0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 116COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D2F528 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 112COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CE7BE4 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 72COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D1F0C8 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 294COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D250B8 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 246COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D11A40 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 240COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D15410 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 233COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D10F60 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 195COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CE713C Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 192COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CE47C8 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 169COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D49D74 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 136COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D5BB2C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 105COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D3A1CC Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 99COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CE9D6C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CF2B84 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 85synchronizationCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D4DD8C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D5F538 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D450E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CF6010 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D5ED3C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D0806C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D64A24 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D64B3C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D64C4C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D6490C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CE5934 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CE4314 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CD4790 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CDA660 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CE9E80 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 153COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CD6090 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 127COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CDD6A0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 106COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CD62A0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 104COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D2F7E4 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 72COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D4BD50 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 477COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D67DA0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 394COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CE0AC4 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 342COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D109A0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 303COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D4B820 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 281COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D485B0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 269COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D4AE40 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 234COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D4B1B0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 219COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D2E480 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 213COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D1B32C Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 212COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CD6670 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 186COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CD7E00 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 181COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CDA9F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 167COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CDEC4C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D2686C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D34550 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CE5508 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D58294 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 127COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CE6FF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 114COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D566C8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112fileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D23690 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D1A940 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D2ED80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 93COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CE79E8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 89libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CD6C60 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 83COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D27C20 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 72COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CDE9D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CEAB34 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 65COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CD36F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61threadCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D23878 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D3E634 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CEC84C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D303F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CDBC10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CD449C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D39A20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D178D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50fileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D1365C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D2CED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D3A788 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D657C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CD385C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D2CF98 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D07650 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D39EDC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CE1BB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CF6204 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D64F9C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CEA900 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D1DB10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D1DA40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CD360C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D2CE2C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D51BF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CE7B4C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CD4540 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CED350 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8CECB40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27timeCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D2CCDC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24libraryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 00007FF6A8D3A58C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |