Windows
Analysis Report
winrar-x64-701(1).exe
Overview
General Information
Detection
Score: | 24 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 40% |
Compliance
Score: | 48 |
Range: | 0 - 100 |
Signatures
Classification
- System is w7x64
- winrar-x64-701(1).exe (PID: 3368 cmdline:
"C:\Users\ user\Deskt op\winrar- x64-701(1) .exe" MD5: 46C17C999744470B689331F41EAB7DF1) - Uninstall.exe (PID: 3688 cmdline:
"C:\Users\ user\unins tall.exe" /setup MD5: 4783F1A5F0BBA7A6A40CB74BC8C41217)
- cleanup
Source: | Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): |
Click to jump to signature section
Source: | EXE: | Jump to behavior | ||
Source: | EXE: | Jump to behavior | ||
Source: | EXE: | Jump to behavior | ||
Source: | EXE: | Jump to behavior | ||
Source: | EXE: | Jump to behavior |
Compliance |
---|
Source: | EXE: | Jump to behavior | ||
Source: | EXE: | Jump to behavior | ||
Source: | EXE: | Jump to behavior | ||
Source: | EXE: | Jump to behavior | ||
Source: | EXE: | Jump to behavior |
Source: | File created: | Jump to behavior | ||
Source: | File created: | Jump to behavior |
Source: | Static PE information: |
Source: | Static PE information: |
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: |
Source: | Code function: | 0_2_000000013F791F08 | |
Source: | Code function: | 0_2_000000013F7B9B40 | |
Source: | Code function: | 0_2_000000013F7A34D0 | |
Source: | Code function: | 4_2_000000013FA49B10 | |
Source: | Code function: | 4_2_000000013FA66DC0 |
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: |
Source: | Window created: | Jump to behavior |
Spam, unwanted Advertisements and Ransom Demands |
---|
Source: | File dropped: | Jump to dropped file |
Source: | Code function: | 0_2_000000013F7A0A20 |
Source: | Code function: | 0_2_000000013F78C4E0 |
Source: | Code function: | 0_2_000000013F78DE98 | |
Source: | Code function: | 0_2_000000013F795B4C | |
Source: | Code function: | 0_2_000000013F7A5ABC | |
Source: | Code function: | 0_2_000000013F796960 | |
Source: | Code function: | 0_2_000000013F7A4930 | |
Source: | Code function: | 0_2_000000013F785330 | |
Source: | Code function: | 0_2_000000013F79D3C0 | |
Source: | Code function: | 0_2_000000013F7A41D0 | |
Source: | Code function: | 0_2_000000013F79EEF0 | |
Source: | Code function: | 0_2_000000013F797FC8 | |
Source: | Code function: | 0_2_000000013F7BCFAC | |
Source: | Code function: | 0_2_000000013F7B7D40 | |
Source: | Code function: | 0_2_000000013F7A1CE8 | |
Source: | Code function: | 0_2_000000013F7B1D94 | |
Source: | Code function: | 0_2_000000013F7B9B40 | |
Source: | Code function: | 0_2_000000013F7BCB10 | |
Source: | Code function: | 0_2_000000013F788BE0 | |
Source: | Code function: | 0_2_000000013F7B1B90 | |
Source: | Code function: | 0_2_000000013F79F9B0 | |
Source: | Code function: | 0_2_000000013F7B1984 | |
Source: | Code function: | 0_2_000000013F798978 | |
Source: | Code function: | 0_2_000000013F7B2840 | |
Source: | Code function: | 0_2_000000013F7B78AC | |
Source: | Code function: | 0_2_000000013F787754 | |
Source: | Code function: | 0_2_000000013F7B1780 | |
Source: | Code function: | 0_2_000000013F784778 | |
Source: | Code function: | 0_2_000000013F7C1518 | |
Source: | Code function: | 0_2_000000013F7B35D4 | |
Source: | Code function: | 0_2_000000013F7B65C0 | |
Source: | Code function: | 0_2_000000013F7B1574 | |
Source: | Code function: | 0_2_000000013F7994DC | |
Source: | Code function: | 0_2_000000013F7B83C0 | |
Source: | Code function: | 0_2_000000013F7B1370 | |
Source: | Code function: | 0_2_000000013F78A1EC | |
Source: | Code function: | 0_2_000000013F7B31D0 | |
Source: | Code function: | 0_2_000000013F79F04C | |
Source: | Code function: | 4_2_000000013FA6CC50 | |
Source: | Code function: | 4_2_000000013FA4BA0C | |
Source: | Code function: | 4_2_000000013FA48F98 | |
Source: | Code function: | 4_2_000000013FA5C780 | |
Source: | Code function: | 4_2_000000013FA52FD8 | |
Source: | Code function: | 4_2_000000013FA4C7E0 | |
Source: | Code function: | 4_2_000000013FA5DFC0 | |
Source: | Code function: | 4_2_000000013FA6C704 | |
Source: | Code function: | 4_2_000000013FA5BF60 | |
Source: | Code function: | 4_2_000000013FA62D9C | |
Source: | Code function: | 4_2_000000013FA5C57C | |
Source: | Code function: | 4_2_000000013FA6F5C8 | |
Source: | Code function: | 4_2_000000013FA66DC0 | |
Source: | Code function: | 4_2_000000013FA5BD5C | |
Source: | Code function: | 4_2_000000013FA69D30 | |
Source: | Code function: | 4_2_000000013FA5C370 | |
Source: | Code function: | 4_2_000000013FA5DBBC | |
Source: | Code function: | 4_2_000000013FA63230 | |
Source: | Code function: | 4_2_000000013FA5D22C | |
Source: | Code function: | 4_2_000000013FA5C16C | |
Source: | Code function: | 4_2_000000013FA6A1CC | |
Source: | Code function: | 4_2_000000013FA61928 | |
Source: | Code function: | 4_2_000000013FA638B0 |
Source: | Dropped File: | ||
Source: | Dropped File: |
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: |
Source: | Key opened: | Jump to behavior |
Source: | Classification label: |
Source: | Code function: | 0_2_000000013F78BA38 |
Source: | Code function: | 4_2_000000013FA4853C |
Source: | Code function: | 0_2_000000013F7A02DC |
Source: | Code function: | 0_2_000000013F7A1FEC |
Source: | File created: | Jump to behavior |
Source: | Static PE information: |
Source: | File read: | Jump to behavior |
Source: | Key opened: | Jump to behavior |
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: |
Source: | File read: | Jump to behavior |
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | Jump to behavior |
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior |
Source: | Key value queried: | Jump to behavior |
Source: | LNK file: | ||
Source: | LNK file: | ||
Source: | LNK file: | ||
Source: | LNK file: | ||
Source: | LNK file: | ||
Source: | LNK file: | ||
Source: | LNK file: | ||
Source: | LNK file: |
Source: | Automated click: | ||
Source: | Automated click: | ||
Source: | Automated click: |
Source: | Window detected: |
Source: | Window detected: |
Source: | Static PE information: |
Source: | Static PE information: |
Source: | Static file information: |
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: |
Source: | Static PE information: |
Source: | Static PE information: |
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: |
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: |
Source: | File created: | Jump to behavior |
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: |
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file |
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file |
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file |
Source: | File created: | Jump to behavior | ||
Source: | File created: | Jump to behavior |
Boot Survival |
---|
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file |
Source: | File created: | Jump to behavior | ||
Source: | File created: | Jump to behavior | ||
Source: | File created: | Jump to behavior | ||
Source: | File created: | Jump to behavior | ||
Source: | File created: | Jump to behavior | ||
Source: | File created: | Jump to behavior | ||
Source: | File created: | Jump to behavior | ||
Source: | File created: | Jump to behavior | ||
Source: | File created: | Jump to behavior | ||
Source: | File created: | Jump to behavior |
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior |
Source: | Memory allocated: | Jump to behavior | ||
Source: | Memory allocated: | Jump to behavior |
Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
Source: | Dropped PE file which has not been started: | Jump to dropped file |
Source: | Thread sleep time: | Jump to behavior |
Source: | Code function: | 0_2_000000013F791F08 | |
Source: | Code function: | 0_2_000000013F7B9B40 | |
Source: | Code function: | 0_2_000000013F7A34D0 | |
Source: | Code function: | 4_2_000000013FA49B10 | |
Source: | Code function: | 4_2_000000013FA66DC0 |
Source: | Code function: | 0_2_000000013F7A88A0 |
Source: | Binary or memory string: |
Source: | Code function: | 0_2_000000013F7AFEC8 |
Source: | Code function: | 0_2_000000013F7BB630 |
Source: | Code function: | 0_2_000000013F7A9D00 | |
Source: | Code function: | 0_2_000000013F7AFEC8 | |
Source: | Code function: | 0_2_000000013F7A9458 | |
Source: | Code function: | 0_2_000000013F7AA354 | |
Source: | Code function: | 0_2_000000013F7AA170 | |
Source: | Code function: | 4_2_000000013FA54E10 | |
Source: | Code function: | 4_2_000000013FA5AE38 | |
Source: | Code function: | 4_2_000000013FA55488 | |
Source: | Code function: | 4_2_000000013FA55298 | |
Source: | Code function: | 4_2_000000013FA547F8 |
Source: | Code function: | 0_2_000000013F7A4930 |
Source: | Process created: | Jump to behavior |
Source: | Binary or memory string: |
Source: | Code function: | 0_2_000000013F79AEE4 |
Source: | Code function: | 0_2_000000013F7A2954 |
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior |
Source: | Code function: | 0_2_000000013F7A41D0 |
Source: | Code function: | 0_2_000000013F792D64 |
Source: | Key value queried: | Jump to behavior |
Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 2 Command and Scripting Interpreter | 1 Registry Run Keys / Startup Folder | 1 Exploitation for Privilege Escalation | 121 Masquerading | OS Credential Dumping | 1 System Time Discovery | Remote Services | 1 Email Collection | 1 Encrypted Channel | Exfiltration Over Other Network Medium | 1 Data Encrypted for Impact |
Credentials | Domains | Default Accounts | Scheduled Task/Job | 1 DLL Side-Loading | 12 Process Injection | 2 Virtualization/Sandbox Evasion | LSASS Memory | 21 Security Software Discovery | Remote Desktop Protocol | 1 Archive Collected Data | Junk Data | Exfiltration Over Bluetooth | Network Denial of Service |
Email Addresses | DNS Server | Domain Accounts | At | 1 DLL Search Order Hijacking | 1 Registry Run Keys / Startup Folder | 12 Process Injection | Security Account Manager | 2 Virtualization/Sandbox Evasion | SMB/Windows Admin Shares | 1 Clipboard Data | Steganography | Automated Exfiltration | Data Encrypted for Impact |
Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | 1 DLL Side-Loading | 1 Deobfuscate/Decode Files or Information | NTDS | 1 Process Discovery | Distributed Component Object Model | Input Capture | Protocol Impersonation | Traffic Duplication | Data Destruction |
Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | 1 DLL Search Order Hijacking | 1 Obfuscated Files or Information | LSA Secrets | 2 File and Directory Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 1 Software Packing | Cached Domain Credentials | 36 System Information Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 1 DLL Side-Loading | DCSync | Remote System Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
Network Trust Dependencies | Serverless | Drive-by Compromise | Container Orchestration Job | Scheduled Task/Job | Scheduled Task/Job | 1 DLL Search Order Hijacking | Proc Filesystem | System Owner/User Discovery | Cloud Services | Credential API Hooking | Application Layer Protocol | Exfiltration Over Alternative Protocol | Defacement |
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
0% | Virustotal | Browse | ||
0% | ReversingLabs |
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
0% | ReversingLabs | |||
0% | Virustotal | Browse | ||
0% | ReversingLabs | |||
1% | Virustotal | Browse | ||
0% | ReversingLabs | |||
0% | Virustotal | Browse | ||
0% | ReversingLabs | |||
0% | Virustotal | Browse | ||
0% | ReversingLabs | |||
0% | Virustotal | Browse | ||
0% | ReversingLabs | |||
0% | Virustotal | Browse | ||
0% | ReversingLabs | |||
0% | Virustotal | Browse | ||
0% | ReversingLabs | |||
0% | Virustotal | Browse | ||
3% | ReversingLabs | |||
3% | Virustotal | Browse | ||
0% | ReversingLabs | |||
0% | Virustotal | Browse | ||
0% | ReversingLabs | |||
0% | Virustotal | Browse | ||
0% | ReversingLabs | |||
0% | Virustotal | Browse | ||
0% | ReversingLabs | |||
1% | Virustotal | Browse | ||
0% | ReversingLabs | |||
0% | Virustotal | Browse |
Name | Source | Malicious | Antivirus Detection | Reputation |
---|---|---|---|---|
false |
| unknown | ||
false | unknown | |||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown |
Joe Sandbox version: | 41.0.0 Charoite |
Analysis ID: | 1530646 |
Start date and time: | 2024-10-10 10:17:38 +02:00 |
Joe Sandbox product: | CloudBasic |
Overall analysis duration: | 0h 5m 51s |
Hypervisor based Inspection enabled: | false |
Report type: | full |
Cookbook file name: | default.jbs |
Analysis system description: | Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2) |
Number of analysed new started processes analysed: | 6 |
Number of new started drivers analysed: | 0 |
Number of existing processes analysed: | 0 |
Number of existing drivers analysed: | 0 |
Number of injected processes analysed: | 0 |
Technologies: |
|
Analysis Mode: | default |
Analysis stop reason: | Timeout |
Sample name: | winrar-x64-701(1).exe |
Detection: | SUS |
Classification: | sus24.rans.winEXE@3/38@0/0 |
EGA Information: |
|
HCA Information: |
|
Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): dllhost.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 2.21.22.114, 2.21.22.106, 93.184.221.240
- Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu-b-net.trafficmanager.net, wu.azureedge.net, download.windowsupdate.com.edgesuite.net
- Report size getting too big, too many NtOpenKeyEx calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
Time | Type | Description |
---|---|---|
04:18:29 | API Interceptor | |
04:18:44 | API Interceptor |
Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
---|---|---|---|---|---|---|
C:\Users\user\7zxa.dll | Get hash | malicious | CobaltStrike | Browse | ||
Get hash | malicious | CobaltStrike | Browse | |||
Get hash | malicious | Unknown | Browse | |||
Get hash | malicious | Unknown | Browse | |||
Get hash | malicious | Unknown | Browse | |||
Get hash | malicious | AgentTesla | Browse | |||
C:\Users\user\Default.SFX | Get hash | malicious | CobaltStrike | Browse | ||
Get hash | malicious | CobaltStrike | Browse | |||
Get hash | malicious | Unknown | Browse | |||
Get hash | malicious | Unknown | Browse | |||
Get hash | malicious | Unknown | Browse | |||
Get hash | malicious | AgentTesla | Browse |
Process: | C:\Users\user\Uninstall.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 832 |
Entropy (8bit): | 4.7875179191521875 |
Encrypted: | false |
SSDEEP: | 12:8ZZ2v4RCrOvSpiseNMlWlEaXolZFp6NwuG3YilMMEpxRljKZTdc7y/Tdc7X:8jLRExIseNkWCqolAw3q0yW7yr |
MD5: | 23290A796D6B01E8596D5EBA1FEBA453 |
SHA1: | 599D519ED8C757AF58D0D86033032E7EC17F4E1A |
SHA-256: | 6ED10475A1DC040602E50A384F69494C23DD45498E52A7B70FF5B225151B89A0 |
SHA-512: | 6EC511EF4429BA9112FF93AE5A302EC00836E126A0852FF7450CC4CBFF6826FA2EB3EB18EA0C59FE331B59D3C411A027896B6438A31DC63564592EF7BCE9DEBC |
Malicious: | false |
Reputation: | low |
Preview: |
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\What is new in the latest version.lnk
Download File
Process: | C:\Users\user\Uninstall.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 863 |
Entropy (8bit): | 4.790126072770396 |
Encrypted: | false |
SSDEEP: | 12:8GSf4BgaRaCMZzIislYMlWlEaszElZFp6NwuG3YilMMEpxRljKZTddy/TddX:8mBhaZz7slYkWCXzElAw3q0q7P |
MD5: | 2E6B9A14988C1987299CB72453E53290 |
SHA1: | DFD1316E253DE0B08AACFF3039B2E6773FD13EF7 |
SHA-256: | 98981B824606A9993140460F03208F2F4EA6B015D47578C95DD5A19E6263B46D |
SHA-512: | EB108BAAB05F1A71ACF79FB68ECF8FD2FEF96F8B1BF070703BD6533E5D5B4532640DF75A37BE66529CA2E7D2F492BED9F55F9E053429AD9EF526BCBABA8A0718 |
Malicious: | false |
Reputation: | low |
Preview: |
Process: | C:\Users\user\Uninstall.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 851 |
Entropy (8bit): | 4.816525321852148 |
Encrypted: | false |
SSDEEP: | 12:8R19p4mJHLLC75PszWis4MlWlEaUcsz3SFp6NwuG3YilMMEpxRljKZTd0Cy/Td0i:8R1oeH3w4ls4kWCy4Jw3q0at7ai |
MD5: | ED0A7FAE3C8BAD80FA5A2372CEFE6A37 |
SHA1: | D64965072069F756EB4BD3C27758579671D7A258 |
SHA-256: | F76FB4A2FC1632BC423C1CB58FDE78973A9E71F2A564666A1D5AD22833395C26 |
SHA-512: | 7A6435677447D44A30BF32FF020D7123F1C7DF48704AA886CCAFB28CAAE542A9551E1BD5D0534BFEDD44C0F57EB6B9A7FFD7C342CD897E7C498E74D83B2277D5 |
Malicious: | false |
Reputation: | low |
Preview: |
Process: | C:\Users\user\Uninstall.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 851 |
Entropy (8bit): | 4.7921618322653865 |
Encrypted: | false |
SSDEEP: | 12:8mRp4m7CwoFszAvisWMlWlEaUcszAUmTFp6NwuG3YilMMEpxRljKZTdIy/TdIX:8mkuy4bsWkWCy4fw3q057u |
MD5: | EF850AC9735C9770F0CD99714FE3E04E |
SHA1: | AFDB93F049961B9E0991EAC65214BD27F8C9A188 |
SHA-256: | 43047A93F9386C76A7C2C755538C11E2C85E81D3E8AB62417995EF9F33210C25 |
SHA-512: | 0EC29F76B4CAFFC49A0867C145BF65CD2ED2ED5D7F2EC0522480F736B855165AA084C52B1EFFC9329B74233F8777B82680AC296D69D456FFCB7BA5B0CF079B56 |
Malicious: | false |
Reputation: | low |
Preview: |
Process: | C:\Users\user\Desktop\winrar-x64-701(1).exe |
File Type: | |
Category: | dropped |
Size (bytes): | 226456 |
Entropy (8bit): | 6.366028824236922 |
Encrypted: | false |
SSDEEP: | 3072:+ftOtcS7lCZc9Ltue1C+zV2zUmiRvgWDFSaRPQIDCuPK1gSBvAGfPFjaRv+PB7PT:etViwgLtun+soC1vx2Hr0/NG1E |
MD5: | 04D3E794624A82228A7E683FDF22E182 |
SHA1: | 114B74E926913BB0A588E671025F9EB38E8B854B |
SHA-256: | DB3D0484228ED14AD8D3763F4880D36024FB27B189C91720FF147B92D46BCB5A |
SHA-512: | B5767971F9075B5E483F9E77DCB50637EB81D70DA86D655A230DA6AD3DC5337D2A08038261F32E3867FDE68FD33BF23A75B50E0381762BECB46E859404E78D82 |
Malicious: | true |
Antivirus: |
|
Joe Sandbox View: |
|
Reputation: | low |
Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\Console RAR manual.lnk
Download File
Process: | C:\Users\user\Uninstall.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 814 |
Entropy (8bit): | 4.795556189671133 |
Encrypted: | false |
SSDEEP: | 12:8ZZ2v4RCrOvSpiseNMlWlEa4iolZFp6NwuG3YilMMEpxRljKZTdc7y/Tdc7X:8jLRExIseNkWChiolAw3q0yW7yr |
MD5: | 383AF18C044E861871C050791F1C43A2 |
SHA1: | E2A169B2230C238CB5F421E7FC7D40F9621FB0AE |
SHA-256: | AA889C2AE6CB4F6FD44955686D2B07FF30068FC6234D47966FD6B693B42BD9A4 |
SHA-512: | 02FBE6F47CE09580A80485B96C25CEADEF58639ABDD4C2AF0E97FB5DCDFCFAF58CBB92E684125810EED3FC17045061B9D8A7CDDE66B22D241B97F407EAA4D066 |
Malicious: | false |
Reputation: | low |
Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\What is new in the latest version.lnk
Download File
Process: | C:\Users\user\Uninstall.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 845 |
Entropy (8bit): | 4.806329182189861 |
Encrypted: | false |
SSDEEP: | 12:8GSf4BgaRaCMZzIislYMlWlEaOpzElZFp6NwuG3YilMMEpxRljKZTddy/TddX:8mBhaZz7slYkWCzzElAw3q0q7P |
MD5: | 3D0FB82CB0516162B465A2B3FA818F87 |
SHA1: | C7C8293D5D70A1A02DF91728864A5CE93624AEF1 |
SHA-256: | 812AFD1FC5E9627663AC7B2ABA8DE2D81F485E32372FDF14215E5C71E438865E |
SHA-512: | 4D6808259AFAFAB3CE8176647004114C6B5383C5EE7D1AA4F0D57286649B2DBD55D26EA8B392EDA6E618D452CE942D80D8D7DE1F55080E10560C4F80873394CA |
Malicious: | false |
Reputation: | low |
Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR help.lnk
Download File
Process: | C:\Users\user\Uninstall.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 833 |
Entropy (8bit): | 4.829783343698719 |
Encrypted: | false |
SSDEEP: | 12:8R19p4mJHLLC75PszWis4MlWlEarcWxsz3SFp6NwuG3YilMMEpxRljKZTd0Cy/TN:8R1oeH3w4ls4kWCyx4Jw3q0at7ai |
MD5: | FEF5D29980CF84DB0FBA74871B533BB7 |
SHA1: | FE984FBB0DB29FE932861AF56AE9261FC67B12E6 |
SHA-256: | 410F13D53393AD75499E6398E25B697C61D7DD32892562BC2057D6B0B803EF82 |
SHA-512: | 4025FB0A477DB8CCF7CBB405C1B55654AB69C07CC4C00761111BACF8F1DDD13E2DBA16F6D77EE8DDCE7DF86DAD06D40837F88149CE52E4403AC981BD04AB5859 |
Malicious: | false |
Preview: |
Process: | C:\Users\user\Uninstall.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 833 |
Entropy (8bit): | 4.806228346687001 |
Encrypted: | false |
SSDEEP: | 12:8mRp4m7CwoFszAvisWMlWlEarcWxszAUmTFp6NwuG3YilMMEpxRljKZTdIy/TdIX:8mkuy4bsWkWCyx4fw3q057u |
MD5: | 3CA6780E7BF7ECC5ED8583BB4FFDBA77 |
SHA1: | 4716B016A2C55D1293CBA022497B4EE78D7D78EA |
SHA-256: | 2872125D3B46562B89D81063E6ED5AC848E33A6AAB1DED3EC06DED270F09E077 |
SHA-512: | 0ED070A74F74FDC2787F13F1873A4FA1E46D845BF1564368C0F84C78510CFACB1DB9F3B7DF5A6609361C7F0FD29BBFC8F6C3E9098B9B40244B8D7754B3BD6BE2 |
Malicious: | false |
Preview: |
Process: | C:\Users\user\Desktop\winrar-x64-701(1).exe |
File Type: | |
Category: | dropped |
Size (bytes): | 448000 |
Entropy (8bit): | 6.477949014491552 |
Encrypted: | false |
SSDEEP: | 12288:xyveQB/fTHIGaPkKEYzURNAwbAgB2X+t4:xuDXTIGaPhEYzUzA0/0 |
MD5: | AB1C239D68D65D84EE139DD0C8CE8A52 |
SHA1: | 1A638556DE77369151839BF7A570D972410360E3 |
SHA-256: | B83A105DDA4806F7AC5E9F3B6546829B37D42D85911D1C4487B1E95BFEA91E9D |
SHA-512: | EA2306628F2079BDF5420C12AF3D097C78FB3D3CD90AE2283C6F591E0751325F3AF675BB257B812BABB4D03F7493E2819B97FCA969DC9B5031EC07BB8517ECFB |
Malicious: | true |
Antivirus: |
|
Joe Sandbox View: |
|
Preview: |
Process: | C:\Users\user\Desktop\winrar-x64-701(1).exe |
File Type: | |
Category: | dropped |
Size (bytes): | 366592 |
Entropy (8bit): | 6.676160748927781 |
Encrypted: | false |
SSDEEP: | 6144:pVJQ3KJxNVhbU3y83OI1SFc+gcYjhLPNVOIopJrX+t4rR8o:7Jf/DdUC83OIgFc+tYjhLFH8rX+t498o |
MD5: | C5BCFD921F209366B9CFED632B174A3B |
SHA1: | 332E2AEB7BC2D4491CBE4B994DBB8FF8E55FFF9F |
SHA-256: | 476E3F779D2638238EA185DF6019E4FCB54B3704AD12DBD051399FCF26E6E1BF |
SHA-512: | 72C0D13FA20A7648074601D5726F02C46EA7E62761F80366C2EBDCE40D95568543E11D42907D789864D178D5DA73992FC50400A50FC777B1BC02A02F9276FC55 |
Malicious: | true |
Antivirus: |
|
Preview: |
Process: | C:\Users\user\Desktop\winrar-x64-701(1).exe |
File Type: | |
Category: | dropped |
Size (bytes): | 1984 |
Entropy (8bit): | 4.660424973452362 |
Encrypted: | false |
SSDEEP: | 48:1dilPla18jQ1TfzG7D6nmoLP0UTdfwGQ68Z:1VfwoLMUTO9 |
MD5: | 84846ABC52DC17020E4E934D3C94B4E6 |
SHA1: | 94562A3E13B3EDCCF1848EC0743CAF0E32ED5E3E |
SHA-256: | 3449FD40D054C96285FAB92011E732174C7CD000EDA67470376F26F0D431F1F2 |
SHA-512: | 9B8CF7844D346B806E2FF6FE9D165D82FC7B4F764846C0F9B30443672E585F588399CF915DF728743E420FC8E58008F0373F7570C8483A2E408567AA1026900E |
Malicious: | false |
Preview: |
Process: | C:\Users\user\Desktop\winrar-x64-701(1).exe |
File Type: | |
Category: | dropped |
Size (bytes): | 6880 |
Entropy (8bit): | 4.374157879775667 |
Encrypted: | false |
SSDEEP: | 96:1ikG8jtbvVq93CLbKTy2tqxULp6C2t1fAOzm44owhAV4aOY5X3Uq2teNAZjweJ:k4DVqQKuABQvpDBEFtey6A |
MD5: | 672064CF19DB0B083B981CF0BE7662B0 |
SHA1: | C200C77558CA77C044A2C2D794C98F8437FFD2B4 |
SHA-256: | 9FC8AA33CCAFA04C1CE4C0A61047B341297D720ADAB1B77F67B5FE59F43BB59F |
SHA-512: | A016B287B6D1A4320BD5AB5790163F837A28B54D8BCCA56A51DC8B6A50374AACB35C0341D42915CD97D3B135DBF1F363087A4631DEB69F82811D41DB2F78A0A8 |
Malicious: | false |
Preview: |
Process: | C:\Users\user\Desktop\winrar-x64-701(1).exe |
File Type: | |
Category: | dropped |
Size (bytes): | 3416 |
Entropy (8bit): | 5.03176338065389 |
Encrypted: | false |
SSDEEP: | 48:Mq9YxlbkLgrjd0M8LTyMMNnkVZcJE5NRQ3aTN1x2LJJ/krkhA/lSDFOeGfVKrlx:MTsgSJZcJETRkaqr1UlS5zGfVclx |
MD5: | 5C336DE3B3D794322AD9E5915E3A509F |
SHA1: | 5256262A417E9A29FE23E8CCA09782C7A3532FC9 |
SHA-256: | BCE29EF3B95306CB7B304FB8C3039BE7157356D9F9D4E7E1C6BFBF02A117F48F |
SHA-512: | 7243C9B8EB39FC8AA10EC8B5C290E27D44FA1C245F0478B75AE77964C178D41E9C1F651F987316F1153C1A7176EECEBC269FFB0C42CED5BD0B12E5CC1B95DA04 |
Malicious: | false |
Preview: |
Process: | C:\Users\user\Desktop\winrar-x64-701(1).exe |
File Type: | |
Category: | dropped |
Size (bytes): | 762520 |
Entropy (8bit): | 6.480895043803242 |
Encrypted: | false |
SSDEEP: | 12288:F09QJ3MbqLyQx5ooXTAl080ejQsg6Udqmoy6jEIq+EpNUstSpx:G9C3MbqyeOojATzjaPiyQq+EpNlSpx |
MD5: | 16659AE52CE03889AD19DB1F5710C6AA |
SHA1: | 66B814FE3BE64229E2CC19F0A4460E123BA74971 |
SHA-256: | 0B1866B627D8078D296E7D39583C9F856117BE79C1D226B8C9378FE075369118 |
SHA-512: | F9DD360C3A230131C08C4D5F838457F690ED4094EC166ACD9F141B7603F649CFA71A47EA80E9FF41B8296246BDC1C72A75288F9A836C18431E06C2E8E3FC8398 |
Malicious: | true |
Antivirus: |
|
Preview: |
Process: | C:\Users\user\Desktop\winrar-x64-701(1).exe |
File Type: | |
Category: | dropped |
Size (bytes): | 108383 |
Entropy (8bit): | 4.26316643545334 |
Encrypted: | false |
SSDEEP: | 768:FoxKukh1SIfjcjKVbRZHqT9E1qYiHSzoOKyGi018e5xCwVxD+wb+WkOPMYC7:FoxKuOKKV9Z699S7Kyi1ZbF7iWBXK |
MD5: | B954981A253F5E1EE25585037A0C5FEE |
SHA1: | 96566E5C591DF1C740519371EE6953AC1DC6A13F |
SHA-256: | 59E40B34B09BE2654B793576035639C459AD6E962F9F9CD000D556FA21B1C7CD |
SHA-512: | 6A7772C6B404CD7FEE50110B894FF0C470E5813264E605852B8DCC06BFAEB62B8CC79ADCB695B3DA149E42D5372A0D730CC7E8ED893C0BD0EDB015FC088B7531 |
Malicious: | true |
Preview: |
Process: | C:\Users\user\Desktop\winrar-x64-701(1).exe |
File Type: | |
Category: | dropped |
Size (bytes): | 651416 |
Entropy (8bit): | 6.694392253598639 |
Encrypted: | false |
SSDEEP: | 12288:CheO83S/X2oc1fZy4CArT0pLGbNUnaC7PeUnBd3X3uK:CheOIS/GzfZpopLGbNUL2UnBd3X39 |
MD5: | 1E86C3BFCC0688BDBE629ED007B184B0 |
SHA1: | 793FADA637D0D462E3511AF3FFAEC26C33248FAC |
SHA-256: | 7B08DAEE81A32F72DBC10C5163B4D10EB48DA8BB7920E9253BE296774029F4EF |
SHA-512: | 4F8AE58BBF55ACB13600217ED0EEF09FA5F124682CEDD2BFC489D83D921F609B66B0294D8450ACB1A85D838ADB0E8394DADF5282817DBA576571E730704F43AC |
Malicious: | true |
Antivirus: |
|
Preview: |
Process: | C:\Users\user\Desktop\winrar-x64-701(1).exe |
File Type: | |
Category: | dropped |
Size (bytes): | 554648 |
Entropy (8bit): | 6.907707531547957 |
Encrypted: | false |
SSDEEP: | 12288:WM7zuNOwsIJur4LnQkAifUsogbesSEpwpDBd3X3uQDc:WSz/ug4LQdh2es8pDBd3X3hc |
MD5: | 24F6FAA5D2E9C8FB15AE0C936BFA4545 |
SHA1: | 17F85D25F0F0C15A164EB11A34F498268677DCB0 |
SHA-256: | BD3F01E7C100422A6FAAE60D76DA16158F6D8B3868D474E81FD657EC3C0127EF |
SHA-512: | CD3F4DD020CAD0357BE2CC18459E7051D65F05B5DF60A8D980152179DFF6CC8DEDF9FEF758224E9B6ADC87DE9033D18DAA3E09AEA8AF2E2A1860EFC753A01380 |
Malicious: | true |
Antivirus: |
|
Preview: |
Process: | C:\Users\user\Desktop\winrar-x64-701(1).exe |
File Type: | |
Category: | dropped |
Size (bytes): | 186008 |
Entropy (8bit): | 6.251929166363143 |
Encrypted: | false |
SSDEEP: | 3072:YCXGYJKNlePjzWBEFxwk6m9xy7n/covzScPdpKatjS:YCXpAmzWGSk6mYc4rLDG |
MD5: | F5B54D16610A819BBC6099BDC92ADD2C |
SHA1: | 7C680A87233FF7E75866657E9C1ACF97D69F6579 |
SHA-256: | 46F533007FB231D0B0AF058A0997AB5E6B44A1B02AE327621F04FDC4B2E18964 |
SHA-512: | A120A2EE6C926CD6F6B8D1BE68FF471294552B049BAA637A474D1210FE3CA83E66D0834217D1A5EEA0491D080CEA1795EE328FDD4CB54F6A132BE2DC2E58E4A8 |
Malicious: | true |
Antivirus: |
|
Preview: |
Process: | C:\Users\user\Desktop\winrar-x64-701(1).exe |
File Type: | |
Category: | dropped |
Size (bytes): | 2183 |
Entropy (8bit): | 7.892242389507994 |
Encrypted: | false |
SSDEEP: | 48:XJu59Mz9ZOj4v0y+ptQo0QOKNxO4a9hOAZ0CZLFua1Q1WGl:XJK9MZ8K+pio0Q13OFWAZ0SLFFO1WO |
MD5: | 85EE643E6B0837849E300B11395422C4 |
SHA1: | 4634019350AD8DD59FD6C99B4AABEA99CDF06BDD |
SHA-256: | 8D42F3961E0E381EE32D3E1E144BFBB59294D43A9965E895FC75B8827ACD98E6 |
SHA-512: | C744A6B2D64121A7AA279CD197790512C9B97264E70D7399BE992FC6F53BAE31B7143ED299B1A47E5DB1AD9BB82D982AE0988CDDF5E4E52814C5A3EADD107D95 |
Malicious: | false |
Preview: |
Process: | C:\Users\user\Desktop\winrar-x64-701(1).exe |
File Type: | |
Category: | dropped |
Size (bytes): | 4179 |
Entropy (8bit): | 7.941638225376268 |
Encrypted: | false |
SSDEEP: | 96:HsNP4L15zRkIEBdPWt+zIeofvdWIcq4dkuRQVRv6hKXUvBzpoLb+qSEsYqw/m+wC:MNP015zRk/uczQfsIcq4SuiVx6KXaBzk |
MD5: | EC177CBE676473543E8C9B5D9FB0B797 |
SHA1: | 0D1BB7649D090831D2AB1F2FB44F580E0D4004D3 |
SHA-256: | 5E3C8BBCD81CD0C08819EDCBE04772DBD157F79373A0171B7BD914CF7A2CDEF9 |
SHA-512: | 925A86B5BE1C9FE91CC587B71A3E0D2FBF8EDDEF06093A8356BFFA955B63C296A041729DB38A9538DFC811B723E0ACA4B7A183AB0E9D12D0A302D1239DB12374 |
Malicious: | false |
Preview: |
Process: | C:\Users\user\Desktop\winrar-x64-701(1).exe |
File Type: | |
Category: | dropped |
Size (bytes): | 6234 |
Entropy (8bit): | 7.9623011066892895 |
Encrypted: | false |
SSDEEP: | 192:F7LhuPsvwxZKPeCHV6sZ68EUDfHZkmoWsm:F7SxEDHV6sZd3Nsm |
MD5: | 248FA2B659874A14B43B5E0E17AC1CFF |
SHA1: | B6B0671E015104EE7F4BAC4E6ABF961EC55FDB12 |
SHA-256: | ED99246EBC6FAD80103F1E887DD8388F67EB509FCBBA187AAA13556B8D884AB2 |
SHA-512: | 1A8E9F0C13D565CDAE77CC17942792E33861F056F73422EB2DF79FBA5DC241A37106C0BF7173F9BA83F517E2016E9D3B8E117DF2BD2D5972155781DBF147F90A |
Malicious: | false |
Preview: |
Process: | C:\Users\user\Desktop\winrar-x64-701(1).exe |
File Type: | |
Category: | dropped |
Size (bytes): | 24440 |
Entropy (8bit): | 7.925485516468654 |
Encrypted: | false |
SSDEEP: | 384:DBR015ziBz4oqvhFv+qkDmm0fxPZp7SxEDHV6sZd3NsSkI8mvC4j9tEIkTXBHhjA:PYzMzHshFvbkD9oZ06MsZd3w/abEIABS |
MD5: | 4EBEB72C7DA644A296A0026C061DB51D |
SHA1: | 6F94EA0EAE2664C8341265D62FF7D871DA702A76 |
SHA-256: | DE451E233072B0D34ACECF04DDC38BCAD61B56A1E0218041CA0A80AD752BACCF |
SHA-512: | B4937191D5A61EBC41497938DA51F6C741D3DA6A9213E236CD62F82B106D311DB597C613BC924C18E3BDC654F3F8526F43CF13EDE0F00380AC22382713570153 |
Malicious: | false |
Preview: |
Process: | C:\Users\user\Desktop\winrar-x64-701(1).exe |
File Type: | |
Category: | dropped |
Size (bytes): | 1306 |
Entropy (8bit): | 4.704353931608651 |
Encrypted: | false |
SSDEEP: | 24:XB0Ku+6fYEbsaoprp2Xc9wARVo+iL/5BiiUWeiaQPxvjf:xvSQEEpT2AXG/rPfP5 |
MD5: | E70E22D45ECB35217D66A4CE30F081FA |
SHA1: | A5F6C6E1335596D50E89F99267773E30BEBE159E |
SHA-256: | 9EB1099D7231CD24D8740609D3AC6985139F2334730356DF983AB01D7896AD6F |
SHA-512: | 638AB88BCF95AA16E2F15036F3DE1C5803A30B518B1A283464444A9B2F04B45F7927FB3C4BF666740C8D042C991D872B6D5749BBD9A721A42DDE6DBF9F549CD3 |
Malicious: | false |
Preview: |
Process: | C:\Users\user\Desktop\winrar-x64-701(1).exe |
File Type: | |
Category: | dropped |
Size (bytes): | 1288 |
Entropy (8bit): | 4.706456912766128 |
Encrypted: | false |
SSDEEP: | 24:wT562i+znj04COlBEaT336uSXqzcrfMLosGPjJn9kn7f28hUHT16:wT562i6j04PBnj3PSXKEfKoseTc7f28v |
MD5: | 00D0A57A6D64EE3DE8F4D5529D6C6447 |
SHA1: | 56C7A7FEFB01AA0A032A8E0F91EA9EFF53BEE1F3 |
SHA-256: | FCD13E1B97AF47B8B923BA97AE15E9731C66093609667C3171D5DD24A6F7F2E6 |
SHA-512: | A644967D0CD6EF47324B2E8C52698318C658D1B3B37E5F4DE5E6897AF9CA951B0611CEBA5C6D3E087CA9958286E481BECF9BBFA1C483CB11EBD2F4BE7526F474 |
Malicious: | false |
Preview: |
Process: | C:\Users\user\Desktop\winrar-x64-701(1).exe |
File Type: | |
Category: | dropped |
Size (bytes): | 1640 |
Entropy (8bit): | 3.946312688270784 |
Encrypted: | false |
SSDEEP: | 48:W8LxIIwIIrIITIIk1Wx32oG9hwTrazcOIIshUdIIwMIIwhIIw1yF:WIOI9IcIEI7TGMTWyInKIYIfIvF |
MD5: | 43CB15C1F1CC705305AEBA33B0A9EE73 |
SHA1: | 52B4CBF1C3ED4494837F54EAFA3E7294BA8E5485 |
SHA-256: | A7BB097441D9F06DD7A8D08874D70E7495626760C05284CA1AE3A208C11B52F0 |
SHA-512: | 179DDA1518AEC276AE01BD7966272BBD545072077B34FB07396EC47C5B11ADBDDD00AB385D4EE2131A3C1C5265857434A51BE4F33AC7CCD8C4E4B4DFDA8D9C6F |
Malicious: | false |
Preview: |
Process: | C:\Users\user\Desktop\winrar-x64-701(1).exe |
File Type: | |
Category: | dropped |
Size (bytes): | 506008 |
Entropy (8bit): | 6.4284173495366845 |
Encrypted: | false |
SSDEEP: | 6144:yY8mmN3YWYGAj9JwXScp39ioIKzKVEKfr01//bbh3S62Wt3A3ksFqXqjh6AusDyn:yY8XiWYGAkXh3Qqia/zAot3A6AhezSpK |
MD5: | 98CCD44353F7BC5BAD1BC6BA9AE0CD68 |
SHA1: | 76A4E5BF8D298800C886D29F85EE629E7726052D |
SHA-256: | E51021F6CB20EFBD2169F2A2DA10CE1ABCA58B4F5F30FBF4BAE931E4ECAAC99B |
SHA-512: | D6E8146A1055A59CBA5E2AAF47F6CB184ACDBE28E42EC3DAEBF1961A91CEC5904554D9D433EBF943DD3639C239EF11560FA49F00E1CFF02E11CD8D3506C4125F |
Malicious: | true |
Antivirus: |
|
Preview: |
Process: | C:\Users\user\Desktop\winrar-x64-701(1).exe |
File Type: | |
Category: | dropped |
Size (bytes): | 488600 |
Entropy (8bit): | 7.025557043139148 |
Encrypted: | false |
SSDEEP: | 12288:9Z5zraThq5dDnHEJt1kXm+wBhvBJ/+5IISY1A9h:9Z5n2hsdDnkGXm9Bhvn/+r1+h |
MD5: | 4783F1A5F0BBA7A6A40CB74BC8C41217 |
SHA1: | A22B9DC8074296841A5A78EA41F0E2270F7B7AD7 |
SHA-256: | F376AAA0D4444D0727DB5598E8377F9F1606400ADBBB4772D39D1E4937D5F28C |
SHA-512: | 463DFF17F06ECA41AE76E3C0B2EFC4EF36529AA2EAED5163EEC0A912FE7802C9FB38C37ACFE94B82972861AAF1ACF02823A5948FBB3292BB4743641ACB99841E |
Malicious: | true |
Antivirus: |
|
Preview: |
Process: | C:\Users\user\Desktop\winrar-x64-701(1).exe |
File Type: | |
Category: | dropped |
Size (bytes): | 793 |
Entropy (8bit): | 4.866183859305658 |
Encrypted: | false |
SSDEEP: | 24:vY7Opm2lX+KBJlHchkyiQyaI6qI8I1Xou6qu8u1Xm:gAXNHYkyi3cP1had1W |
MD5: | 6EEEFCB85673C14201D024B6E6AC6258 |
SHA1: | DD3BBAD1B014F8D8E9F981AC0DEB9F2F343C5CF4 |
SHA-256: | B75FDEE208D2834AB147DACB51F4E7D70E44457C8B639048FE67B252B8D61F1F |
SHA-512: | D68322F4B861F05876E9B3F349D135B3DF115A52B93C52590A1DC240089AB0DCDB256F91FCA01FD65DC8E689EE53CBD106337BBDA42D402D12B9DCA90434671B |
Malicious: | false |
Preview: |
Process: | C:\Users\user\Desktop\winrar-x64-701(1).exe |
File Type: | |
Category: | dropped |
Size (bytes): | 46292 |
Entropy (8bit): | 4.525159711057252 |
Encrypted: | false |
SSDEEP: | 384:cZIEmAyhs0z4NNVmF5OgUDBA2XCh9Iq1IAnUc9joBHLKp63xUA5B33vX6TBcxAfL:cZ41kVEbUDbwXic9p63Df3fXxuWJo4c |
MD5: | 1C44C85FDAB8E9C663405CD8E4C3DBBD |
SHA1: | 74D44E9CB2BF6F4C152AADB61B2FFC6B6CCD1C88 |
SHA-256: | 33108DD40B4E07D60E96E1BCFA4AD877EB4906DE2CC55844E40360E5D4DAFB5D |
SHA-512: | 46D3FB4F2D084D51B6FD01845823100ABC81913EBD1B0BCFEB52EF18E8222199D282AA45CAE452F0716E0E2BF5520F7A6A254363D22B65F7AB6C10F11292EE2D |
Malicious: | false |
Preview: |
Process: | C:\Users\user\Desktop\winrar-x64-701(1).exe |
File Type: | |
Category: | dropped |
Size (bytes): | 382976 |
Entropy (8bit): | 6.2782769555064935 |
Encrypted: | false |
SSDEEP: | 6144:KSyrfN+mx1KqjlxAGcQn6vGF3tUImBV15dp6zOmBjC/TGq39YyperSp:KSy731KkuQwtVXdpGjA39YPrSp |
MD5: | 11217B1A96E83FF6B0DF1DFC0CD804E7 |
SHA1: | FB824D799554180D7A1C42827C942EB31BEDFD60 |
SHA-256: | F73F4751DC2B4493CB99E644E6A94F55B4B956B40F0709E205DDAFB512CD1296 |
SHA-512: | 82528862BD375E724DFD6976C3411AF95472AB8355C381064D103DE14376263BC497B73B2A9B343E05467CDC05C5F4A4ECC0A413EE39D40D59D999F963D51E19 |
Malicious: | true |
Antivirus: |
|
Preview: |
Process: | C:\Users\user\Desktop\winrar-x64-701(1).exe |
File Type: | |
Category: | dropped |
Size (bytes): | 315904 |
Entropy (8bit): | 6.438879283746244 |
Encrypted: | false |
SSDEEP: | 6144:Jc+iPZ8eA2KjsnHocFconGhZeD774evVSp4:5ZsKjsHpFconKeD77XSp4 |
MD5: | E5F0C2C4F60BD298855DFE0019C63043 |
SHA1: | C741358D77584D9BF055C35BB7D0AC8E44231291 |
SHA-256: | A339A384B1B69D58BBAAD230C2648944B08030F823E1EF2C41E870053188F878 |
SHA-512: | 311805305F1C9D1D0F9B605E29799AC100E7889B36678E1B87009E71D79271C170DFCC36E589F2E79D74228E4706D8C2C6065F18BC3EFFF255FA7627FEFA8FF7 |
Malicious: | true |
Antivirus: |
|
Preview: |
Process: | C:\Users\user\Desktop\winrar-x64-701(1).exe |
File Type: | |
Category: | dropped |
Size (bytes): | 324272 |
Entropy (8bit): | 7.939215029789359 |
Encrypted: | false |
SSDEEP: | 6144:0HQbQuhUP/yv4J15/8Z0lIiFiDoQRkx79WftE+qby/919rRj+g8HR:JQuayv4V8ZMokx79WfGxI9LrPcR |
MD5: | 6CA1BC8BFE8B929F448E1742DACB8E7F |
SHA1: | ECA3E637DB230FA179DCD6C6499BD7D616F211E8 |
SHA-256: | 997184B6F08D36DEDC2CD12EE8DC5AFB5E6E4BF77F7AB10F7ADE9EEFDB163344 |
SHA-512: | D823F2C960A4D92129B9BDA0F4F9195D32E64B929082B5EFB9149546B5053021255D1DD03CB443F0A03106314554F76B94173E280A553A81E4AC2AC282877973 |
Malicious: | false |
Preview: |
Process: | C:\Users\user\Desktop\winrar-x64-701(1).exe |
File Type: | |
Category: | dropped |
Size (bytes): | 3286680 |
Entropy (8bit): | 6.864323385790075 |
Encrypted: | false |
SSDEEP: | 49152:olh7WxDi+U/pcCz7PZTZlzdOZlUkJLF1Uac+3+fESa6HYlGBzNwui0hBdH3XK:oMgZeD+hBBquTBpnK |
MD5: | 53CF9BACC49C034E9E947D75FFAB9224 |
SHA1: | 7DB940C68D5D351E4948F26425CD9AEE09B49B3F |
SHA-256: | 3B214FD9774C6D96332E50A501C5E467671B8B504070BBB17E497083B7E282C3 |
SHA-512: | 44C9154B1FDBCF27AB7FAEE6BE5B563A18B2BAEAD3E68B3EA788C6C76CF582F52F3F87BD447A4F6E25EC7D4690761332211659D754FB4E0630C22A372E470BDA |
Malicious: | true |
Antivirus: |
|
Preview: |
Process: | C:\Users\user\Desktop\winrar-x64-701(1).exe |
File Type: | |
Category: | dropped |
Size (bytes): | 387584 |
Entropy (8bit): | 6.458529414773216 |
Encrypted: | false |
SSDEEP: | 6144:p5aMJNLwL73PZPkFr1jilzqqVWk6855JKSFtIooEbQ/WX+t4:pOxPkPjQeqQ1Y53KR/WX+t4 |
MD5: | CD7BB857DE39A930085360674B5D78E9 |
SHA1: | 77AA6120D04B05C387FEAA9E3563B1E4D0CD4662 |
SHA-256: | 8AFBE21A3F3BCCAC6345AAB8D99C2E8F6E01CBD96D9F0FFE58F6CB881E4638FE |
SHA-512: | 0B64FE30C4704AF1ED404B287C081AD1EACBADDE153A1D9B14849868BCB950F7A41D7A36E5B03AD3CCC9C0F8E2690BE5D74D87AA606004854E4FD2EE81805D7C |
Malicious: | true |
Antivirus: |
|
Preview: |
Process: | C:\Users\user\Desktop\winrar-x64-701(1).exe |
File Type: | |
Category: | dropped |
Size (bytes): | 323072 |
Entropy (8bit): | 6.679575531692226 |
Encrypted: | false |
SSDEEP: | 6144:au3rMuh4risIXF9sQJlBBYuiTj+7HiR1juTIosSeX+t4sh:xX4riL9sU/BYuCQHipeeX+t4M |
MD5: | E0A8B12266260CB8597D0D5ECAE30362 |
SHA1: | 69D5B706B7B11462B4279592535C95E78CC090CF |
SHA-256: | 6EA28B1B5DA1D2F13DC3787D1348934F0C2BF6A186535D691818FD9FE8A90294 |
SHA-512: | 5BE1E9E4BDF75E490867150D82CBE8FB3D25B32D0E1009774BF41AF02565FE488BEFE133A959E4187B4457CCAB63059609370C314404C674174CB085021552BB |
Malicious: | true |
Antivirus: |
|
Preview: |
Process: | C:\Users\user\Uninstall.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 24 |
Entropy (8bit): | 4.053508854797679 |
Encrypted: | false |
SSDEEP: | 3:uv6L4fz0mkl:uv6cLkl |
MD5: | C69D0B5902A959577C02E9DCDDA77DE0 |
SHA1: | 6233724F8B3AC18649DC248D1C778E2BCA78A7F2 |
SHA-256: | 4301EC2E9592E7A22262D1C046954545033B73BE322B33A8117D201556C4254B |
SHA-512: | 2E8945172EF567D4AE84D6317EFCE63502A6D9496CAA48B8DC09CF12D1CEEC3E89D033D6D9FCEEBA82F403107D15341BCDB72B4A6F60BA3E6DF4D2A2CB6E48CD |
Malicious: | false |
Preview: |
Process: | C:\Users\user\Uninstall.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 22 |
Entropy (8bit): | 1.0476747992754052 |
Encrypted: | false |
SSDEEP: | 3:pjt/l:Nt |
MD5: | 76CDB2BAD9582D23C1F6F4D868218D6C |
SHA1: | B04F3EE8F5E43FA3B162981B50BB72FE1ACABB33 |
SHA-256: | 8739C76E681F900923B900C9DF0EF75CF421D39CABB54650C4B9AD19B6A76D85 |
SHA-512: | 5E2F959F36B66DF0580A94F384C5FC1CEEEC4B2A3925F062D7B68F21758B86581AC2ADCFDDE73A171A28496E758EF1B23CA4951C05455CDAE9357CC3B5A5825F |
Malicious: | false |
Preview: |
File type: | |
Entropy (8bit): | 7.955285356381258 |
TrID: |
|
File name: | winrar-x64-701(1).exe |
File size: | 3'948'120 bytes |
MD5: | 46c17c999744470b689331f41eab7df1 |
SHA1: | b8a63127df6a87d333061c622220d6d70ed80f7c |
SHA256: | c5b5def1c8882b702b6b25cbd94461c737bc151366d2d9eba5006c04886bfc9a |
SHA512: | 4b02a3e85b699f62df1b4fe752c4dee08cfabc9b8bb316bc39b854bd5187fc602943a95788ec680c7d3dc2c26ad882e69c0740294bd6cb3b32cdcd165a9441b6 |
SSDEEP: | 98304:6NRBOBfKgQIm9EOTqw8vjh9Ac9nUNupK4hVvcF+yHrAr:sR/gmeOqv7Ac9F0kB |
TLSH: | 8206231AF7A904F5D077E178C9A34607E6727C9D4771928F23E60A492F277909E3E322 |
File Content Preview: | MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.............u...u...u...v...u...p.P.u.J.....u.J.q...u.J.v...u.J.p...u...q...u...s...u...t...u...t...u.D.|...u.D.u...u.D.....u.D.w...u |
Icon Hash: | 3b3b336b696ab269 |
Entrypoint: | 0x140029e90 |
Entrypoint Section: | .text |
Digitally signed: | true |
Imagebase: | 0x140000000 |
Subsystem: | windows gui |
Image File Characteristics: | EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE |
DLL Characteristics: | HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE |
Time Stamp: | 0x66409736 [Sun May 12 10:17:26 2024 UTC] |
TLS Callbacks: | |
CLR (.Net) Version: | |
OS Version Major: | 6 |
OS Version Minor: | 0 |
File Version Major: | 6 |
File Version Minor: | 0 |
Subsystem Version Major: | 6 |
Subsystem Version Minor: | 0 |
Import Hash: | 39da3cace27ab9503fa46001ce968ea6 |
Signature Valid: | true |
Signature Issuer: | CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US |
Signature Validation Error: | The operation completed successfully |
Error Number: | 0 |
Not Before, Not After |
|
Subject Chain |
|
Version: | 3 |
Thumbprint MD5: | 4E14FDD2231019D7E676235D9D81BCAE |
Thumbprint SHA-1: | 729AE1F8B489DE176CC099FF49937F85F9E412F7 |
Thumbprint SHA-256: | E0F8ABF2A732B2D82369C6CDF5657C85C231A924C82528D853AA8F38E0B3ACD9 |
Serial: | 048B08399EC703623C72CD2077AD65D9 |
Instruction |
---|
dec eax |
sub esp, 28h |
call 00007F25489F4AC8h |
dec eax |
add esp, 28h |
jmp 00007F25489F440Fh |
int3 |
int3 |
dec eax |
mov eax, esp |
dec eax |
mov dword ptr [eax+08h], ebx |
dec eax |
mov dword ptr [eax+10h], ebp |
dec eax |
mov dword ptr [eax+18h], esi |
dec eax |
mov dword ptr [eax+20h], edi |
inc ecx |
push esi |
dec eax |
sub esp, 20h |
dec ebp |
mov edx, dword ptr [ecx+38h] |
dec eax |
mov esi, edx |
dec ebp |
mov esi, eax |
dec eax |
mov ebp, ecx |
dec ecx |
mov edx, ecx |
dec eax |
mov ecx, esi |
dec ecx |
mov edi, ecx |
inc ecx |
mov ebx, dword ptr [edx] |
dec eax |
shl ebx, 04h |
dec ecx |
add ebx, edx |
dec esp |
lea eax, dword ptr [ebx+04h] |
call 00007F25489F4C1Fh |
mov eax, dword ptr [ebp+04h] |
and al, 66h |
neg al |
mov eax, 00000001h |
sbb edx, edx |
neg edx |
add edx, eax |
test dword ptr [ebx+04h], edx |
je 00007F25489F45A3h |
dec esp |
mov ecx, edi |
dec ebp |
mov eax, esi |
dec eax |
mov edx, esi |
dec eax |
mov ecx, ebp |
call 00007F25489F6AFFh |
dec eax |
mov ebx, dword ptr [esp+30h] |
dec eax |
mov ebp, dword ptr [esp+38h] |
dec eax |
mov esi, dword ptr [esp+40h] |
dec eax |
mov edi, dword ptr [esp+48h] |
dec eax |
add esp, 20h |
inc ecx |
pop esi |
ret |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
nop word ptr [eax+eax+00000000h] |
dec eax |
sub esp, 10h |
dec esp |
mov dword ptr [esp], edx |
dec esp |
mov dword ptr [esp+08h], ebx |
dec ebp |
xor ebx, ebx |
dec esp |
lea edx, dword ptr [esp+18h] |
dec esp |
sub edx, eax |
Name | Virtual Address | Virtual Size | Is in Section |
---|---|---|---|
IMAGE_DIRECTORY_ENTRY_EXPORT | 0x54f50 | 0x34 | .rdata |
IMAGE_DIRECTORY_ENTRY_IMPORT | 0x54f84 | 0x50 | .rdata |
IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x6c000 | 0x26090 | .rsrc |
IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x66000 | 0x3ff0 | .pdata |
IMAGE_DIRECTORY_ENTRY_SECURITY | 0x3c15c0 | 0x2898 | |
IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x93000 | 0x944 | .reloc |
IMAGE_DIRECTORY_ENTRY_DEBUG | 0x4f340 | 0x54 | .rdata |
IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_TLS | 0x4f400 | 0x28 | .rdata |
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x44d00 | 0x140 | .rdata |
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_IAT | 0x44000 | 0x518 | .rdata |
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x5412c | 0x100 | .rdata |
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
---|---|---|---|---|---|---|---|---|---|
.text | 0x1000 | 0x4217e | 0x42200 | 3b541339cc9e14f15b888d0479b3133f | False | 0.5534137228260869 | DOS executable (COM) | 6.465496377863431 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
.rdata | 0x44000 | 0x12096 | 0x12200 | 68b3387c3dedeaa3b1e5cd69a387443c | False | 0.4515355603448276 | SysEx File - Matsushita | 5.2033734091823645 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
