Edit tour

Windows Analysis Report
FXdg37pY22.exe

Overview

General Information

Sample name:	FXdg37pY22.exe renamed because original name is a hash value
Original sample name:	558a2574865079a1c4d69350493310df.exe
Analysis ID:	1581380
MD5:	558a2574865079a1c4d69350493310df
SHA1:	e76374501315596dc32eebe8833cf1d8efeccba8
SHA256:	6c2b5ad84731b310763f541ff0b9e21b5dd698fba32e24e33dbed9278dd7b4c8
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC Stealer

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

FXdg37pY22.exe (PID: 428 cmdline: "C:\Users\user\Desktop\FXdg37pY22.exe" MD5: 558A2574865079A1C4D69350493310DF)

conhost.exe (PID: 6292 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": ["covery-mover.biz", "formy-spill.biz", "dare-curbys.biz", "impend-differ.biz", "dwell-exclaim.biz", "zinc-sneark.biz", "se-blurry.biz", "print-vexer.biz"], "Build id": "H8NgCl--modie"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T14:42:09.159152+0100	2028371	3	Unknown Traffic	192.168.2.5	49704	23.55.153.106	443	TCP
2024-12-27T14:42:11.735795+0100	2028371	3	Unknown Traffic	192.168.2.5	49705	104.21.66.86	443	TCP
2024-12-27T14:42:13.639065+0100	2028371	3	Unknown Traffic	192.168.2.5	49706	104.21.66.86	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T14:42:12.478038+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49705	104.21.66.86	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T14:42:12.478038+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49705	104.21.66.86	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T14:42:05.656321+0100	2057973	1	Domain Observed Used for C2 Detected	192.168.2.5	61076	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T14:42:06.865274+0100	2057975	1	Domain Observed Used for C2 Detected	192.168.2.5	59930	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T14:42:06.369553+0100	2057979	1	Domain Observed Used for C2 Detected	192.168.2.5	58300	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T14:42:06.629198+0100	2057977	1	Domain Observed Used for C2 Detected	192.168.2.5	55642	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T14:42:07.321388+0100	2057969	1	Domain Observed Used for C2 Detected	192.168.2.5	60132	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T14:42:07.084787+0100	2057971	1	Domain Observed Used for C2 Detected	192.168.2.5	58982	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T14:42:05.893053+0100	2057983	1	Domain Observed Used for C2 Detected	192.168.2.5	49211	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T14:42:06.133318+0100	2057981	1	Domain Observed Used for C2 Detected	192.168.2.5	60711	1.1.1.1	53	UDP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T14:42:09.967434+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.5	49704	23.55.153.106	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://lev-tolstoi.com/piRv	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/apiy	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/apido	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/apistr	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000003.2047331999.00000000019A1000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["covery-mover.biz", "formy-spill.biz", "dare-curbys.biz", "impend-differ.biz", "dwell-exclaim.biz", "zinc-sneark.biz", "se-blurry.biz", "print-vexer.biz"], "Build id": "H8NgCl--modie"}

Multi AV Scanner detection for submitted file

Source: FXdg37pY22.exe	Virustotal: Detection: 66%			Perma Link
Source: FXdg37pY22.exe	ReversingLabs: Detection: 82%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.2% probability

Machine Learning detection for sample

Source: FXdg37pY22.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000003.2047331999.00000000019A1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: impend-differ.biz
Source: 00000000.00000003.2047331999.00000000019A1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: print-vexer.biz
Source: 00000000.00000003.2047331999.00000000019A1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: dare-curbys.biz
Source: 00000000.00000003.2047331999.00000000019A1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: covery-mover.biz
Source: 00000000.00000003.2047331999.00000000019A1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: formy-spill.biz
Source: 00000000.00000003.2047331999.00000000019A1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: dwell-exclaim.biz
Source: 00000000.00000003.2047331999.00000000019A1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: zinc-sneark.biz
Source: 00000000.00000003.2047331999.00000000019A1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: se-blurry.biz
Source: 00000000.00000003.2047331999.00000000019A1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: covery-mover.biz
Source: 00000000.00000003.2047331999.00000000019A1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: impend-differ.biz
Source: 00000000.00000003.2047331999.00000000019A1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: print-vexer.biz
Source: 00000000.00000003.2047331999.00000000019A1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: dare-curbys.biz
Source: 00000000.00000003.2047331999.00000000019A1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: covery-mover.biz
Source: 00000000.00000003.2047331999.00000000019A1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: formy-spill.biz
Source: 00000000.00000003.2047331999.00000000019A1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: dwell-exclaim.biz
Source: 00000000.00000003.2047331999.00000000019A1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: zinc-sneark.biz
Source: 00000000.00000003.2047331999.00000000019A1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: se-blurry.biz
Source: 00000000.00000003.2047331999.00000000019A1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: covery-mover.biz
Source: 00000000.00000003.2047331999.00000000019A1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000003.2047331999.00000000019A1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000003.2047331999.00000000019A1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000003.2047331999.00000000019A1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000003.2047331999.00000000019A1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000003.2047331999.00000000019A1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: H8NgCl--modie

Source: FXdg37pY22.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.5:49705 version: TLS 1.2

Source: FXdg37pY22.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+05h]	0_2_0154A960
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then mov byte ptr [edx], bl	0_2_0154CE55
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then mov edx, ecx	0_2_01549CC0
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+79314A46h]	0_2_01566170
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-0BF7BDDDh]	0_2_01565F7D
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_0156A060
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then push eax	0_2_0154C36E
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then mov byte ptr [edi+ebx], 00000000h	0_2_0154C274
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then mov ecx, eax	0_2_01562270
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_015745F0
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_01560717
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then mov word ptr [ecx], dx	0_2_01560717
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	0_2_0156A630
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+36A27D27h]	0_2_0156C6D7
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then mov byte ptr [esi], al	0_2_0156C6D7
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+07540F19h]	0_2_0156C6D7
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+07540F19h]	0_2_0156C6D7
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_015686F0
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then cmp al, 2Eh	0_2_015666E7
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], 299A4ECDh	0_2_0157E690
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_015686F0
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi]	0_2_01542B70
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then movzx ebp, word ptr [ecx+ebx*2]	0_2_01576B20
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	0_2_0157CBD6
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	0_2_0156AAD0
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	0_2_0157CAC0
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	0_2_0157CD60
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	0_2_0157CCE0
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then add ebx, 03h	0_2_01568F5D
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then cmp dword ptr [ecx+edx*8], B430E561h	0_2_01554F08
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then mov ecx, edx	0_2_01554F08
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	0_2_0157CE00
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then movzx edi, byte ptr [esi+eax-000000BCh]	0_2_01556E97
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then mov edi, eax	0_2_01556E97
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then cmp word ptr [ebp+edx+02h], 0000h	0_2_0155CEA5
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then movzx edi, byte ptr [esi+eax-000000BCh]	0_2_01557190
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then mov edx, ecx	0_2_0155D074
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then mov edx, ecx	0_2_0155D087
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then mov byte ptr [esi], cl	0_2_0156D085
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then mov byte ptr [esi], cl	0_2_0156D085
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then movzx ebx, bx	0_2_0156536C
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then mov word ptr [ecx], dx	0_2_01567307
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then mov byte ptr [edi], bl	0_2_0156B3DE
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then mov byte ptr [edi], bl	0_2_0156B3DE
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then mov eax, dword ptr [01584284h]	0_2_01565230
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+1Ch]	0_2_015692D0
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then mov edx, ebx	0_2_015692D0
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then jmp eax	0_2_0156B475
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	0_2_01547470
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	0_2_01547470
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_0156B4BB
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+2Ch]	0_2_01567653
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-41h]	0_2_015696D8
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then movzx edi, byte ptr [esi+eax-000000BCh]	0_2_0155597D
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then mov ebx, eax	0_2_01545910
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then mov ebp, eax	0_2_01545910
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then movzx edi, byte ptr [esi+eax-000000BCh]	0_2_01556E97
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then mov edi, eax	0_2_01556E97
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then cmp dword ptr [ebx+esi*8], B430E561h	0_2_01565920
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	0_2_0157DBD0
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then mov byte ptr [eax], cl	0_2_01555ADC
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], B430E561h	0_2_01559C10
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 29DF508Eh	0_2_0157DCF0
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-0BF7BDDDh]	0_2_01565F7D
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-51BA460Ah]	0_2_0156BFD3
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-51BA460Ah]	0_2_0156BFDA
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 2298EE00h	0_2_0157DFB0
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then movzx edi, byte ptr [esi+ecx-000000BCh]	0_2_01555EE0
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_01561EE0
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_01557E82

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2057931 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz) : 192.168.2.5:55642 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057977 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz) : 192.168.2.5:55642 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057949 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz) : 192.168.2.5:60711 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057945 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz) : 192.168.2.5:49211 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057981 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz) : 192.168.2.5:60711 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057983 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz) : 192.168.2.5:49211 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057927 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz) : 192.168.2.5:59930 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057975 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz) : 192.168.2.5:59930 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057943 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz) : 192.168.2.5:58982 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057971 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz) : 192.168.2.5:58982 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057935 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz) : 192.168.2.5:60132 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057969 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz) : 192.168.2.5:60132 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057925 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz) : 192.168.2.5:61076 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057973 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz) : 192.168.2.5:61076 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057929 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz) : 192.168.2.5:58300 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057979 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz) : 192.168.2.5:58300 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.5:49704 -> 23.55.153.106:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49705 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49705 -> 104.21.66.86:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: covery-mover.biz
Source: Malware configuration extractor	URLs: formy-spill.biz
Source: Malware configuration extractor	URLs: dare-curbys.biz
Source: Malware configuration extractor	URLs: impend-differ.biz
Source: Malware configuration extractor	URLs: dwell-exclaim.biz
Source: Malware configuration extractor	URLs: zinc-sneark.biz
Source: Malware configuration extractor	URLs: se-blurry.biz
Source: Malware configuration extractor	URLs: print-vexer.biz

Source: Joe Sandbox View	IP Address: 104.21.66.86 104.21.66.86
Source: Joe Sandbox View	IP Address: 23.55.153.106 23.55.153.106

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49706 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49705 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49704 -> 23.55.153.106:443

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: LRPC-3bc2bcf3ed6d7050e4; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=8243cc0a5d084dc165582d3a; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type35121Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveFri, 27 Dec 2024 13:42:09 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: covery-mover.biz
Source: global traffic	DNS traffic detected: DNS query: se-blurry.biz
Source: global traffic	DNS traffic detected: DNS query: zinc-sneark.biz
Source: global traffic	DNS traffic detected: DNS query: dwell-exclaim.biz
Source: global traffic	DNS traffic detected: DNS query: formy-spill.biz
Source: global traffic	DNS traffic detected: DNS query: dare-curbys.biz
Source: global traffic	DNS traffic detected: DNS query: print-vexer.biz
Source: global traffic	DNS traffic detected: DNS query: impend-differ.biz
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: lev-tolstoi.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com

Source: FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116178354.0000000001639000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: FXdg37pY22.exe, 00000000.00000003.2116178354.0000000001639000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116178354.0000000001639000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamst
Source: FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/
Source: FXdg37pY22.exe, 00000000.00000003.2116195820.0000000001647000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116178354.0000000001639000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a
Source: FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
Source: FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
Source: FXdg37pY22.exe, 00000000.00000003.2116195820.0000000001647000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116178354.0000000001639000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001638000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000002.2130273641.0000000001638000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.p
Source: FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116178354.0000000001639000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: FXdg37pY22.exe, 00000000.00000003.2116195820.0000000001647000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116178354.0000000001639000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: FXdg37pY22.exe, 00000000.00000003.2116195820.0000000001647000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116178354.0000000001639000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=_92TWn81
Source: FXdg37pY22.exe, 00000000.00000003.2116195820.0000000001647000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116178354.0000000001639000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=FRRi
Source: FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
Source: FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
Source: FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
Source: FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
Source: FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=oOCAGrkRfpQ6&l=e
Source: FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en
Source: FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: FXdg37pY22.exe	String found in binary or memory: https://gcc.gnu.org/bugs/):
Source: FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001692000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/
Source: FXdg37pY22.exe, 00000000.00000003.2129319839.0000000001698000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001692000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api
Source: FXdg37pY22.exe, 00000000.00000002.2130273641.0000000001608000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apido
Source: FXdg37pY22.exe, 00000000.00000003.2129319839.0000000001698000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001692000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apistr
Source: FXdg37pY22.exe, 00000000.00000003.2129647775.0000000001692000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000002.2130539606.0000000001692000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001692000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apiy
Source: FXdg37pY22.exe, 00000000.00000003.2129647775.0000000001692000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000002.2130539606.0000000001692000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001692000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/d
Source: FXdg37pY22.exe, 00000000.00000003.2129647775.0000000001692000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000002.2130539606.0000000001692000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001692000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/pi
Source: FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/piRv
Source: FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001638000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116178354.0000000001639000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000002.2130273641.0000000001638000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: FXdg37pY22.exe, 00000000.00000003.2116195820.0000000001647000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116178354.0000000001639000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116178354.0000000001639000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: FXdg37pY22.exe, 00000000.00000002.2130273641.0000000001608000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: FXdg37pY22.exe, 00000000.00000002.2130273641.0000000001608000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb
Source: FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116178354.0000000001639000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.5:49705 version: TLS 1.2

Source: C:\Users\user\Desktop\FXdg37pY22.exe

Code function: 0_2_01571A30 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

0_2_01571A30

Source: C:\Users\user\Desktop\FXdg37pY22.exe

Code function: 0_2_01571A30 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

0_2_01571A30

Source: C:\Users\user\Desktop\FXdg37pY22.exe

Code function: 0_2_01571BB0 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

0_2_01571BB0

Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_000900D0	0_2_000900D0
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_000765B4	0_2_000765B4
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_0007C720	0_2_0007C720
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_00074751	0_2_00074751
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_000A4934	0_2_000A4934
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_0007A967	0_2_0007A967
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_00078A1F	0_2_00078A1F
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_00074CDD	0_2_00074CDD
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_0009ED70	0_2_0009ED70
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_000A5120	0_2_000A5120
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_0009F4D8	0_2_0009F4D8
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_00077794	0_2_00077794
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_0008F80C	0_2_0008F80C
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_0007B858	0_2_0007B858
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_000A79A0	0_2_000A79A0
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_000A1AA4	0_2_000A1AA4
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_00075D2F	0_2_00075D2F
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_015487F0	0_2_015487F0
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_0154A960	0_2_0154A960
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01576F90	0_2_01576F90
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01566170	0_2_01566170
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_0156A100	0_2_0156A100
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_015701D0	0_2_015701D0
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_015481F0	0_2_015481F0
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01565F7D	0_2_01565F7D
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_0154E06A	0_2_0154E06A
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_0157A030	0_2_0157A030
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_015780D9	0_2_015780D9
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_015680B0	0_2_015680B0
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_0155C360	0_2_0155C360
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_0157A3F0	0_2_0157A3F0
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01544270	0_2_01544270
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01562270	0_2_01562270
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01546200	0_2_01546200
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_0157E2C0	0_2_0157E2C0
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_0154E2A9	0_2_0154E2A9
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01556571	0_2_01556571
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01576430	0_2_01576430
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01560717	0_2_01560717
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01558731	0_2_01558731
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_015567A5	0_2_015567A5
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01552670	0_2_01552670
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_0156C6D7	0_2_0156C6D7
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_015666E7	0_2_015666E7
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01546690	0_2_01546690
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01576690	0_2_01576690
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_0157E690	0_2_0157E690
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_0156297F	0_2_0156297F
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01548990	0_2_01548990
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_0155CB5A	0_2_0155CB5A
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01556B7E	0_2_01556B7E
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_0157CBD6	0_2_0157CBD6
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01544BA0	0_2_01544BA0
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_0154CA54	0_2_0154CA54
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01554A40	0_2_01554A40
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_0157CAC0	0_2_0157CAC0
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01564D70	0_2_01564D70
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_0157CD60	0_2_0157CD60
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01576C40	0_2_01576C40
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01574C4D	0_2_01574C4D
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01558C1E	0_2_01558C1E
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01562CF8	0_2_01562CF8
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_0157CCE0	0_2_0157CCE0
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01568F5D	0_2_01568F5D
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01554F08	0_2_01554F08
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_0155EF30	0_2_0155EF30
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01550FD6	0_2_01550FD6
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01558FAD	0_2_01558FAD
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_0155AE00	0_2_0155AE00
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_0157CE00	0_2_0157CE00
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01556E97	0_2_01556E97
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01566EBE	0_2_01566EBE
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01542EA0	0_2_01542EA0
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01557190	0_2_01557190
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01549070	0_2_01549070
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_0156D085	0_2_0156D085
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_0154B351	0_2_0154B351
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01549360	0_2_01549360
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_0157533A	0_2_0157533A
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_015633A0	0_2_015633A0
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_015692D0	0_2_015692D0
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_015592BA	0_2_015592BA
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_015615F0	0_2_015615F0
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_0154D44C	0_2_0154D44C
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01547470	0_2_01547470
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_0155D420	0_2_0155D420
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_0156B763	0_2_0156B763
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_015497B0	0_2_015497B0
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01565670	0_2_01565670
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_015556D0	0_2_015556D0
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_015776B0	0_2_015776B0
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01545910	0_2_01545910
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01556E97	0_2_01556E97
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01577900	0_2_01577900
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01565920	0_2_01565920
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_015438C0	0_2_015438C0
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_0155D8E0	0_2_0155D8E0
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01551B1B	0_2_01551B1B
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01579B90	0_2_01579B90
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_0155BA48	0_2_0155BA48
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01563A00	0_2_01563A00
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01555ADC	0_2_01555ADC
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_0156BA8D	0_2_0156BA8D
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01563D30	0_2_01563D30
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01559C10	0_2_01559C10
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_0155DC20	0_2_0155DC20
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_0157DCF0	0_2_0157DCF0
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01567C9D	0_2_01567C9D
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01565F7D	0_2_01565F7D
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_0156BFD3	0_2_0156BFD3
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_0156BFDA	0_2_0156BFDA
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_0157DFB0	0_2_0157DFB0
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_0155DE40	0_2_0155DE40
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01563E4B	0_2_01563E4B
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01545E60	0_2_01545E60
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01563E30	0_2_01563E30
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_01555EE0	0_2_01555EE0

Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: String function: 01554A30 appears 76 times
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: String function: 000D2610 appears 86 times
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: String function: 01548000 appears 55 times
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: String function: 0007214F appears 37 times

Source: FXdg37pY22.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: classification engine

Classification label: mal96.troj.winEXE@2/1@10/2

Source: C:\Users\user\Desktop\FXdg37pY22.exe

Code function: 0_2_01576F90 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

0_2_01576F90

Source: C:\Users\user\Desktop\FXdg37pY22.exe

Code function: 0_2_000868D8 GetModuleHandleA,FindResourceA,LoadResource,LockResource,

0_2_000868D8

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6292:120:WilError_03

Source: FXdg37pY22.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\FXdg37pY22.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: FXdg37pY22.exe	Virustotal: Detection: 66%
Source: FXdg37pY22.exe	ReversingLabs: Detection: 82%

Source: C:\Users\user\Desktop\FXdg37pY22.exe

File read: C:\Users\user\Desktop\FXdg37pY22.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\FXdg37pY22.exe "C:\Users\user\Desktop\FXdg37pY22.exe"
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\FXdg37pY22.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: FXdg37pY22.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\FXdg37pY22.exe

Code function: 0_2_0007DE7C GetModuleHandleW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,

0_2_0007DE7C

Source: FXdg37pY22.exe

Static PE information: real checksum: 0x8fb6f should be: 0xdc618

Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_000DE09C push eax; mov dword ptr [esp], esi	0_2_000DE0B8
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_000A80F8 push eax; mov dword ptr [esp], 0000002Eh	0_2_000A8615
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_000A80F8 push eax; mov dword ptr [esp], 00000065h	0_2_000A86E5
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_000A2194 push eax; mov dword ptr [esp], 0000002Eh	0_2_000A2677
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_000A2194 push eax; mov dword ptr [esp], 00000065h	0_2_000A273D
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_000AC1A8 push ecx; mov dword ptr [esp], edx	0_2_000AC1E2
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_0008A2C8 push eax; mov dword ptr [esp], edi	0_2_0008A2EE
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_000AE2C0 push ecx; mov dword ptr [esp], edx	0_2_000AE2FA
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_000E244C push edx; mov dword ptr [esp], eax	0_2_000E2558
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_000E244C push edi; mov dword ptr [esp], 00000002h	0_2_000E2576
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_00092450 push eax; mov dword ptr [esp], esi	0_2_0009247C
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_000AC4FB push ecx; mov dword ptr [esp], eax	0_2_000AC510
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_000C0531 push edx; mov dword ptr [esp], esi	0_2_000C0594
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_000C0554 push edx; mov dword ptr [esp], esi	0_2_000C0594
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_000AE611 push esi; mov dword ptr [esp], eax	0_2_000AE626
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_000CC6C4 push edx; mov dword ptr [esp], eax	0_2_000CC735
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_000C06C0 push edx; mov dword ptr [esp], esi	0_2_000C06FA
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_000E472C push ebx; mov dword ptr [esp], eax	0_2_000E47B9
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_000D0754 push eax; mov dword ptr [esp], 000ED110h	0_2_000D0786
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_000D0754 push edx; mov dword ptr [esp], 00000001h	0_2_000D0798
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_000D0754 push eax; mov dword ptr [esp], esi	0_2_000D07B9
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_000D0754 push eax; mov dword ptr [esp], 000ED158h	0_2_000D07CD
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_000D0754 push eax; mov dword ptr [esp], 000ED164h	0_2_000D07F6
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_000D0754 push eax; mov dword ptr [esp], 00000001h	0_2_000D0871
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_000D0754 push eax; mov dword ptr [esp], 000ED0F0h	0_2_000D0880
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_000D0754 push eax; mov dword ptr [esp], 000ED11Ch	0_2_000D08BB
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_000D0754 push eax; mov dword ptr [esp], 00000001h	0_2_000D08CD
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_000D0754 push edx; mov dword ptr [esp], 000ED194h	0_2_000D08DC
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_000D0754 push eax; mov dword ptr [esp], 000ED170h	0_2_000D0905
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_000D0754 push eax; mov dword ptr [esp], 000ED17Ch	0_2_000D092E
Source: C:\Users\user\Desktop\FXdg37pY22.exe	Code function: 0_2_000D0754 push eax; mov dword ptr [esp], 000ED100h	0_2_000D09B8

Source: C:\Users\user\Desktop\FXdg37pY22.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Users\user\Desktop\FXdg37pY22.exe

API coverage: 5.4 %

Source: C:\Users\user\Desktop\FXdg37pY22.exe TID: 6968

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\FXdg37pY22.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: FXdg37pY22.exe, 00000000.00000002.2130039333.00000000015DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001638000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116195820.0000000001647000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116178354.0000000001639000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000002.2130273641.0000000001638000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001638000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116195820.0000000001647000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116178354.0000000001639000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000002.2130273641.0000000001638000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn,Q

Source: C:\Users\user\Desktop\FXdg37pY22.exe

Code function: 0_2_0157B480 LdrInitializeThunk,

0_2_0157B480

Source: C:\Users\user\Desktop\FXdg37pY22.exe

Code function: 0_2_00081866 _strdup,free,IsDebuggerPresent,RaiseException,

0_2_00081866

Source: C:\Users\user\Desktop\FXdg37pY22.exe

Code function: 0_2_0007DE7C GetModuleHandleW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,

0_2_0007DE7C

Source: C:\Users\user\Desktop\FXdg37pY22.exe

Code function: 0_2_00071127 Sleep,_amsg_exit,_initterm,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,__initenv,exit,_cexit,

0_2_00071127

Source: C:\Users\user\Desktop\FXdg37pY22.exe

Code function: 0_2_000CB240 cpuid

0_2_000CB240

Source: C:\Users\user\Desktop\FXdg37pY22.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\FXdg37pY22.exe

Code function: 0_2_0007F3E3 GetSystemTimeAsFileTime,

0_2_0007F3E3

Source: C:\Users\user\Desktop\FXdg37pY22.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	2 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	33 System Information Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
FXdg37pY22.exe	67%	Virustotal		Browse
FXdg37pY22.exe	83%	ReversingLabs	Win32.Spyware.Lummastealer
FXdg37pY22.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://community.fastly.steamst	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/piRv	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/apiy	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/apido	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/apistr	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	23.55.153.106	true	false	high
lev-tolstoi.com	104.21.66.86	true	false	high
dare-curbys.biz	unknown	unknown	false	high
impend-differ.biz	unknown	unknown	false	high
se-blurry.biz	unknown	unknown	false	high
zinc-sneark.biz	unknown	unknown	false	high
print-vexer.biz	unknown	unknown	false	high
covery-mover.biz	unknown	unknown	false	high
dwell-exclaim.biz	unknown	unknown	false	high
formy-spill.biz	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
dare-curbys.biz	false	high
formy-spill.biz	false	high
https://steamcommunity.com/profiles/76561199724331900	false	high
https://lev-tolstoi.com/api	false	high
print-vexer.biz	false	high
impend-differ.biz	false	high
dwell-exclaim.biz	false	high
zinc-sneark.biz	false	high
se-blurry.biz	false	high
covery-mover.biz	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gcc.gnu.org/bugs/):	FXdg37pY22.exe	false		high
https://player.vimeo.com	FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp	FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.microsoft	FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/?subsection=broadcasts	FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamst	FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lev-tolstoi.com/piRv	FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://store.steampowered.com/subscriber_agreement/	FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.gstatic.cn/recaptcha/	FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.valvesoftware.com/legal.htm	FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en	FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com	FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com	FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	FXdg37pY22.exe, 00000000.00000003.2116195820.0000000001647000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116178354.0000000001639000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/	FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl	FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis	FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s.ytimg.com;	FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=FRRi	FXdg37pY22.exe, 00000000.00000003.2116195820.0000000001647000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116178354.0000000001639000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/	FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116178354.0000000001639000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&	FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/	FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/d	FXdg37pY22.exe, 00000000.00000003.2129647775.0000000001692000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000002.2130539606.0000000001692000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001692000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steam.tv/	FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en	FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/	FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001692000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/privacy_agreement/	FXdg37pY22.exe, 00000000.00000003.2116178354.0000000001639000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/points/shop/	FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a	FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sketchfab.com	FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lv.queniujq.cn	FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199724331900/inventory/	FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116178354.0000000001639000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com/	FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/privacy_agreement/	FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng	FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/	FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	false		high
https://checkout.steampowered.com/	FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/;	FXdg37pY22.exe, 00000000.00000002.2130273641.0000000001608000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/about/	FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/my/wishlist/	FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&	FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.steampowered.com/en/	FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/market/	FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/news/	FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/subscriber_agreement/	FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116178354.0000000001639000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001638000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116178354.0000000001639000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000002.2130273641.0000000001638000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/apiy	FXdg37pY22.exe, 00000000.00000003.2129647775.0000000001692000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000002.2130539606.0000000001692000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001692000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://recaptcha.net/recaptcha/;	FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/discussions/	FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/stats/	FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am	FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	false		high
https://medal.tv	FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	false		high
https://broadcast.st.dl.eccdnx.com	FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a	FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/steam_refunds/	FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a	FXdg37pY22.exe, 00000000.00000003.2116195820.0000000001647000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116178354.0000000001639000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e	FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/workshop/	FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.steampowered.com/	FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb	FXdg37pY22.exe, 00000000.00000002.2130273641.0000000001608000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c	FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/apido	FXdg37pY22.exe, 00000000.00000002.2130273641.0000000001608000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://store.steampowered.com/legal/	FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116178354.0000000001639000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en	FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng	FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/apistr	FXdg37pY22.exe, 00000000.00000003.2129319839.0000000001698000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001692000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a	FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl	FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	false		high
https://recaptcha.net	FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/	FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=oOCAGrkRfpQ6&l=e	FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png	FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	false		high
http://127.0.0.1:27060	FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	false		high
https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	FXdg37pY22.exe, 00000000.00000003.2116195820.0000000001647000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116178354.0000000001639000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.p	FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001638000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000002.2130273641.0000000001638000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ	FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp	FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.steampowered.com/	FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.steampowered.com/	FXdg37pY22.exe, 00000000.00000003.2129346354.0000000001608000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/account/cookiepreferences/	FXdg37pY22.exe, 00000000.00000002.2130522293.0000000001686000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116178354.0000000001639000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2116146738.0000000001654000.00000004.00000020.00020000.00000000.sdmp, FXdg37pY22.exe, 00000000.00000003.2129116818.0000000001685000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/mobile	FXdg37pY22.exe, 00000000.00000003.2116125563.0000000001695000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.66.86	lev-tolstoi.com	United States		13335	CLOUDFLARENETUS	false
23.55.153.106	steamcommunity.com	United States		20940	AKAMAI-ASN1EU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581380
Start date and time:	2024-12-27 14:41:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	FXdg37pY22.exe renamed because original name is a hash value
Original Sample Name:	558a2574865079a1c4d69350493310df.exe
Detection:	MAL
Classification:	mal96.troj.winEXE@2/1@10/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 23 Number of non-executed functions: 180
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:42:05	API Interceptor	11x Sleep call for process: FXdg37pY22.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.66.86	MV ROCKET_PDA.exe	Get hash	malicious	FormBook	Browse	www.ayushigangwar.com/nqn4/?CJBlp=0Brh6Vr8UbBX&T2MpwT=59bmqUDXor7TXV4b71NCQ0d0nCVif23i1yH5+9ZmJc5hgCU7y+ZN9z0btTsWzGv6OrGw
23.55.153.106	k0ukcEH.exe	Get hash	malicious	LummaC	Browse
	5uVReRlvME.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Remcos, Stealc	Browse
	8WRONDszv4.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse
	z3IxCpcpg4.exe	Get hash	malicious	LummaC	Browse
	GtEVo1eO2p.exe	Get hash	malicious	LummaC	Browse
	AiaStwRBdI.exe	Get hash	malicious	LummaC	Browse
	HJVzgKyC0y.exe	Get hash	malicious	LummaC	Browse
	rUfr2hQGOb.exe	Get hash	malicious	LummaC	Browse
	YhF4vhbnMW.exe	Get hash	malicious	LummaC	Browse
	SPFFah2O2q.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
lev-tolstoi.com	k0ukcEH.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	pVbAZEFIpI.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	GxX48twWHA.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	ERTL09tA59.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	MaZjv5XeQi.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	jT7sgjdTea.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	Y4svWfRK1L.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	YKri2nEBWE.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	0c8cY5GOMh.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	z3IxCpcpg4.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
steamcommunity.com	k0ukcEH.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	8WRONDszv4.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	23.55.153.106
	pVbAZEFIpI.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	GxX48twWHA.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	RUUSfr6dVm.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	9idglWFv95.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	tJd3ArrDAm.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	gdtJGo7jH3.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	oQSTpQfzz5.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	rkPR0Fo9Cb.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	grand-theft-auto-5-theme-1-installer_qb8W-j1.exe	Get hash	malicious	Unknown	Browse	184.85.182.130
	k0ukcEH.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	5uVReRlvME.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Remcos, Stealc	Browse	23.55.153.106
	8WRONDszv4.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	23.55.153.106
	aD7D9fkpII.exe	Get hash	malicious	Vidar	Browse	23.209.72.25
	installer.bat	Get hash	malicious	Vidar	Browse	23.209.72.7
	skript.bat	Get hash	malicious	Vidar	Browse	2.16.158.83
	din.exe	Get hash	malicious	Vidar	Browse	23.44.201.32
	lem.exe	Get hash	malicious	Vidar	Browse	23.209.72.40
	z3IxCpcpg4.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
CLOUDFLARENETUS	gshv2.exe	Get hash	malicious	Unknown	Browse	162.159.129.233
	OiMp3TH.exe	Get hash	malicious	LummaC	Browse	172.67.216.236
	https://dnsextension.pro/invoice/d2d0bf8701b34bc296ca83b956c10720	Get hash	malicious	Unknown	Browse	104.21.31.138
	k0ukcEH.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	appFile.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.94.92
	FloydMounts.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.25.41
	5uVReRlvME.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Remcos, Stealc	Browse	172.67.165.185
	0A7XTINw3R.exe	Get hash	malicious	Unknown	Browse	104.26.8.44
	RDb082EApV.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	GnHq2ZaBUl.exe	Get hash	malicious	LummaC	Browse	104.21.11.101

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	OiMp3TH.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	k0ukcEH.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	https://online-ops.mypasschange.com/landingPage/2/fbb0559ebe1911efb53c0242ac190102	Get hash	malicious	Unknown	Browse	104.21.66.86 23.55.153.106
	appFile.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.66.86 23.55.153.106
	FloydMounts.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.66.86 23.55.153.106
	RDb082EApV.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	GnHq2ZaBUl.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	vVJvxAfBDM.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.66.86 23.55.153.106
	LIWYEYWSOj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.66.86 23.55.153.106
	onaUtwpiyq.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106

Process:	C:\Users\user\Desktop\FXdg37pY22.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10
Entropy (8bit):	3.321928094887362
Encrypted:	false
SSDEEP:	3:/FLoy:/FLl
MD5:	6E43EB4BA5DC366EE48961504A9DDC2A
SHA1:	444DFECFF6F9D4441F458A2B62DF4AF916F74887
SHA-256:	26D3A8E5B7B03427CF084AE3CD9713AD575A1921B432B02C96600B2AF7649D67
SHA-512:	13FB738CD092E000D2528B145F62C63B47DECB2424F836C3D9A08B400D8C130B56377276F5D3A0260B1611190498647454A301CAC562791F6B9703F6DAC1F305
Malicious:	false
Reputation:	low
Preview:	Got size..

Static File Info

General

File type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	7.158365042147545
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	FXdg37pY22.exe
File size:	874'496 bytes
MD5:	558a2574865079a1c4d69350493310df
SHA1:	e76374501315596dc32eebe8833cf1d8efeccba8
SHA256:	6c2b5ad84731b310763f541ff0b9e21b5dd698fba32e24e33dbed9278dd7b4c8
SHA512:	f4a8a88d8f527b1864fdeb2b36b0fc3407329cd8d4e50e9cdef738823cc9e13ef857c302a7984b599dd1cb0c25792d929e191e8fe9d5085e8bee1c0e36ea6b2c
SSDEEP:	24576:ztgBE/yQbXpz7pTCes2iRUyvw+1RLBXXzvNMJK/:ztwE/yQbXpz7pTCes2iw+1RxzKE
TLSH:	18058E67611390F6CC3365F2098BBAEFEA20CE1D54220A1FE7488964EBF6510757E367
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......................(.....T....................@.................................o.....@... ............................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x401307
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:	0x406bd9, 0x406ba8, 0x410774
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	e83be636913a91ed7c5d5aef532bc05d

Entrypoint Preview

Instruction
xor eax, eax
mov dword ptr [00489054h], eax
jmp 00007FCBEC916FBFh
push ebp
mov ebp, esp
sub esp, 18h
mov eax, dword ptr [ebp+08h]
mov dword ptr [esp], eax
call 00007FCBEC92420Dh
leave
cmp eax, 01h
sbb eax, eax
ret
nop
push ebp
mov ebp, esp
sub esp, 18h
mov dword ptr [esp], 00401340h
call 00007FCBEC91718Ah
leave
ret
ret
nop
nop
nop
push ebp
mov ebp, esp
sub esp, 10h
mov eax, dword ptr [ebp+08h]
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp+0Ch]
mov dword ptr [ebp-0Ch], eax
mov dword ptr [ebp-04h], 00000000h
jmp 00007FCBEC9171CBh
mov edx, dword ptr [ebp-0Ch]
mov eax, dword ptr [ebp-04h]
add eax, edx
mov ecx, dword ptr [ebp-08h]
mov edx, dword ptr [ebp-04h]
add edx, ecx
movzx eax, byte ptr [eax]
mov byte ptr [edx], al
add dword ptr [ebp-04h], 01h
mov eax, dword ptr [ebp-04h]
cmp eax, dword ptr [ebp+10h]
jc 00007FCBEC917191h
nop
nop
leave
ret
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 000001CCh
mov dword ptr [ebp-000001A4h], 00477FE8h
mov dword ptr [ebp-000001A0h], 00479828h
lea eax, dword ptr [ebp-0000019Ch]
mov dword ptr [eax], ebp
mov edx, 004017B1h
mov dword ptr [eax+04h], edx
mov dword ptr [eax+08h], esp
lea eax, dword ptr [ebp-000001BCh]
mov dword ptr [esp], eax
call 00007FCBEC91D89Fh
mov dword ptr [ebp-34h], 0000000Ah
mov eax, dword ptr [ebp-34h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8a000	0xe0c	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8d000	0x498b4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xd7000	0x4944	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x81858	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8a258	0x208	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x7a250	0x7a400	0d972b9e1bc2abf7a9f03fe4766abbcb	False	0.3918352185582822	data	6.311758769777413	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x7c000	0x1310	0x1400	36b77a8f6136b5b74274f9bc33537e58	False	0.0650390625	data	0.6881509775359347	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x7e000	0xa3d8	0xa400	d36ab0e2944028d344c50b0c6474639a	False	0.2950171493902439	data	5.54306110763306	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0x89000	0xad4	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x8a000	0xe0c	0x1000	d540bee2b9f5c9784a265aefb5468f43	False	0.296630859375	data	4.42433236204921	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x8b000	0x34	0x200	1d1527587aa546cad1face2659be5dfd	False	0.068359375	data	0.28187555731160896	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x8c000	0x8	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x8d000	0x498b4	0x49a00	095f9aaa3530a8789f549778641a4f6a	False	0.8771653491086587	Matlab v4 mat-file (little endian) \300, numeric, rows 0, columns 4, imaginary	7.729467197642069	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xd7000	0x4944	0x4a00	92dfc814a99b9bb6a2d957cdb1e3ea7a	False	0.65625	data	6.633200714215997	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
4W{RU\|W{W=NVPF<ZU	0x8d894	0x2592	data	0.912975670617592
9E]KH:WS7XGS{=IURU	0x8fe28	0x1e5b	data	0.9496847252605842
9WMG{7ZNYN;OSZMUENJV	0x91c84	0x1743	data	0.929471032745592
E49X	0x933c8	0x70	ASCII text, with no line terminators	0.7767857142857143
EHLRZ9Y	0x93438	0x21a5	data	0.8482526413560897
FLRV	0x955e0	0x864	data	0.9604283054003724
HF4WKKEMVQ\\FWV^;[5	0x95e44	0x368	data	1.0126146788990826
IYSS\|FNJT	0x961ac	0x2e16	data	0.9175283946431598
IYVY	0x98fc4	0x197	ASCII text	0.8083538083538083
JH\I\ZY[Q}<TFJ	0x9915c	0x20c6b	data	0.8778184147604114
JRNTN]FFFEXR<	0xb9dc8	0x2874	data	0.9003476245654692
K47~HH~GWIZ\9WYVNOM	0xbc63c	0x2add	data	0.9037637838330448
KZZKMXI6T=W	0xbf11c	0x365d	OpenPGP Public Key	0.9056549543723503
MNYT	0xc277c	0x3008	data	0.9076935588809368
N<UH[6\|LQV	0xc5784	0x26fc	data	0.8967935871743486
NIFNKR4KI[{U	0xc7e80	0x101b	data	0.8011156924569488
QX{GZ]WVJVROMSLHF8U	0xc8e9c	0x12c3	data	0.929419113054341
UQUIO7R\|RR~\|NEI9U	0xca160	0x38f4	data	0.9065157750342936
WO::TJJFU\6FLL9YW6TE4E	0xcda54	0x28be	data	0.9165867689357622
[=HZF6IWY]	0xd0314	0x1752	data	0.9152428810720268
\|H8XZ[H9IOQJ~	0xd1a68	0x2a84	data	0.9167585446527012
\|MGUZKQ;E8	0xd44ec	0x23c6	data	0.9081677222100896

Imports

DLL	Import
KERNEL32.dll	CloseHandle, CreateEventA, CreateFileMappingA, CreateSemaphoreA, DeleteCriticalSection, DuplicateHandle, EnterCriticalSection, FindResourceA, FormatMessageA, GetConsoleWindow, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetHandleInformation, GetLastError, GetModuleHandleA, GetModuleHandleW, GetProcAddress, GetProcessAffinityMask, GetSystemTimeAsFileTime, GetThreadContext, GetThreadPriority, GetTickCount, InitializeCriticalSection, IsDBCSLeadByteEx, IsDebuggerPresent, LeaveCriticalSection, LoadLibraryA, LoadLibraryW, LoadResource, LocalFree, LockResource, MapViewOfFile, MultiByteToWideChar, OpenProcess, OutputDebugStringA, QueryPerformanceCounter, QueryPerformanceFrequency, RaiseException, ReleaseSemaphore, ResetEvent, ResumeThread, SetEvent, SetLastError, SetProcessAffinityMask, SetThreadContext, SetThreadPriority, SetUnhandledExceptionFilter, SizeofResource, Sleep, SuspendThread, TlsAlloc, TlsGetValue, TlsSetValue, TryEnterCriticalSection, UnmapViewOfFile, VirtualProtect, VirtualQuery, WaitForMultipleObjects, WaitForSingleObject, WideCharToMultiByte
msvcrt.dll	__getmainargs, __initenv, __mb_cur_max, __p__commode, __p__fmode, __set_app_type, __setusermatherr, _amsg_exit, _beginthreadex, _cexit, _endthreadex, _errno, _initterm, _iob, _lock, _onexit, _setjmp3, _unlock, _vsnprintf, _vsnwprintf, abort, atoi, calloc, exit, fgetwc, fprintf, fputc, fputs, free, getc, getenv, iswctype, localeconv, longjmp, malloc, memchr, memcmp, memcpy, memmove, memset, printf, realloc, setlocale, signal, strchr, strcmp, strcoll, strcpy, strerror, strftime, strlen, strncmp, strtol, strtoul, strxfrm, towlower, towupper, vfprintf, wcscoll, wcsftime, wcslen, wcsxfrm, _strdup, _read
USER32.dll	ShowWindow

