Edit tour
Windows
Analysis Report
nHOMA2CalculatorWindowsSetup.exe
Overview
General Information
| Sample name: | nHOMA2CalculatorWindowsSetup.exe |
| Analysis ID: | 1538232 |
| MD5: | f89876113397eab218fb197d549903ac |
| SHA1: | 23bc6f72adccb9f5577ff939b8501e488fd8834b |
| SHA256: | 3308fbc9f79869fdda63dc3d911b1c300518db7a04fe4e0591307b3f29094350 |
| Tags: | exeuser-Porcupine |
| Infos: | |
 | |
Detection
| Score: | 5 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 40% |
Signatures
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to create guard pages, often used to hinder reverse usering and debugging
Contains functionality to dynamically determine API calls
Contains functionality to query locales information (e.g. system language)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates files inside the system directory
Detected potential crypto function
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
PE file contains executable resources (Code or Archives)
Queries keyboard layouts
Queries the volume information (name, serial number etc) of a device
Registers a DLL
Sample file is different than original file name gathered from version info
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Classification
- System is w10x64
nHOMA2CalculatorWindowsSetup.exe (PID: 5812 cmdline: "C:\Users\ user\Deskt op\nHOMA2C alculatorW indowsSetu p.exe" MD5: F89876113397EAB218FB197D549903AC) - nHOMA2CalculatorWindowsSetup.tmp (PID: 1548 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\is-EVE H9.tmp\nHO MA2Calcula torWindows Setup.tmp" /SL5="$20 3BC,193464 3,407552,C :\Users\us er\Desktop \nHOMA2Cal culatorWin dowsSetup. exe" MD5: 2703D25D95D502EC71ADE55C81145A03) 
regsvr32.exe (PID: 1616 cmdline: "C:\Window s\system32 \regsvr32. exe" /s "C :\Windows\ system32\H OMACore.dl l" MD5: 878E47C8656E53AE8A8A21E927C6F7E0) - HOMA2 Calculator.exe (PID: 3472 cmdline:
"C:\Progra m Files\HO MA Calcula tor v2.2.3 \HOMA2 Cal culator.ex e" MD5: E017A16D1C8F66C4383C585C3FD8C629)
- cleanup
⊘No configs have been found
⊘No yara matches
⊘No Sigma rule has matched
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
There are no malicious signatures, click here to show all signatures.
| Source: | Static PE information: | ||
| Source: | Directory created: | Jump to behavior | ||
| Source: | Directory created: | Jump to behavior | ||
| Source: | Directory created: | Jump to behavior | ||
| Source: | Directory created: | Jump to behavior | ||
| Source: | Directory created: | Jump to behavior | ||
| Source: | Directory created: | Jump to behavior | ||
| Source: | Directory created: | Jump to behavior | ||
| Source: | Directory created: | Jump to behavior | ||
| Source: | Directory created: | Jump to behavior | ||
| Source: | Directory created: | Jump to behavior | ||
| Source: | Directory created: | Jump to behavior | ||
| Source: | Registry value created: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Code function: | 5_2_6C8D0CBB | |
| Source: | Code function: | 5_2_6C8CCC23 | |
| Source: | Code function: | 5_2_6C8D088A | |
| Source: | Code function: | 5_2_6C8CC8FD | |
| Source: | Code function: | 5_2_6C8CE0BD | |
| Source: | Code function: | 5_2_6C8981A1 | |
| Source: | Code function: | 5_2_6C8CFF0E | |
| Source: | Code function: | 5_2_6C8CF9DD | |
| Source: | Code function: | 5_2_6C8CDBC0 | |
| Source: | Code function: | 5_2_6C8CF593 | |
| Source: | Code function: | 5_2_6C8CD687 | |
| Source: | Code function: | 5_2_6C8D110C | |
| Source: | Code function: | 5_2_6C8CF169 | |
| Source: | Code function: | 5_2_6C87F680 | |
| Source: | Code function: | 5_2_6C887270 | |
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Code function: | 5_2_00FC1000 | |
| Source: | Code function: | 5_2_6C8BECCD | |
| Source: | Code function: | 5_2_6C888F83 | |
| Source: | Code function: | 5_2_6C90083D | |
| Source: | Code function: | 5_2_6C8A0919 | |
| Source: | Code function: | 5_2_6C886B28 | |
| Source: | Code function: | 5_2_6C8E245B | |
| Source: | Code function: | 5_2_6C89457E | |
| Source: | Code function: | 5_2_6C88867F | |
| Source: | Code function: | 5_2_6C91672F | |
| Source: | Code function: | 5_2_6C8EE765 | |
| Source: | Code function: | 5_2_6C8CE0BD | |
| Source: | Code function: | 5_2_6C886018 | |
| Source: | Code function: | 5_2_6C8721F0 | |
| Source: | Code function: | 5_2_6C908140 | |
| Source: | Code function: | 5_2_6C88A2A7 | |
| Source: | Code function: | 5_2_6C8E42FB | |
| Source: | Code function: | 5_2_6C8843A6 | |
| Source: | Code function: | 5_2_6C8863C9 | |
| Source: | Code function: | 5_2_6C8CA3DD | |
| Source: | Code function: | 5_2_6C901C17 | |
| Source: | Code function: | 5_2_6C885C2C | |
| Source: | Code function: | 5_2_6C885C30 | |
| Source: | Code function: | 5_2_6C883DD0 | |
| Source: | Code function: | 5_2_6C889D65 | |
| Source: | Code function: | 5_2_6C903888 | |
| Source: | Code function: | 5_2_6C8EF82E | |
| Source: | Code function: | 5_2_6C8E9945 | |
| Source: | Code function: | 5_2_6C911A00 | |
| Source: | Code function: | 5_2_6C883A1C | |
| Source: | Code function: | 5_2_6C917A5A | |
| Source: | Code function: | 5_2_6C8CDBC0 | |
| Source: | Code function: | 5_2_6C8ED45A | |
| Source: | Code function: | 5_2_6C8CD687 | |
| Source: | Code function: | 5_2_6C919659 | |
| Source: | Code function: | 5_2_6C90D674 | |
| Source: | Code function: | 5_2_6C8EB79B | |
| Source: | Code function: | 5_2_6C8897A0 | |
| Source: | Code function: | 5_2_6C887093 | |
| Source: | Code function: | 5_2_6C8871A3 | |
| Source: | Code function: | 5_2_6C89911E | |
| Source: | Code function: | 5_2_6C8E52E5 | |
| Source: | Code function: | 5_2_6C91923E | |
| Source: | Code function: | 5_2_6C887270 | |
| Source: | Code function: | 5_2_6C8E3332 | |
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 5_2_6C8CD543 | |
| Source: | Code function: | 5_2_00FC1000 | |
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Key value created or modified: | Jump to behavior | ||
| Source: | String found in binary or memory: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | Key value created or modified: | Jump to behavior | ||
| Source: | Window found: | Jump to behavior | ||
| Source: | Automated click: | ||
| Source: | Automated click: | ||
| Source: | Automated click: | ||
| Source: | Automated click: | ||
| Source: | Automated click: | ||
| Source: | Automated click: | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Window detected: | ||
| Source: | Window detected: | ||
| Source: | Directory created: | Jump to behavior | ||
| Source: | Directory created: | Jump to behavior | ||
| Source: | Directory created: | Jump to behavior | ||
| Source: | Directory created: | Jump to behavior | ||
| Source: | Directory created: | Jump to behavior | ||
| Source: | Directory created: | Jump to behavior | ||
| Source: | Directory created: | Jump to behavior | ||
| Source: | Directory created: | Jump to behavior | ||
| Source: | Directory created: | Jump to behavior | ||
| Source: | Directory created: | Jump to behavior | ||
| Source: | Directory created: | Jump to behavior | ||
| Source: | Registry value created: | Jump to behavior | ||
| Source: | Static file information: | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Code function: | 5_2_00FC1000 | |
| Source: | Process created: | ||
| Source: | Code function: | 5_2_00FC2DD8 | |
| Source: | Code function: | 5_2_6C880CD8 | |
| Source: | Code function: | 5_2_6C872DA6 | |
| Source: | Code function: | 5_2_6C89A6B1 | |
| Source: | Code function: | 5_2_6C899CE6 | |
| Source: | Code function: | 5_2_6C88B66B | |
| Source: | Static PE information: | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Code function: | 5_2_6C8CA3DD | |
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | API coverage: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Code function: | 5_2_6C8D0CBB | |
| Source: | Code function: | 5_2_6C8CCC23 | |
| Source: | Code function: | 5_2_6C8D088A | |
| Source: | Code function: | 5_2_6C8CC8FD | |
| Source: | Code function: | 5_2_6C8CE0BD | |
| Source: | Code function: | 5_2_6C8981A1 | |
| Source: | Code function: | 5_2_6C8CFF0E | |
| Source: | Code function: | 5_2_6C8CF9DD | |
| Source: | Code function: | 5_2_6C8CDBC0 | |
| Source: | Code function: | 5_2_6C8CF593 | |
| Source: | Code function: | 5_2_6C8CD687 | |
| Source: | Code function: | 5_2_6C8D110C | |
| Source: | Code function: | 5_2_6C8CF169 | |
| Source: | Code function: | 5_2_6C8F6BA4 | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | API call chain: | graph_5-70721 | ||
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Code function: | 5_2_00FC13E0 | |
| Source: | Code function: | 5_2_6C8F6BA4 | |
| Source: | Code function: | 5_2_00FC1000 | |
| Source: | Code function: | 5_2_6C8F9B6F | |
| Source: | Code function: | 5_2_00FC13E0 | |
| Source: | Code function: | 5_2_00FC18A6 | |
| Source: | Code function: | 5_2_6C8FAD2C | |
| Source: | Code function: | 5_2_6C8807A7 | |
| Source: | Code function: | 5_2_6C8FC097 | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Code function: | 5_2_6C8FEF5C | |
| Source: | Code function: | 5_2_6C8874D0 | |
| Source: | Code function: | 5_2_6C88750C | |
| Source: | Code function: | 5_2_6C88767A | |
| Source: | Code function: | 5_2_6C8FF003 | |
| Source: | Code function: | 5_2_6C8FF05E | |
| Source: | Code function: | 5_2_6C8FF2EF | |
| Source: | Code function: | 5_2_6C8852E4 | |
| Source: | Code function: | 5_2_6C8FF22F | |
| Source: | Code function: | 5_2_6C887270 | |
| Source: | Code function: | 5_2_6C8873B4 | |
| Source: | Code function: | 5_2_6C8FF356 | |
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Code function: | 5_2_00FC2F6F | |
| Source: | Code function: | 5_2_6C8962FC | |
| Source: | Code function: | 5_2_6C8BBE38 | |
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 2 Command and Scripting Interpreter | 1 Windows Service | 1 Windows Service | 23 Masquerading | OS Credential Dumping | 2 System Time Discovery | Remote Services | 1 Archive Collected Data | 1 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | 1 Native API | 1 Registry Run Keys / Startup Folder | 2 Process Injection | 1 Disable or Modify Tools | LSASS Memory | 21 Security Software Discovery | Remote Desktop Protocol | Data from Removable Media | Junk Data | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | 1 DLL Side-Loading | 1 Registry Run Keys / Startup Folder | 2 Process Injection | Security Account Manager | 2 Process Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | Steganography | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | 1 DLL Side-Loading | 1 Deobfuscate/Decode Files or Information | NTDS | 2 System Owner/User Discovery | Distributed Component Object Model | Input Capture | Protocol Impersonation | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 4 Obfuscated Files or Information | LSA Secrets | 2 File and Directory Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 1 Regsvr32 | Cached Domain Credentials | 35 System Information Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 1 Software Packing | DCSync | Remote System Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
| Network Trust Dependencies | Serverless | Drive-by Compromise | Container Orchestration Job | Scheduled Task/Job | Scheduled Task/Job | 1 DLL Side-Loading | Proc Filesystem | System Owner/User Discovery | Cloud Services | Credential API Hooking | Application Layer Protocol | Exfiltration Over Alternative Protocol | Defacement |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 5% | ReversingLabs |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 7% | ReversingLabs | |||
| 7% | ReversingLabs | |||
| 7% | ReversingLabs | |||
| 7% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 7% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs |
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe |
⊘No contacted domains info
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false | unknown | |||
| false | unknown | |||
| false | unknown | |||
| false | unknown | |||
| false |
| unknown | ||
| false | unknown | |||
| false | unknown | |||
| false | unknown | |||
| false | unknown |
⊘No contacted IP infos
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1538232 |
| Start date and time: | 2024-10-20 21:01:09 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 6m 29s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 14 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | nHOMA2CalculatorWindowsSetup.exe |
| Detection: | CLEAN |
| Classification: | clean5.winEXE@7/26@0/0 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
- Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
- Report size getting too big, too many NtOpenKeyEx calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
- VT rate limit hit for: nHOMA2CalculatorWindowsSetup.exe
⊘No simulations
⊘No context
⊘No context
⊘No context
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| C:\Program Files\HOMA Calculator v2.2.3\HOMA2 Calculator Libs\is-42761.tmp | Get hash | malicious | DanaBot | Browse | ||
| Get hash | malicious | DanaBot | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse |
| Process: | C:\Users\user\AppData\Local\Temp\is-EVEH9.tmp\nHOMA2CalculatorWindowsSetup.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 64 |
| Entropy (8bit): | 4.741729296672176 |
| Encrypted: | false |
| SSDEEP: | 3:HRAbABGQYm/0S4VdwFkmEtKBn:HRYFVm/r4VKezOn |
| MD5: | BC757328FBACD4A2F07A7697213CE9B1 |
| SHA1: | 007D46B043E6076B35A3A73444F8BE71E8929E73 |
| SHA-256: | D42254E795D527CDEDA069831AA84DDD90A0FEE20D2BB51D861E2CFF2DC3D0DE |
| SHA-512: | 25697D06CD4C10196B1F6FD4432443791331C2439B51C56737A2FB8305983AEF9BED488526CFED7E48FAF4F3B0A881D5A062800C64AE6E29091805A40CCA376C |
| Malicious: | false |
| Reputation: | low |
| Preview: |
C:\Program Files\HOMA Calculator v2.2.3\HOMA2 Calculator Libs\RBGUIFramework.dll (copy) 
Download File
| Process: | C:\Users\user\AppData\Local\Temp\is-EVEH9.tmp\nHOMA2CalculatorWindowsSetup.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1848320 |
| Entropy (8bit): | 6.7432555985692435 |
| Encrypted: | false |
| SSDEEP: | 49152:PBPigQxM2PzpWMnVk15kVWUqFdGpguBbW+s/TYYuGfezmAd539aG:PBPiJu1HFdtuB |
| MD5: | 4D4F8135729A66286733B3963986C077 |
| SHA1: | 1724E58B84201F61F671F6B76A1C9FE56653BBE5 |
| SHA-256: | D46748677D12742B983085D8AFC7712F4F7098C3BFCA932C779654DFBF3367EA |
| SHA-512: | CC41BBC6FBA64CFA24F016947D83838208840131B077B16F7DE604EE95326A14927D42CB3EA2B58B1783361BEDBF33105F2AA5986D8B347DE487EC5BCC7EB17B |
| Malicious: | false |
| Antivirus: |
|
| Reputation: | low |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-EVEH9.tmp\nHOMA2CalculatorWindowsSetup.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 421200 |
| Entropy (8bit): | 6.59808962341698 |
| Encrypted: | false |
| SSDEEP: | 12288:iHEqYsrMWIqz473PTiPoH/aGhUgiW6QR7t5qv3Ooc8UHkC2eKq87:iH9YsIWIW4rPTiPofaDv3Ooc8UHkC2e8 |
| MD5: | 03E9314004F504A14A61C3D364B62F66 |
| SHA1: | 0AA3CAAC24FDF9D9D4C618E2BBF0A063036CD55D |
| SHA-256: | A3BA6421991241BEA9C8334B62C3088F8F131AB906C3CC52113945D05016A35F |
| SHA-512: | 2FCFF4439D2759D93C57D49B24F28AE89B7698E284E76AC65FE2B50BDEFC23A8CC3C83891D671DE4E4C0F036CEF810856DE79AC2B028AA89A895BF35ABFF8C8D |
| Malicious: | false |
| Antivirus: |
|
| Joe Sandbox View: |
|
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-EVEH9.tmp\nHOMA2CalculatorWindowsSetup.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1848320 |
| Entropy (8bit): | 6.7432555985692435 |
| Encrypted: | false |
| SSDEEP: | 49152:PBPigQxM2PzpWMnVk15kVWUqFdGpguBbW+s/TYYuGfezmAd539aG:PBPiJu1HFdtuB |
| MD5: | 4D4F8135729A66286733B3963986C077 |
| SHA1: | 1724E58B84201F61F671F6B76A1C9FE56653BBE5 |
| SHA-256: | D46748677D12742B983085D8AFC7712F4F7098C3BFCA932C779654DFBF3367EA |
| SHA-512: | CC41BBC6FBA64CFA24F016947D83838208840131B077B16F7DE604EE95326A14927D42CB3EA2B58B1783361BEDBF33105F2AA5986D8B347DE487EC5BCC7EB17B |
| Malicious: | false |
| Antivirus: |
|
| Reputation: | low |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-EVEH9.tmp\nHOMA2CalculatorWindowsSetup.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 770384 |
| Entropy (8bit): | 6.908020029901359 |
| Encrypted: | false |
| SSDEEP: | 12288:fQmCy3NeRjkpQmj3oaMtQqjoygfXq3kon9IlbgaOxQdVJJ6j5EBKX8hR5:ImCy3VQs9MtLjTgfa3kon9FaOdEz5 |
| MD5: | 67EC459E42D3081DD8FD34356F7CAFC1 |
| SHA1: | 1738050616169D5B17B5ADAC3FF0370B8C642734 |
| SHA-256: | 1221A09484964A6F38AF5E34EE292B9AFEFCCB3DC6E55435FD3AAF7C235D9067 |
| SHA-512: | 9ED1C106DF217E0B4E4FBD1F4275486CEBA1D8A225D6C7E47B854B0B5E6158135B81BE926F51DB0AD5C624F9BD1D09282332CF064680DC9F7D287073B9686D33 |
| Malicious: | false |
| Antivirus: |
|
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-EVEH9.tmp\nHOMA2CalculatorWindowsSetup.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 421200 |
| Entropy (8bit): | 6.59808962341698 |
| Encrypted: | false |
| SSDEEP: | 12288:iHEqYsrMWIqz473PTiPoH/aGhUgiW6QR7t5qv3Ooc8UHkC2eKq87:iH9YsIWIW4rPTiPofaDv3Ooc8UHkC2e8 |
| MD5: | 03E9314004F504A14A61C3D364B62F66 |
| SHA1: | 0AA3CAAC24FDF9D9D4C618E2BBF0A063036CD55D |
| SHA-256: | A3BA6421991241BEA9C8334B62C3088F8F131AB906C3CC52113945D05016A35F |
| SHA-512: | 2FCFF4439D2759D93C57D49B24F28AE89B7698E284E76AC65FE2B50BDEFC23A8CC3C83891D671DE4E4C0F036CEF810856DE79AC2B028AA89A895BF35ABFF8C8D |
| Malicious: | false |
| Antivirus: |
|
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-EVEH9.tmp\nHOMA2CalculatorWindowsSetup.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 770384 |
| Entropy (8bit): | 6.908020029901359 |
| Encrypted: | false |
| SSDEEP: | 12288:fQmCy3NeRjkpQmj3oaMtQqjoygfXq3kon9IlbgaOxQdVJJ6j5EBKX8hR5:ImCy3VQs9MtLjTgfa3kon9FaOdEz5 |
| MD5: | 67EC459E42D3081DD8FD34356F7CAFC1 |
| SHA1: | 1738050616169D5B17B5ADAC3FF0370B8C642734 |
| SHA-256: | 1221A09484964A6F38AF5E34EE292B9AFEFCCB3DC6E55435FD3AAF7C235D9067 |
| SHA-512: | 9ED1C106DF217E0B4E4FBD1F4275486CEBA1D8A225D6C7E47B854B0B5E6158135B81BE926F51DB0AD5C624F9BD1D09282332CF064680DC9F7D287073B9686D33 |
| Malicious: | false |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-EVEH9.tmp\nHOMA2CalculatorWindowsSetup.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2451091 |
| Entropy (8bit): | 5.974986593274922 |
| Encrypted: | false |
| SSDEEP: | 24576:oCtK8Huk1uOjBeEJx/WSWyaPSmdPoHL8xIpA1D4FiwLIiuJnO6QLqoWQsblUFjOu:/g1gJQS5GRqF |
| MD5: | E017A16D1C8F66C4383C585C3FD8C629 |
| SHA1: | 7ED7E28ED931A14C49C65661E9D85F3B70BC2BAF |
| SHA-256: | EF379292614A23ECD1F9A5CEA3C5F9DF7D104B0D9B3E464E10A354B12446D310 |
| SHA-512: | AD3F59080BE4D9969B21C2FE55A2A0543CE3FF43FAB5715DB4D0A35ABB283BE7235BAB11AAE443C9D1E70069822F8F72DA30DE44A0EC96DA1235B281D68988CE |
| Malicious: | false |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-EVEH9.tmp\nHOMA2CalculatorWindowsSetup.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 484352 |
| Entropy (8bit): | 4.669230713462755 |
| Encrypted: | false |
| SSDEEP: | 6144:rxEtjPOtioVjDGUU1qfDlavx+W/IE18lFxqgt6U52LmoyGdDxKHCJHN8v/2Wj4i/:jULZy27t8H2itbEQ |
| MD5: | 3B5DB63D1F0B800C6BC21DE84A645E02 |
| SHA1: | 42C2C9F5036221955E9D2379005107CC90964DA4 |
| SHA-256: | 23F499B333056E02B7320676977E1BA3715727CDF22C88293B5F9EA57B6ADF77 |
| SHA-512: | 83E6F86D674E0856BC253BE1DD31F69118A84452A5D910EEED09455E2704027E5DFA6B9E44B71B5B4E98FE85FB5C3ED88DE13A1C27B0A89550420FBBD41FC9B0 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-EVEH9.tmp\nHOMA2CalculatorWindowsSetup.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 69120 |
| Entropy (8bit): | 4.905119825579193 |
| Encrypted: | false |
| SSDEEP: | 1536:NRxEtjPOtioVjDGUU1qfDlaGGx+cL/IEt/D9dlOAGte9OO9UGps:PxEtjPOtioVjDGUU1qfDlaGGx+cL/IE+ |
| MD5: | 5D537B9B8DE399D605DD5F90ED0274C8 |
| SHA1: | 0F34B93DABE6AAE121F3C9394DDD53595275FB0B |
| SHA-256: | 1FA1FD95DE10971B51CFC975EBCD8ACE579D5651A4BC89F25FCF4D8CAF4D678B |
| SHA-512: | 1B7B9622119AA0BB6689DA31DEE3C47B647AF07444A620C80FB6106D830D4561892444FFB23192FCB0317F029D0B5C550161D95E8D81827F3A8F00E882AEE2CE |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-EVEH9.tmp\nHOMA2CalculatorWindowsSetup.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1481417 |
| Entropy (8bit): | 6.334218973634393 |
| Encrypted: | false |
| SSDEEP: | 24576:54VN4kkKF3hDXq8xeidJLvkU99kkkkJE58dlX3IiAtp3Nq3E/HoQYx96HtlYx9E9:CT90guMXEdqwHkUHoi |
| MD5: | DF3CE4F2359684D422140F1562BC973D |
| SHA1: | 67251A1E39AAA6D6CB78D800457A50C51A9216C0 |
| SHA-256: | B68644D189D47B405FC7251DA4733FE7417AD2D0096AE03657D7429D6BA69AB0 |
| SHA-512: | A9A0B19F5456F8EAD161164016A919C8C4FF811ABB4B35A1B53BB0856DBE09359EAD1FC1E9472778468F086E60B438324D72FD5E8133426094355497332492C4 |
| Malicious: | false |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-EVEH9.tmp\nHOMA2CalculatorWindowsSetup.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 69120 |
| Entropy (8bit): | 4.905119825579193 |
| Encrypted: | false |
| SSDEEP: | 1536:NRxEtjPOtioVjDGUU1qfDlaGGx+cL/IEt/D9dlOAGte9OO9UGps:PxEtjPOtioVjDGUU1qfDlaGGx+cL/IE+ |
| MD5: | 5D537B9B8DE399D605DD5F90ED0274C8 |
| SHA1: | 0F34B93DABE6AAE121F3C9394DDD53595275FB0B |
| SHA-256: | 1FA1FD95DE10971B51CFC975EBCD8ACE579D5651A4BC89F25FCF4D8CAF4D678B |
| SHA-512: | 1B7B9622119AA0BB6689DA31DEE3C47B647AF07444A620C80FB6106D830D4561892444FFB23192FCB0317F029D0B5C550161D95E8D81827F3A8F00E882AEE2CE |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-EVEH9.tmp\nHOMA2CalculatorWindowsSetup.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 484352 |
| Entropy (8bit): | 4.669230713462755 |
| Encrypted: | false |
| SSDEEP: | 6144:rxEtjPOtioVjDGUU1qfDlavx+W/IE18lFxqgt6U52LmoyGdDxKHCJHN8v/2Wj4i/:jULZy27t8H2itbEQ |
| MD5: | 3B5DB63D1F0B800C6BC21DE84A645E02 |
| SHA1: | 42C2C9F5036221955E9D2379005107CC90964DA4 |
| SHA-256: | 23F499B333056E02B7320676977E1BA3715727CDF22C88293B5F9EA57B6ADF77 |
| SHA-512: | 83E6F86D674E0856BC253BE1DD31F69118A84452A5D910EEED09455E2704027E5DFA6B9E44B71B5B4E98FE85FB5C3ED88DE13A1C27B0A89550420FBBD41FC9B0 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-EVEH9.tmp\nHOMA2CalculatorWindowsSetup.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2451091 |
| Entropy (8bit): | 5.974986593274922 |
| Encrypted: | false |
| SSDEEP: | 24576:oCtK8Huk1uOjBeEJx/WSWyaPSmdPoHL8xIpA1D4FiwLIiuJnO6QLqoWQsblUFjOu:/g1gJQS5GRqF |
| MD5: | E017A16D1C8F66C4383C585C3FD8C629 |
| SHA1: | 7ED7E28ED931A14C49C65661E9D85F3B70BC2BAF |
| SHA-256: | EF379292614A23ECD1F9A5CEA3C5F9DF7D104B0D9B3E464E10A354B12446D310 |
| SHA-512: | AD3F59080BE4D9969B21C2FE55A2A0543CE3FF43FAB5715DB4D0A35ABB283BE7235BAB11AAE443C9D1E70069822F8F72DA30DE44A0EC96DA1235B281D68988CE |
| Malicious: | false |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-EVEH9.tmp\nHOMA2CalculatorWindowsSetup.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 8059 |
| Entropy (8bit): | 3.610448044791127 |
| Encrypted: | false |
| SSDEEP: | 96:OdCv2ffc1AGlEDA4MZAe2LB9T16XHwRzUQWH/apadafakOIFCqC5CqdCqC/C8dCg:OFff7fDSmvi3pHo |
| MD5: | 067D093644353C912E15BBB236FCA922 |
| SHA1: | 26950089B402C93B0C2EE6F8FD1C05CE5F4085F7 |
| SHA-256: | 6552EC34E289423229C4983164DBAB36C21D8463D27462C2C724E8C04126A61F |
| SHA-512: | 959D19A0DF114DA5024CACBEE62DD4570353E84CBA2E75F5E585B49D7388FA55B65C2F6E54132CA06221BDD53987C88F6ED9945A6172F7063703F03350392285 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-EVEH9.tmp\nHOMA2CalculatorWindowsSetup.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1481417 |
| Entropy (8bit): | 6.334218973634393 |
| Encrypted: | false |
| SSDEEP: | 24576:54VN4kkKF3hDXq8xeidJLvkU99kkkkJE58dlX3IiAtp3Nq3E/HoQYx96HtlYx9E9:CT90guMXEdqwHkUHoi |
| MD5: | DF3CE4F2359684D422140F1562BC973D |
| SHA1: | 67251A1E39AAA6D6CB78D800457A50C51A9216C0 |
| SHA-256: | B68644D189D47B405FC7251DA4733FE7417AD2D0096AE03657D7429D6BA69AB0 |
| SHA-512: | A9A0B19F5456F8EAD161164016A919C8C4FF811ABB4B35A1B53BB0856DBE09359EAD1FC1E9472778468F086E60B438324D72FD5E8133426094355497332492C4 |
| Malicious: | false |
| Antivirus: |
|
| Preview: |
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HOMA Calculator v2.2.3\HOMA Calculator on the Web.lnk
Download File
| Process: | C:\Users\user\AppData\Local\Temp\is-EVEH9.tmp\nHOMA2CalculatorWindowsSetup.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 717 |
| Entropy (8bit): | 3.0375241729531046 |
| Encrypted: | false |
| SSDEEP: | 6:4xtCl0/w0Ml//A9LY/dlrt4lX6K/H/llkzuLkbdlrd9H7X39LF0bdlrd9H//:8wl040kXXdpOX6KVCtbdpdpIbdpd1 |
| MD5: | 91C51EEAC9CF8D7635D1698999A8885B |
| SHA1: | A0048F6A39D00162B64586CCBDEEC1805FB60126 |
| SHA-256: | 3FC82E74378A781143FDE6C347BD2DCFF79E12ED1BA33E042A3C85E419970767 |
| SHA-512: | B6464C9EA4087EC89D650B670435EC60405647D716FAC194010B540CCEA97B08C2CF892BA5CDB7E0B33B757CCEEBFECCF978DCB23316E794B11E9D4ED0F4B2EF |
| Malicious: | false |
| Preview: |
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HOMA Calculator v2.2.3\HOMA Calculator v2.2.3 (Excel).lnk
Download File
| Process: | C:\Users\user\AppData\Local\Temp\is-EVEH9.tmp\nHOMA2CalculatorWindowsSetup.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1006 |
| Entropy (8bit): | 4.510389234843017 |
| Encrypted: | false |
| SSDEEP: | 12:8mel/s9YXHo1h9ehacdpF48H1qMKP+p1KjAmYbdpdpGbdpd8DhmV:8m6/Po0pdv1qLWAAPdzpidz81m |
| MD5: | 0D49A3D3A231DCC975540D6113B37B50 |
| SHA1: | 952E72156CDB457B86840FDD8FE1946BA6319114 |
| SHA-256: | 257780AF8A866092BFC568EB346514F578F3E4A4C768589240E6BE8D09B1F15D |
| SHA-512: | 4FA07064281EDB51DA5A743DAA428045D039335D7D913A6492FBD9D9E97DF8ED77529CC236A078D73A20967AA08DDB7ECAF4E573300C49BC38F914F76D8F1A41 |
| Malicious: | false |
| Preview: |
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HOMA Calculator v2.2.3\HOMA Calculator v2.2.3 Validation (Excel).lnk
Download File
| Process: | C:\Users\user\AppData\Local\Temp\is-EVEH9.tmp\nHOMA2CalculatorWindowsSetup.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1061 |
| Entropy (8bit): | 4.533535959934583 |
| Encrypted: | false |
| SSDEEP: | 12:8mHFs1/YXHo1h9ehacdpF48H1qMKPs0y7yLHAjAl7xNobdpdp5zbdpd8hrmV:8mHmOo0pdv1qLUSUA1xedzpBdz8Zm |
| MD5: | 093A8370945A1E0165F655751B7CD5DB |
| SHA1: | ACD1D07D6957281618CE9BF4F08606B49A1F9A23 |
| SHA-256: | B3F40EADCE3F227A34BAE84958B4B54C8BC5107BF66978587F49CED663D20781 |
| SHA-512: | 5D817C6AD7ED4219C6308A1EB6AA2B0DBC18CD797F09437235A7EE24D49A52A49170E2DEF4BA7D8F7311F86175DDFCEFA118B97A7A47D32D11CE7819104A8A60 |
| Malicious: | false |
| Preview: |
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HOMA Calculator v2.2.3\HOMA Calculator v2.2.3.lnk
Download File
| Process: | C:\Users\user\AppData\Local\Temp\is-EVEH9.tmp\nHOMA2CalculatorWindowsSetup.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1011 |
| Entropy (8bit): | 4.551982565885238 |
| Encrypted: | false |
| SSDEEP: | 12:8mVrq5RYXIh9BtnKjbdpF48H1qMKPQ3gwgtYjAzNDebdpdp2obdpd8JDmV:8mK1ibdv1qLGg8ARWdzp28dz8pm |
| MD5: | C46871EB72E8D3EC1E1CA7644942024F |
| SHA1: | DC520920106E72D19B8E77E4D7BD281EDB200AE2 |
| SHA-256: | 1FB8EFC1771276AB27006E37E13DF69394502708AC4F831E2271BBE69F967F26 |
| SHA-512: | CE87741BD05AFEC7443F531224CD4236AB697DDEDF8A7D004A8E1B6E5399D17B992DFF22CCA1BDF82398F4F56B9D58F22E220DB2E66AF717C190C067843EF197 |
| Malicious: | false |
| Preview: |
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HOMA Calculator v2.2.3\Uninstall HOMA Calculator.lnk
Download File
| Process: | C:\Users\user\AppData\Local\Temp\is-EVEH9.tmp\nHOMA2CalculatorWindowsSetup.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 971 |
| Entropy (8bit): | 4.570646314775607 |
| Encrypted: | false |
| SSDEEP: | 12:8mNE7YXHo1h9ehacdpF48H1qMKPYFZ4OHqGOjALDL7Rkbdpd0Wbdpd8VPmV:8mzo0pdv1qLwF3K1A/L7Rwdz0Sdz8Rm |
| MD5: | 5AEBE9C90F62573C4AC89D70A4CBC1F9 |
| SHA1: | 17AB2206AAF6857D17EDF902719E873CAB6065FA |
| SHA-256: | 76226FB4B1CB0D52B8D8A254A39D4B8967F0E9BBFDFB6924BD00EDA9505E84C0 |
| SHA-512: | 04ACEA8DACA85167F6D8FD32839C058916F0A6C32BD26F09AC904F1E710CA942A1447502D3B30C33E5A63B2873F070944F09BAE28EFA2D76CFCE06C50A3B7946 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-EVEH9.tmp\nHOMA2CalculatorWindowsSetup.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 6144 |
| Entropy (8bit): | 4.289297026665552 |
| Encrypted: | false |
| SSDEEP: | 48:Sv1LfWvPcXegCPUo1vlZQrAxoONfHFZONfH3d1xCWMBFNL2pGSS4k+bkg6j0KHc:wfkcXegaJ/ZAYNzcld1xaX12pfSKvkc |
| MD5: | C8871EFD8AF2CF4D9D42D1FF8FADBF89 |
| SHA1: | D0EACD5322C036554D509C7566F0BCC7607209BD |
| SHA-256: | E4FC574A01B272C2D0AED0EC813F6D75212E2A15A5F5C417129DD65D69768F40 |
| SHA-512: | 2735BB610060F749E26ACD86F2DF2B8A05F2BDD3DCCF3E4B2946EBB21BA0805FB492C474B1EEB2C5B8BF1A421F7C1B8728245F649C644F4A9ECC5BD8770A16F6 |
| Malicious: | false |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-EVEH9.tmp\nHOMA2CalculatorWindowsSetup.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 23312 |
| Entropy (8bit): | 4.596242908851566 |
| Encrypted: | false |
| SSDEEP: | 384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4 |
| MD5: | 92DC6EF532FBB4A5C3201469A5B5EB63 |
| SHA1: | 3E89FF837147C16B4E41C30D6C796374E0B8E62C |
| SHA-256: | 9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87 |
| SHA-512: | 9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3 |
| Malicious: | false |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\Desktop\nHOMA2CalculatorWindowsSetup.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1458688 |
| Entropy (8bit): | 6.353878555914344 |
| Encrypted: | false |
| SSDEEP: | 24576:h4VN4kkKF3hDXq8xeidJLvkU99kkkkJE58dlX3IiAtp3Nq3E/HoQYx96HtlYx9EG:qT90guMXEdqwHkUHoD |
| MD5: | 2703D25D95D502EC71ADE55C81145A03 |
| SHA1: | 251AD391F81D78383C3E8A656CA7FFF464D21822 |
| SHA-256: | 7107DE2DCD8AC439737D069B7111A52EECCD501E77CBAA1EF5DE9538434BC104 |
| SHA-512: | D171A450C3F2A2E78D87EB652FFFC52C0011C213546F8A7857D9E20C4AFD0EAD53ABD265599985C3E328F4747D47AC65C99E28115C758A318A1DA7525A47439F |
| Malicious: | false |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-EVEH9.tmp\nHOMA2CalculatorWindowsSetup.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 282624 |
| Entropy (8bit): | 5.634157218054538 |
| Encrypted: | false |
| SSDEEP: | 6144:5V7amW0cAirt938u5AO9O73c/9jUweuAmlQB:5V7DSpt8u5eQ/9jJ |
| MD5: | F9A7715D195327E6990004F78B5E348D |
| SHA1: | A2E6A63633C563792D872621A8C39FD1075A0ED4 |
| SHA-256: | F95C717BBA02DA5BDE1E8E16B7192D71EF664850311BE2B7C3ED4C2C66C5CFA1 |
| SHA-512: | BB2EA8A5548CC512965616680DEC7D273380207ED40B0BC8175D6A642D910B958B6A652F255116338DB164BA49673DDD541863A8F8E8CB2964E32FD59A051378 |
| Malicious: | false |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-EVEH9.tmp\nHOMA2CalculatorWindowsSetup.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 282624 |
| Entropy (8bit): | 5.634157218054538 |
| Encrypted: | false |
| SSDEEP: | 6144:5V7amW0cAirt938u5AO9O73c/9jUweuAmlQB:5V7DSpt8u5eQ/9jJ |
| MD5: | F9A7715D195327E6990004F78B5E348D |
| SHA1: | A2E6A63633C563792D872621A8C39FD1075A0ED4 |
| SHA-256: | F95C717BBA02DA5BDE1E8E16B7192D71EF664850311BE2B7C3ED4C2C66C5CFA1 |
| SHA-512: | BB2EA8A5548CC512965616680DEC7D273380207ED40B0BC8175D6A642D910B958B6A652F255116338DB164BA49673DDD541863A8F8E8CB2964E32FD59A051378 |
| Malicious: | false |
| Antivirus: |
|
| Preview: |
| File type: | |
| Entropy (8bit): | 7.8149190604946845 |
| TrID: |
|
| File name: | nHOMA2CalculatorWindowsSetup.exe |
| File size: | 2'338'251 bytes |
| MD5: | f89876113397eab218fb197d549903ac |
| SHA1: | 23bc6f72adccb9f5577ff939b8501e488fd8834b |
| SHA256: | 3308fbc9f79869fdda63dc3d911b1c300518db7a04fe4e0591307b3f29094350 |
| SHA512: | 2d7b96391495b4b5a0febc3035e2fc3bcfa10cd4c482df5d59a68545ed5a3e0d55434cff8a0ffb3522cbf290a9756cd3f6ba9d140f59d04f3363b39e73d9af6b |
| SSDEEP: | 49152:2XZrb6pbEI2o8QkLVCCI/OwPoyDb6Rpyktxo08oB0JT3F:AF6p0HTLVm1F6vyL0HBu3F |
| TLSH: | 74B5AB26E692C525F97096FEC5E264FC0A257E30CFB642075FECBE2D33B47425829612 |
| File Content Preview: | MZP.....................@...............................................!..L.!..This program must be run under Win32..$7....................................................................................................................................... |
 | |
| Icon Hash: | bdace9e969698755 |
| Entrypoint: | 0x4113bc |
| Entrypoint Section: | .itext |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI |
| DLL Characteristics: | TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x51092C84 [Wed Jan 30 14:21:56 2013 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 5 |
| OS Version Minor: | 0 |
| File Version Major: | 5 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 5 |
| Subsystem Version Minor: | 0 |
| Import Hash: | 48aa5c8931746a9655524f67b25a47ef |
| Instruction |
|---|
| push ebp |
| mov ebp, esp |
| add esp, FFFFFFA4h |
| push ebx |
| push esi |
| push edi |
| xor eax, eax |
| mov dword ptr [ebp-3Ch], eax |
| mov dword ptr [ebp-40h], eax |
| mov dword ptr [ebp-5Ch], eax |
| mov dword ptr [ebp-30h], eax |
| mov dword ptr [ebp-38h], eax |
| mov dword ptr [ebp-34h], eax |
| mov dword ptr [ebp-2Ch], eax |
| mov dword ptr [ebp-28h], eax |
| mov dword ptr [ebp-14h], eax |
| mov eax, 0041002Ch |
| call 00007F534CB2AF0Dh |
| xor eax, eax |
| push ebp |
| push 00411A9Eh |
| push dword ptr fs:[eax] |
| mov dword ptr fs:[eax], esp |
| xor edx, edx |
| push ebp |
| push 00411A5Ah |
| push dword ptr fs:[edx] |
| mov dword ptr fs:[edx], esp |
| mov eax, dword ptr [00415B48h] |
| call 00007F534CB3353Bh |
| call 00007F534CB3308Ah |
| cmp byte ptr [00412ADCh], 00000000h |
| je 00007F534CB35D2Eh |
| call 00007F534CB33650h |
| xor eax, eax |
| call 00007F534CB28FA5h |
| lea edx, dword ptr [ebp-14h] |
| xor eax, eax |
| call 00007F534CB30107h |
| mov edx, dword ptr [ebp-14h] |
| mov eax, 00418650h |
| call 00007F534CB2957Ah |
| push 00000002h |
| push 00000000h |
| push 00000001h |
| mov ecx, dword ptr [00418650h] |
| mov dl, 01h |
| mov eax, dword ptr [0040BF3Ch] |
| call 00007F534CB309F2h |
| mov dword ptr [00418654h], eax |
| xor edx, edx |
| push ebp |
| push 00411A06h |
| push dword ptr fs:[edx] |
| mov dword ptr fs:[edx], esp |
| call 00007F534CB335AEh |
| mov dword ptr [0041865Ch], eax |
| mov eax, dword ptr [0041865Ch] |
| cmp dword ptr [eax+0Ch], 01h |
| jne 00007F534CB35D6Ah |
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x19000 | 0xdd0 | .idata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x1c000 | 0x51624 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x1b000 | 0x18 | .rdata |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x192fc | 0x20c | .idata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0xf12c | 0xf200 | 3a126e478661f20816f9d9285615f98e | False | 0.550910382231405 | data | 6.391482648256754 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .itext | 0x11000 | 0xb44 | 0xc00 | ba48b9b17b3dd8b92da3bd93f20ddb34 | False | 0.5930989583333334 | data | 5.732070848969494 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .data | 0x12000 | 0xc88 | 0xe00 | d7fd5f4b562d7961758f3d6a8c834fd0 | False | 0.24832589285714285 | data | 2.246312806661135 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .bss | 0x13000 | 0x56b4 | 0x0 | d41d8cd98f00b204e9800998ecf8427e | False | 0 | empty | 0.0 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .idata | 0x19000 | 0xdd0 | 0xe00 | 93d91a2b90e60bd758fc0c4908856ae1 | False | 0.36439732142857145 | data | 4.97188203376719 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .tls | 0x1a000 | 0x8 | 0x0 | d41d8cd98f00b204e9800998ecf8427e | False | 0 | empty | 0.0 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rdata | 0x1b000 | 0x18 | 0x200 | 3dffc444ccc131c9dcee18db49ee6403 | False | 0.05078125 | data | 0.2044881574398449 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .rsrc | 0x1c000 | 0x51624 | 0x51800 | 39b347088fece1ecdb11f649b74f76bb | False | 0.11235860812883436 | data | 5.256977703275042 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_ICON | 0x1c4ac | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 0 | English | United States | 0.267590618336887 |
| RT_ICON | 0x1d354 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 0 | English | United States | 0.3316787003610108 |
| RT_ICON | 0x1dbfc | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 0 | English | United States | 0.38078034682080925 |
| RT_ICON | 0x1e164 | 0x42028 | Device independent bitmap graphic, 256 x 512 x 32, image size 0 | English | United States | 0.08913143178388615 |
| RT_ICON | 0x6018c | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 0 | English | United States | 0.2936721991701245 |
| RT_ICON | 0x62734 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 0 | English | United States | 0.3808630393996248 |
| RT_ICON | 0x637dc | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 0 | English | United States | 0.5904255319148937 |
| RT_STRING | 0x63c44 | 0x68 | data | 0.6538461538461539 | ||
| RT_STRING | 0x63cac | 0xd4 | data | 0.5283018867924528 | ||
| RT_STRING | 0x63d80 | 0xa4 | data | 0.6524390243902439 | ||
| RT_STRING | 0x63e24 | 0x2ac | data | 0.45614035087719296 | ||
| RT_STRING | 0x640d0 | 0x34c | data | 0.4218009478672986 | ||
| RT_STRING | 0x6441c | 0x294 | data | 0.4106060606060606 | ||
| RT_RCDATA | 0x646b0 | 0x82e8 | data | English | United States | 0.11261637622344235 |
| RT_RCDATA | 0x6c998 | 0x10 | data | 1.5 | ||
| RT_RCDATA | 0x6c9a8 | 0x150 | data | 0.8333333333333334 | ||
| RT_RCDATA | 0x6caf8 | 0x2c | data | 1.1818181818181819 | ||
| RT_GROUP_ICON | 0x6cb24 | 0x68 | data | English | United States | 0.6826923076923077 |
| RT_VERSION | 0x6cb8c | 0x4f4 | data | English | United States | 0.2752365930599369 |
| RT_MANIFEST | 0x6d080 | 0x5a4 | XML 1.0 document, ASCII text, with CRLF line terminators | English | United States | 0.42590027700831024 |
| DLL | Import |
|---|---|
| oleaut32.dll | SysFreeString, SysReAllocStringLen, SysAllocStringLen |
| advapi32.dll | RegQueryValueExW, RegOpenKeyExW, RegCloseKey |
| user32.dll | GetKeyboardType, LoadStringW, MessageBoxA, CharNextW |
| kernel32.dll | GetACP, Sleep, VirtualFree, VirtualAlloc, GetSystemInfo, GetTickCount, QueryPerformanceCounter, GetVersion, GetCurrentThreadId, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenW, lstrcpynW, LoadLibraryExW, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetLocaleInfoW, GetCommandLineW, FreeLibrary, FindFirstFileW, FindClose, ExitProcess, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle, CloseHandle |
| kernel32.dll | TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleW |
| user32.dll | CreateWindowExW, TranslateMessage, SetWindowLongW, PeekMessageW, MsgWaitForMultipleObjects, MessageBoxW, LoadStringW, GetSystemMetrics, ExitWindowsEx, DispatchMessageW, DestroyWindow, CharUpperBuffW, CallWindowProcW |
| kernel32.dll | WriteFile, WideCharToMultiByte, WaitForSingleObject, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, SizeofResource, SignalObjectAndWait, SetLastError, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, RemoveDirectoryW, ReadFile, MultiByteToWideChar, LockResource, LoadResource, LoadLibraryW, GetWindowsDirectoryW, GetVersionExW, GetUserDefaultLangID, GetThreadLocale, GetSystemInfo, GetStdHandle, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetLocaleInfoW, GetLastError, GetFullPathNameW, GetFileSize, GetFileAttributesW, GetExitCodeProcess, GetEnvironmentVariableW, GetDiskFreeSpaceW, GetCurrentProcess, GetCommandLineW, GetCPInfo, InterlockedExchange, InterlockedCompareExchange, FreeLibrary, FormatMessageW, FindResourceW, EnumCalendarInfoW, DeleteFileW, CreateProcessW, CreateFileW, CreateEventW, CreateDirectoryW, CloseHandle |
| advapi32.dll | RegQueryValueExW, RegOpenKeyExW, RegCloseKey, OpenProcessToken, LookupPrivilegeValueW |
| comctl32.dll | InitCommonControls |
| kernel32.dll | Sleep |
| advapi32.dll | AdjustTokenPrivileges |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | United States |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node⊘No network behavior found
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 15:02:01 |
| Start date: | 20/10/2024 |
| Path: | C:\Users\user\Desktop\nHOMA2CalculatorWindowsSetup.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 2'338'251 bytes |
| MD5 hash: | F89876113397EAB218FB197D549903AC |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | Borland Delphi |
| Reputation: | low |
| Has exited: | true |
| Target ID: | 2 |
| Start time: | 15:02:01 |
| Start date: | 20/10/2024 |
| Path: | C:\Users\user\AppData\Local\Temp\is-EVEH9.tmp\nHOMA2CalculatorWindowsSetup.tmp |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 1'458'688 bytes |
| MD5 hash: | 2703D25D95D502EC71ADE55C81145A03 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | Borland Delphi |
| Antivirus matches: |
|
| Reputation: | low |
| Has exited: | true |
| Target ID: | 4 |
| Start time: | 15:02:21 |
| Start date: | 20/10/2024 |
| Path: | C:\Windows\SysWOW64\regsvr32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x970000 |
| File size: | 20'992 bytes |
| MD5 hash: | 878E47C8656E53AE8A8A21E927C6F7E0 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 5 |
| Start time: | 15:02:23 |
| Start date: | 20/10/2024 |
| Path: | C:\Program Files\HOMA Calculator v2.2.3\HOMA2 Calculator.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0xfc0000 |
| File size: | 2'451'091 bytes |
| MD5 hash: | E017A16D1C8F66C4383C585C3FD8C629 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Has exited: | false |
Execution Graph
| Execution Coverage: | 0.3% |
| Dynamic/Decrypted Code Coverage: | 0% |
| Signature Coverage: | 12.7% |
| Total number of Nodes: | 308 |
| Total number of Limit Nodes: | 14 |
Graph
Function 00FC1000 Relevance: 51.0, APIs: 20, Strings: 9, Instructions: 276libraryloaderCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8802C1 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 53COMMONLIBRARYCODE
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C880233 Relevance: 12.1, APIs: 8, Instructions: 60memoryCOMMONLIBRARYCODE
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00FC1380 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41windowCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C880B4E Relevance: 4.6, APIs: 3, Instructions: 54memoryCOMMONLIBRARYCODE
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C88014E Relevance: 4.5, APIs: 3, Instructions: 23memoryCOMMONLIBRARYCODE
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8CA3DD Relevance: 98.2, APIs: 38, Strings: 18, Instructions: 204libraryloaderCOMMONLIBRARYCODE
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C89457E Relevance: 90.4, APIs: 37, Strings: 14, Instructions: 1146COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8BBE38 Relevance: 61.6, APIs: 31, Strings: 4, Instructions: 336libraryloaderCOMMONLIBRARYCODE
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8962FC Relevance: 40.8, APIs: 27, Instructions: 271stringtimeCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C887270 Relevance: 33.7, APIs: 18, Strings: 1, Instructions: 491COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8873B4 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 56stringCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8843A6 Relevance: 12.2, APIs: 8, Instructions: 223COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8FC097 Relevance: 10.6, APIs: 7, Instructions: 54COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C88750C Relevance: 7.6, APIs: 5, Instructions: 91COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8874D0 Relevance: 6.1, APIs: 4, Instructions: 113COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8BECCD Relevance: 2.7, Strings: 2, Instructions: 248COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8A0919 Relevance: 2.1, APIs: 1, Instructions: 645COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C89911E Relevance: 1.8, APIs: 1, Instructions: 294COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C887093 Relevance: .5, Instructions: 489COMMONLIBRARYCODE
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C886B28 Relevance: .3, Instructions: 345COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8863C9 Relevance: .3, Instructions: 331COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C886018 Relevance: .3, Instructions: 327COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C885C2C Relevance: .1, Instructions: 95COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C885C30 Relevance: .1, Instructions: 94COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8871A3 Relevance: .1, Instructions: 90COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8721F0 Relevance: .1, Instructions: 76COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C87F680 Relevance: .0, Instructions: 24COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8933B8 Relevance: 54.6, APIs: 30, Strings: 1, Instructions: 367COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C88DD9D Relevance: 47.5, APIs: 9, Strings: 18, Instructions: 277COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C89022F Relevance: 47.0, APIs: 31, Instructions: 498fileCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C893687 Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 186COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C895276 Relevance: 40.7, APIs: 20, Strings: 3, Instructions: 455COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00FC2BFF Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 109libraryloadermemoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C88B398 Relevance: 38.6, APIs: 17, Strings: 5, Instructions: 110libraryloadermemoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8854B9 Relevance: 34.8, APIs: 23, Instructions: 295COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8926C3 Relevance: 34.7, APIs: 23, Instructions: 213COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8FCFB3 Relevance: 34.7, APIs: 23, Instructions: 201stringCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8D254F Relevance: 31.6, APIs: 17, Strings: 1, Instructions: 116COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8C97E4 Relevance: 28.7, APIs: 19, Instructions: 201COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C88F9A4 Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 233COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8CA890 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 188threadCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8BBAE2 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 111memorylibraryloaderCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8FB03A Relevance: 25.7, APIs: 17, Instructions: 163COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8B7862 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 247timeCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C88F334 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 238COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8BC337 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 224COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8FECDB Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 185stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8BBD35 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 63libraryloaderCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8C7403 Relevance: 24.5, APIs: 7, Strings: 7, Instructions: 49libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8858A9 Relevance: 24.2, APIs: 16, Instructions: 234stringCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C89373E Relevance: 24.2, APIs: 16, Instructions: 198processsynchronizationCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8BFC51 Relevance: 24.1, APIs: 16, Instructions: 111memoryCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C88C737 Relevance: 23.0, APIs: 9, Strings: 4, Instructions: 223COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8D3913 Relevance: 23.0, APIs: 9, Strings: 4, Instructions: 216COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8BB87B Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 115libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8F3EE9 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 73stringCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C887F86 Relevance: 21.3, APIs: 14, Instructions: 349COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C88F4EC Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 98COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C894F02 Relevance: 19.6, APIs: 13, Instructions: 147stringCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8849C8 Relevance: 19.6, APIs: 13, Instructions: 140stringCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8FFF22 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 182stringCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C88F805 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 127COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C88B58E Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 95COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C88F608 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 83COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C88826F Relevance: 16.7, APIs: 11, Instructions: 193COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C88AC1E Relevance: 16.6, APIs: 11, Instructions: 119COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8FBEED Relevance: 16.6, APIs: 11, Instructions: 95COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8DA398 Relevance: 15.1, APIs: 10, Instructions: 116timeCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8D9487 Relevance: 15.1, APIs: 10, Instructions: 110timeCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8C7566 Relevance: 15.1, APIs: 10, Instructions: 94COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8C8FD6 Relevance: 15.1, APIs: 10, Instructions: 89COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8CABC4 Relevance: 15.1, APIs: 10, Instructions: 80librarythreadCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8FC2BC Relevance: 15.1, APIs: 10, Instructions: 72COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C882ADB Relevance: 15.1, APIs: 10, Instructions: 70memoryCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C88DEAC Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 171COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8C5672 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 77COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C88AD86 Relevance: 13.7, APIs: 9, Instructions: 200COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8DF37F Relevance: 13.7, APIs: 9, Instructions: 185stringCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8C1519 Relevance: 13.6, APIs: 9, Instructions: 122COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8BD988 Relevance: 13.6, APIs: 9, Instructions: 75COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C88D963 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 189COMMONLIBRARYCODE