.data | 0x57000 | 0xe404 | 0x1200 | 615b97fd5c58191151507c5357520b77 | False | 0.2573784722222222 | data | 3.0651893813727122 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
.pdata | 0x66000 | 0x3ff0 | 0x4000 | 1b12bb5f5c27bc0ec26e22d952efe46a | False | 0.47430419921875 | data | 5.202190058981855 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
.didat | 0x6a000 | 0x338 | 0x400 | 7a4026fb8d4e9aa87fe9f6aaaaa650d9 | False | 0.244140625 | data | 2.9226525026637282 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
_RDATA | 0x6b000 | 0x15c | 0x200 | c2a487c68e9b43cb7d57799aad555ea0 | False | 0.40625 | data | 3.3261253179891916 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
.rsrc | 0x6c000 | 0x27000 | 0x26200 | 0e7c014a9728ac20034e79955ae49a9b | False | 0.8942943135245902 | data | 7.756954915676745 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
.reloc | 0x93000 | 0x944 | 0xa00 | c5a48e3ca994dee11a564d2249cdf0a4 | False | 0.476171875 | data | 5.252204538581881 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
---|---|---|---|---|---|---|
PNG | 0x6c5cc | 0x3318 | PNG image data, 256 x 64, 8-bit/color RGBA, non-interlaced | English | United States | 0.9983944954128441 |
PNG | 0x6f8e4 | 0xdc20 | PNG image data, 512 x 128, 8-bit/color RGBA, non-interlaced | English | United States | 1.000461385576377 |
RT_ICON | 0x7d504 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 256, resolution 2834 x 2834 px/m, 256 important colors | English | United States | 0.4031791907514451 |
RT_ICON | 0x7da6c | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 1024, resolution 2834 x 2834 px/m, 256 important colors | English | United States | 0.6425992779783394 |
RT_ICON | 0x7e314 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 2304, resolution 2834 x 2834 px/m, 256 important colors | English | United States | 0.6156716417910447 |
RT_ICON | 0x7f1bc | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2834 x 2834 px/m | English | United States | 0.43439716312056736 |
RT_ICON | 0x7f624 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2834 x 2834 px/m | English | United States | 0.5175891181988743 |
RT_ICON | 0x806cc | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2834 x 2834 px/m | English | United States | 0.5034232365145228 |
RT_ICON | 0x82c74 | 0xd646 | PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced | English | United States | 0.9980675976227805 |
RT_DIALOG | 0x902bc | 0xdc | data | English | United States | 0.7090909090909091 |
RT_DIALOG | 0x90398 | 0x12e | data | English | United States | 0.5927152317880795 |
RT_DIALOG | 0x904c8 | 0x338 | data | English | United States | 0.45145631067961167 |
RT_DIALOG | 0x90800 | 0x37a | data | English | United States | 0.5348314606741573 |
RT_STRING | 0x90b7c | 0x178 | data | English | United States | 0.4308510638297872 |
RT_STRING | 0x90cf4 | 0x1b4 | data | English | United States | 0.4426605504587156 |
RT_STRING | 0x90ea8 | 0x19a | data | English | United States | 0.4902439024390244 |
RT_STRING | 0x91044 | 0x146 | data | English | United States | 0.5153374233128835 |
RT_STRING | 0x9118c | 0x1fc | data | English | United States | 0.4547244094488189 |
RT_STRING | 0x91388 | 0xd6 | Matlab v4 mat-file (little endian) E, numeric, rows 0, columns 0 | English | United States | 0.46261682242990654 |
RT_STRING | 0x91460 | 0x9a | data | English | United States | 0.5974025974025974 |
RT_STRING | 0x914fc | 0x3a | data | English | United States | 0.6896551724137931 |
RT_STRING | 0x91538 | 0xd6 | data | English | United States | 0.5747663551401869 |
RT_GROUP_ICON | 0x91610 | 0x68 | data | English | United States | 0.7019230769230769 |
RT_VERSION | 0x91678 | 0x2c8 | data | English | United States | 0.46207865168539325 |
RT_MANIFEST | 0x91940 | 0x750 | XML 1.0 document, ASCII text, with CRLF line terminators | English | United States | 0.3969017094017094 |
DLL | Import |
---|---|
KERNEL32.dll | GetLastError, FormatMessageW, LocalFree, SetLastError, CreateHardLinkW, SetFileTime, GetCurrentProcess, CloseHandle, CreateFileW, DeviceIoControl, RemoveDirectoryW, DeleteFileW, GetLongPathNameW, GetShortPathNameW, MoveFileW, GetStdHandle, WriteFile, ReadFile, SetFilePointer, SetEndOfFile, FlushFileBuffers, GetFileType, CreateDirectoryW, GetFileAttributesW, SetFileAttributesW, GetCurrentProcessId, FindClose, FindFirstFileW, FindNextFileW, GetVersionExW, GetFullPathNameW, FoldStringW, GetModuleFileNameW, SetCurrentDirectoryW, GetCurrentDirectoryW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, ExpandEnvironmentStringsW, SetThreadExecutionState, CompareStringW, AllocConsole, AttachConsole, WriteConsoleW, Sleep, FreeConsole, ExitProcess, GetSystemDirectoryW, LoadLibraryW, InitializeCriticalSection, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, CreateThread, WaitForSingleObject, GetProcessAffinityMask, CreateSemaphoreW, CreateEventW, ReleaseSemaphore, SetThreadPriority, SetEvent, ResetEvent, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToTzSpecificLocalTime, SystemTimeToFileTime, LocalFileTimeToFileTime, TzSpecificLocalTimeToSystemTime, GetSystemTime, WideCharToMultiByte, MultiByteToWideChar, GetCPInfo, IsDBCSLeadByte, GlobalAlloc, SizeofResource, LoadResource, LockResource, GlobalLock, GlobalUnlock, GlobalFree, GetDateFormatW, GetTimeFormatW, GlobalMemoryStatusEx, GetLocaleInfoW, GetNumberFormatW, GetCommandLineW, OpenFileMappingW, MapViewOfFile, UnmapViewOfFile, SetEnvironmentVariableW, GetLocalTime, GetTickCount, CreateFileMappingW, MoveFileExW, GetTempPathW, GetExitCodeProcess, GetConsoleMode, GetConsoleOutputCP, HeapSize, SetFilePointerEx, GetStringTypeW, SetStdHandle, GetProcessHeap, LCMapStringW, FlsFree, FlsSetValue, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, InitializeCriticalSectionAndSpinCount, WaitForSingleObjectEx, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwindEx, RtlPcToFileHeader, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, HeapFree, HeapAlloc, HeapReAlloc, FindFirstFileExW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetEnvironmentStringsW, FreeEnvironmentStringsW, FlsAlloc, FlsGetValue |
OLEAUT32.dll | SysAllocString, SysFreeString, VariantClear |
gdiplus.dll | GdipFree, GdipAlloc, GdipCloneImage, GdipDisposeImage, GdipCreateHBITMAPFromBitmap, GdiplusStartup, GdiplusShutdown, GdipCreateBitmapFromStream |
Language of compilation system | Country where language is spoken | Map |
---|---|---|
English | United States |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
Target ID: | 0 |
Start time: | 04:18:29 |
Start date: | 10/10/2024 |
Path: | C:\Users\user\Desktop\winrar-x64-701(1).exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x13f780000 |
File size: | 3'948'120 bytes |
MD5 hash: | 46C17C999744470B689331F41EAB7DF1 |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | low |
Has exited: | true |
Target ID: | 4 |
Start time: | 04:18:44 |
Start date: | 10/10/2024 |
Path: | C:\Users\user\Uninstall.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x13fa40000 |
File size: | 488'600 bytes |
MD5 hash: | 4783F1A5F0BBA7A6A40CB74BC8C41217 |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Antivirus matches: |
|
Reputation: | low |
Has exited: | false |
Execution Graph
Execution Coverage: | 15.3% |
Dynamic/Decrypted Code Coverage: | 0% |
Signature Coverage: | 17.2% |
Total number of Nodes: | 1336 |
Total number of Limit Nodes: | 23 |
Graph
Function 000000013F7A4930 Relevance: 98.9, APIs: 45, Strings: 11, Instructions: 931windowfilesleepCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7A41D0 Relevance: 40.5, APIs: 17, Strings: 6, Instructions: 228filesleeptimeCOMMON
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7A5ABC Relevance: 34.4, APIs: 7, Strings: 12, Instructions: 1184COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F796960 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 238COMMON
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F795B4C Relevance: 21.5, APIs: 1, Strings: 11, Instructions: 506COMMON
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7A1FEC Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 85memoryCOMMON
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F791F08 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 106fileCOMMON
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7A02DC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 59comCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F79A548 Relevance: 147.4, APIs: 16, Strings: 68, Instructions: 421libraryfileloaderCOMMON
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7A8B00 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 195libraryCOMMON
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7A07C4 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 111COMMON
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7A30D4 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 100windowCOMMON
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7A6E54 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 238COMMON
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7BB170 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 117libraryloaderCOMMON
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7A0DE0 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 113memoryCOMMON
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F790580 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 131filetimeCOMMON
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7AF9BC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7A7598 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57registryCOMMON
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7A19F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 33COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7909B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7911B4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7811C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7A2794 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 24comCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7BAADC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7BA544 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 128COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F790DA8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7907A8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 84fileCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F79AD40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66libraryCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7A0190 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F782724 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F79788C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F791694 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7919A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38fileCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F79160C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7BB3E8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7A0C7C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7A32F8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7BB458 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7827FC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F79AF80 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 25threadCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F781B5C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 21COMMONLIBRARYCODE
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F79B038 Relevance: 3.0, APIs: 2, Instructions: 23COMMONLIBRARYCODE
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7B7738 Relevance: 2.5, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7B7774 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F794A40 Relevance: 1.5, APIs: 1, Instructions: 8COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7BCFAC Relevance: 25.7, APIs: 9, Strings: 5, Instructions: 1226COMMONLIBRARYCODE
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F78C4E0 Relevance: 23.2, APIs: 8, Strings: 5, Instructions: 412fileCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7A34D0 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 247windowCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7AFEC8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7A1CE8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 187COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7BCB10 Relevance: 4.8, APIs: 3, Instructions: 340COMMONLIBRARYCODE
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7B9B40 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 149COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F792D64 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7A2954 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7C1518 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7B7D40 Relevance: 2.6, Strings: 2, Instructions: 144COMMONLIBRARYCODE
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7B31D0 Relevance: 1.6, Strings: 1, Instructions: 327COMMONLIBRARYCODE
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7B78AC Relevance: 1.5, Strings: 1, Instructions: 254COMMONLIBRARYCODE
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F787754 Relevance: .9, Instructions: 893COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F798978 Relevance: .6, Instructions: 587COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7B1D94 Relevance: .1, Instructions: 146COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7B1984 Relevance: .1, Instructions: 146COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7B1574 Relevance: .1, Instructions: 146COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F79EEF0 Relevance: .1, Instructions: 107COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F79AEE4 Relevance: .0, Instructions: 39COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7AA354 Relevance: .0, Instructions: 2COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7A99C0 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 61libraryloaderCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7A5950 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7A2BCC Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 85windowCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7B0BF8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7AD17C Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 317COMMONLIBRARYCODE
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7900DC Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 247fileCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7A213C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 76timeCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7B72E0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 62COMMONLIBRARYCODE
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7A8FC0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137memoryCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F79B444 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 110timeCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F79B5DC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83timeCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7AD654 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 316COMMONLIBRARYCODE
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7BB7D0 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 182COMMONLIBRARYCODE
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F792B00 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 155comCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7C13CC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7A8800 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 43libraryloaderCOMMONLIBRARYCODE
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7B7458 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7BEF38 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 299fileCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7ADD6C Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 191COMMONLIBRARYCODE
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7AC478 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMONLIBRARYCODE
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7913D8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 144filetimeCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F793F2C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 127COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7A33EC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 47COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7A4688 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 43COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7B5E5C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7985E8 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 22libraryloaderCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7ACA4C Relevance: 7.8, APIs: 5, Instructions: 290COMMONLIBRARYCODE