Download Yara Rule
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C885489 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 116stringCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8F53FD Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 109stringCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8DC480 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C882719 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 91COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C881860 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C894D6D Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 77COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C884DDA Relevance: 12.2, APIs: 8, Instructions: 175stringCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8C8425 Relevance: 12.1, APIs: 8, Instructions: 111synchronizationthreadCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C896D24 Relevance: 12.1, APIs: 8, Instructions: 100COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C884B95 Relevance: 12.1, APIs: 8, Instructions: 97stringCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8D69CE Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C88B2A9 Relevance: 12.1, APIs: 8, Instructions: 86stringCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C896C6B Relevance: 12.1, APIs: 8, Instructions: 78COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C880698 Relevance: 12.0, APIs: 8, Instructions: 46threadCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C873F80 Relevance: 10.7, APIs: 7, Instructions: 186COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8917C4 Relevance: 10.6, APIs: 7, Instructions: 148COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C88DE57 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 140COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8BC6A4 Relevance: 10.6, APIs: 7, Instructions: 103COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8C7BBB Relevance: 10.6, APIs: 7, Instructions: 102synchronizationCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8D3483 Relevance: 10.6, APIs: 7, Instructions: 102COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C9006C8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 97COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8B880C Relevance: 10.6, APIs: 7, Instructions: 87threadCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C88E5C8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 76COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8C349E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 74threadCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C894C10 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 70COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8C9FD5 Relevance: 10.6, APIs: 7, Instructions: 68synchronizationsleeptimeCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8C6AE6 Relevance: 10.6, APIs: 7, Instructions: 67COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8B8AC4 Relevance: 10.6, APIs: 7, Instructions: 65threadCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C891712 Relevance: 10.6, APIs: 7, Instructions: 57COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8BFC0E Relevance: 10.6, APIs: 7, Instructions: 56COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C894544 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8DAB00 Relevance: 10.5, APIs: 7, Instructions: 47COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8DA04B Relevance: 10.5, APIs: 7, Instructions: 47COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8DB393 Relevance: 10.5, APIs: 7, Instructions: 47COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8DB31A Relevance: 10.5, APIs: 7, Instructions: 47COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00FC2989 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8B8BCC Relevance: 10.5, APIs: 7, Instructions: 38threadCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8F40E0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 37COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8CEACE Relevance: 10.5, APIs: 7, Instructions: 35COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8D048F Relevance: 10.5, APIs: 7, Instructions: 35COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8FF612 Relevance: 9.3, APIs: 6, Instructions: 261COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8B9F09 Relevance: 9.1, APIs: 6, Instructions: 148threadCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C917538 Relevance: 9.1, APIs: 6, Instructions: 140COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C917387 Relevance: 9.1, APIs: 6, Instructions: 135COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8C6561 Relevance: 9.1, APIs: 6, Instructions: 89synchronizationtimeCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8BFA23 Relevance: 9.1, APIs: 6, Instructions: 74COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8C3BA6 Relevance: 9.1, APIs: 6, Instructions: 74COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8BD8E1 Relevance: 9.1, APIs: 6, Instructions: 60COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8FCCC1 Relevance: 9.1, APIs: 6, Instructions: 56COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8FCD4A Relevance: 9.1, APIs: 6, Instructions: 56COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C88FB0D Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 206COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C881AB5 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 178COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C90008A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C888ED9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 82COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8CACEA Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74threadCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C88498E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8B7406 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51timeCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C88BAF9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C88215F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8C5914 Relevance: 7.8, APIs: 5, Instructions: 273COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C873DF0 Relevance: 7.7, APIs: 5, Instructions: 160COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8E0446 Relevance: 7.6, APIs: 5, Instructions: 117stringCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8E0D54 Relevance: 7.6, APIs: 5, Instructions: 111stringCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8C6C9D Relevance: 7.6, APIs: 5, Instructions: 106COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8CB25E Relevance: 7.6, APIs: 5, Instructions: 100COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8968D9 Relevance: 7.6, APIs: 5, Instructions: 85COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C9176F9 Relevance: 7.6, APIs: 5, Instructions: 78COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8F8A30 Relevance: 7.6, APIs: 5, Instructions: 71COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8C2FB8 Relevance: 7.6, APIs: 5, Instructions: 69COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8DC90A Relevance: 7.6, APIs: 5, Instructions: 67COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8DD387 Relevance: 7.6, APIs: 5, Instructions: 66COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8975B1 Relevance: 7.6, APIs: 5, Instructions: 63COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C892904 Relevance: 7.6, APIs: 5, Instructions: 60COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C88C830 Relevance: 7.6, APIs: 