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7C1028 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7B7520 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7A71D0 Relevance: 7.5, APIs: 5, Instructions: 29windowsynchronizationCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7B5368 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7ADB50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMONLIBRARYCODE
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7AE2E0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMONLIBRARYCODE
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7BF5D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100fileCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7A3B00 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F78C424 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7A92F0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46COMMONLIBRARYCODE
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7A0990 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33registryCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7A1CA4 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7B98FC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7AE518 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMONLIBRARYCODE
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7AEB50 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 117COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7B6174 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F791730 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 110COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7A1A7C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7BF4B4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77fileCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7BF3B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74fileCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7BA138 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7A3920 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F798864 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7A2DE8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7918C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60fileCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F79B0A8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7AC3D8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F791A2C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7A29A4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F79CC5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F79B7E8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20timeCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F7A24A8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F79AFF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16synchronizationCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013F796458 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Execution Graph
Execution Coverage: | 14.7% |
Dynamic/Decrypted Code Coverage: | 0% |
Signature Coverage: | 0% |
Total number of Nodes: | 1814 |
Total number of Limit Nodes: | 12 |
Graph
Function 000000013FA4BA0C Relevance: 19.8, APIs: 1, Strings: 10, Instructions: 502COMMON
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA51D3C Relevance: 33.4, APIs: 12, Strings: 7, Instructions: 130comwindowCOMMON
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA459F0 Relevance: 23.2, APIs: 1, Strings: 12, Instructions: 465COMMON
Control-flow Graph
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA522D0 Relevance: 23.0, APIs: 8, Strings: 5, Instructions: 228windowCOMMON
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA43804 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 188COMMON
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA684E8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA5A92C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA47690 Relevance: 7.6, APIs: 5, Instructions: 131filetimeCOMMON
Control-flow Graph
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA4D818 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56libraryCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA4DB8C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA4A4F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA67860 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 128COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA687D0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53COMMONLIBRARYCODE
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA50E90 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41registryCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA461B4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA5774C Relevance: 3.0, APIs: 2, Instructions: 18memoryCOMMONLIBRARYCODE
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA575E4 Relevance: 3.0, APIs: 2, Instructions: 14COMMONLIBRARYCODE
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA667E8 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA4C7E0 Relevance: 31.8, APIs: 15, Strings: 3, Instructions: 277windowCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA5AE38 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA464B0 Relevance: 23.0, APIs: 8, Strings: 5, Instructions: 260COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA43B00 Relevance: 21.1, APIs: 3, Strings: 9, Instructions: 109synchronizationCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA54AA0 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 61libraryloaderCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA52720 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 163windowCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA51568 Relevance: 16.0, APIs: 4, Strings: 5, Instructions: 228libraryloaderCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA5B5E4 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA580EC Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMONLIBRARYCODE
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA4D954 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 116registryCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA539B4 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 81COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA51F9C Relevance: 12.2, APIs: 1, Strings: 7, Instructions: 211sleepCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA49D7C Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 154comCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA540A0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 137memoryCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA4A5F4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 82registryCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA627D0 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA6EA1C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA4EAA4 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 20libraryloaderCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA585C4 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 316COMMONLIBRARYCODE
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA62948 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA57288 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMONLIBRARYCODE
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA611C4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA579BC Relevance: 7.8, APIs: 5, Instructions: 290COMMONLIBRARYCODE
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA6F18C Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA62A10 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA65B28 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA58CDC Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 191COMMONLIBRARYCODE
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA58AC0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMONLIBRARYCODE
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA59250 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMONLIBRARYCODE
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA50BA4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68registryCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA59488 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMONLIBRARYCODE
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA59AC0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 117COMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA64B28 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA50910 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54registryCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000000013FA571E8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|