5, Instructions: 59COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C893164 Relevance: 7.6, APIs: 5, Instructions: 52COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8CC86F Relevance: 7.6, APIs: 5, Instructions: 50COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8C780F Relevance: 7.6, APIs: 5, Instructions: 50COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8C7DF8 Relevance: 7.5, APIs: 5, Instructions: 49COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8C7A84 Relevance: 7.5, APIs: 5, Instructions: 49COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C881C13 Relevance: 7.5, APIs: 5, Instructions: 48COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8C0EF9 Relevance: 7.5, APIs: 5, Instructions: 45COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C88AA88 Relevance: 7.5, APIs: 5, Instructions: 44COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8FE3B8 Relevance: 7.5, APIs: 5, Instructions: 44COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C892F0F Relevance: 7.5, APIs: 5, Instructions: 41COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8BF2B7 Relevance: 7.5, APIs: 5, Instructions: 41COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8FED88 Relevance: 7.5, APIs: 5, Instructions: 40stringCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8DA0C4 Relevance: 7.5, APIs: 5, Instructions: 40COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8DB0EC Relevance: 7.5, APIs: 5, Instructions: 40COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8DAFF1 Relevance: 7.5, APIs: 5, Instructions: 37COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8BBCC9 Relevance: 7.5, APIs: 5, Instructions: 37threadCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8D91AF Relevance: 7.5, APIs: 5, Instructions: 37COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8BB795 Relevance: 7.5, APIs: 5, Instructions: 35COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8D3E1C Relevance: 7.5, APIs: 5, Instructions: 34COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8C007C Relevance: 7.5, APIs: 5, Instructions: 32memorythreadCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8C324B Relevance: 7.5, APIs: 5, Instructions: 32COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C88DAD9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8F3E6C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8D72B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C884202 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C890A05 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8F3F34 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8FE9F4 Relevance: 6.3, APIs: 4, Instructions: 279COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8846C1 Relevance: 6.3, APIs: 4, Instructions: 262COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C88B73E Relevance: 6.2, APIs: 4, Instructions: 160COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8C3CD0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8C389E Relevance: 6.1, APIs: 4, Instructions: 121COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8C0F74 Relevance: 6.1, APIs: 4, Instructions: 109COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8C85DB Relevance: 6.1, APIs: 4, Instructions: 108threadCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C87F6A8 Relevance: 6.1, APIs: 4, Instructions: 96COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C88489C Relevance: 6.1, APIs: 4, Instructions: 86COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C896D21 Relevance: 6.1, APIs: 4, Instructions: 85COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8BA7E0 Relevance: 6.1, APIs: 4, Instructions: 80COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8B7D24 Relevance: 6.1, APIs: 4, Instructions: 76timeCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C895FCE Relevance: 6.1, APIs: 4, Instructions: 76COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8CCB67 Relevance: 6.1, APIs: 4, Instructions: 72COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8C8EC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8CBFDC Relevance: 6.1, APIs: 4, Instructions: 70COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8DB84F Relevance: 6.1, APIs: 4, Instructions: 70COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8C0B09 Relevance: 6.1, APIs: 4, Instructions: 69COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8C8719 Relevance: 6.1, APIs: 4, Instructions: 68threadCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C88CD87 Relevance: 6.1, APIs: 4, Instructions: 64COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C88F300 Relevance: 6.1, APIs: 4, Instructions: 64COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8C222C Relevance: 6.1, APIs: 4, Instructions: 62COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8B90E6 Relevance: 6.1, APIs: 4, Instructions: 62COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C88F2FC Relevance: 6.1, APIs: 4, Instructions: 61COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8C6750 Relevance: 6.1, APIs: 4, Instructions: 60COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8B933A Relevance: 6.1, APIs: 4, Instructions: 60COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8C575B Relevance: 6.1, APIs: 4, Instructions: 59COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8C218F Relevance: 6.1, APIs: 4, Instructions: 56COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8923EC Relevance: 6.1, APIs: 4, Instructions: 54COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C887F02 Relevance: 6.0, APIs: 4, Instructions: 50COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8CAAC5 Relevance: 6.0, APIs: 4, Instructions: 49COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8B8C86 Relevance: 6.0, APIs: 4, Instructions: 47COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8B874F Relevance: 6.0, APIs: 4, Instructions: 47COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8C7EE6 Relevance: 6.0, APIs: 4, Instructions: 47COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8B7DE5 Relevance: 6.0, APIs: 4, Instructions: 46timeCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C895B46 Relevance: 6.0, APIs: 4, Instructions: 45stringCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8C7A0E Relevance: 6.0, APIs: 4, Instructions: 44COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8C1664 Relevance: 6.0, APIs: 4, Instructions: 40COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8CAC51 Relevance: 6.0, APIs: 4, Instructions: 39threadCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8C81EA Relevance: 6.0, APIs: 4, Instructions: 37COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C89218C Relevance: 6.0, APIs: 4, Instructions: 36COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C89236E Relevance: 6.0, APIs: 4, Instructions: 36COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8C6E7A Relevance: 6.0, APIs: 4, Instructions: 35COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C880841 Relevance: 6.0, APIs: 4, Instructions: 35COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C892543 Relevance: 6.0, APIs: 4, Instructions: 35COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8B5C48 Relevance: 6.0, APIs: 4, Instructions: 35COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8915F6 Relevance: 6.0, APIs: 4, Instructions: 35COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8BC7DC Relevance: 6.0, APIs: 4, Instructions: 32COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C88CA89 Relevance: 6.0, APIs: 4, Instructions: 29COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8C7084 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8C71BD Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8D35DC Relevance: 6.0, APIs: 4, Instructions: 27COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C891868 Relevance: 6.0, APIs: 4, Instructions: 26COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8CB762 Relevance: 6.0, APIs: 4, Instructions: 20COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8FCB44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8D5FDC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8D5EC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C88380F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6C8F583C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|