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-27T14:42:05.656321+0100	2057925	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz)	1	192.168.2.5	61076	1.1.1.1	53	UDP
2024-12-27T14:42:05.656321+0100	2057973	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz)	1	192.168.2.5	61076	1.1.1.1	53	UDP
2024-12-27T14:42:05.893053+0100	2057945	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz)	1	192.168.2.5	49211	1.1.1.1	53	UDP
2024-12-27T14:42:05.893053+0100	2057983	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz)	1	192.168.2.5	49211	1.1.1.1	53	UDP
2024-12-27T14:42:06.133318+0100	2057949	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz)	1	192.168.2.5	60711	1.1.1.1	53	UDP
2024-12-27T14:42:06.133318+0100	2057981	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz)	1	192.168.2.5	60711	1.1.1.1	53	UDP
2024-12-27T14:42:06.369553+0100	2057929	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz)	1	192.168.2.5	58300	1.1.1.1	53	UDP
2024-12-27T14:42:06.369553+0100	2057979	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz)	1	192.168.2.5	58300	1.1.1.1	53	UDP
2024-12-27T14:42:06.629198+0100	2057931	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz)	1	192.168.2.5	55642	1.1.1.1	53	UDP
2024-12-27T14:42:06.629198+0100	2057977	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz)	1	192.168.2.5	55642	1.1.1.1	53	UDP
2024-12-27T14:42:06.865274+0100	2057927	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz)	1	192.168.2.5	59930	1.1.1.1	53	UDP
2024-12-27T14:42:06.865274+0100	2057975	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz)	1	192.168.2.5	59930	1.1.1.1	53	UDP
2024-12-27T14:42:07.084787+0100	2057943	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz)	1	192.168.2.5	58982	1.1.1.1	53	UDP
2024-12-27T14:42:07.084787+0100	2057971	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz)	1	192.168.2.5	58982	1.1.1.1	53	UDP
2024-12-27T14:42:07.321388+0100	2057935	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz)	1	192.168.2.5	60132	1.1.1.1	53	UDP
2024-12-27T14:42:07.321388+0100	2057969	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz)	1	192.168.2.5	60132	1.1.1.1	53	UDP
2024-12-27T14:42:09.159152+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49704	23.55.153.106	443	TCP
2024-12-27T14:42:09.967434+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.5	49704	23.55.153.106	443	TCP
2024-12-27T14:42:11.735795+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49705	104.21.66.86	443	TCP
2024-12-27T14:42:12.478038+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49705	104.21.66.86	443	TCP
2024-12-27T14:42:12.478038+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49705	104.21.66.86	443	TCP
2024-12-27T14:42:13.639065+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49706	104.21.66.86	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 14:42:07.698189974 CET	49704	443	192.168.2.5	23.55.153.106
Dec 27, 2024 14:42:07.698282003 CET	443	49704	23.55.153.106	192.168.2.5
Dec 27, 2024 14:42:07.698419094 CET	49704	443	192.168.2.5	23.55.153.106
Dec 27, 2024 14:42:07.699835062 CET	49704	443	192.168.2.5	23.55.153.106
Dec 27, 2024 14:42:07.699846983 CET	443	49704	23.55.153.106	192.168.2.5
Dec 27, 2024 14:42:09.159044027 CET	443	49704	23.55.153.106	192.168.2.5
Dec 27, 2024 14:42:09.159152031 CET	49704	443	192.168.2.5	23.55.153.106
Dec 27, 2024 14:42:09.162602901 CET	49704	443	192.168.2.5	23.55.153.106
Dec 27, 2024 14:42:09.162612915 CET	443	49704	23.55.153.106	192.168.2.5
Dec 27, 2024 14:42:09.162872076 CET	443	49704	23.55.153.106	192.168.2.5
Dec 27, 2024 14:42:09.216376066 CET	49704	443	192.168.2.5	23.55.153.106
Dec 27, 2024 14:42:09.220761061 CET	49704	443	192.168.2.5	23.55.153.106
Dec 27, 2024 14:42:09.267324924 CET	443	49704	23.55.153.106	192.168.2.5
Dec 27, 2024 14:42:09.967473984 CET	443	49704	23.55.153.106	192.168.2.5
Dec 27, 2024 14:42:09.967497110 CET	443	49704	23.55.153.106	192.168.2.5
Dec 27, 2024 14:42:09.967504025 CET	443	49704	23.55.153.106	192.168.2.5
Dec 27, 2024 14:42:09.967562914 CET	443	49704	23.55.153.106	192.168.2.5
Dec 27, 2024 14:42:09.967567921 CET	49704	443	192.168.2.5	23.55.153.106
Dec 27, 2024 14:42:09.967614889 CET	443	49704	23.55.153.106	192.168.2.5
Dec 27, 2024 14:42:09.967644930 CET	443	49704	23.55.153.106	192.168.2.5
Dec 27, 2024 14:42:09.967659950 CET	49704	443	192.168.2.5	23.55.153.106
Dec 27, 2024 14:42:09.967659950 CET	49704	443	192.168.2.5	23.55.153.106
Dec 27, 2024 14:42:09.967673063 CET	49704	443	192.168.2.5	23.55.153.106
Dec 27, 2024 14:42:09.967685938 CET	49704	443	192.168.2.5	23.55.153.106
Dec 27, 2024 14:42:10.154320955 CET	443	49704	23.55.153.106	192.168.2.5
Dec 27, 2024 14:42:10.154423952 CET	443	49704	23.55.153.106	192.168.2.5
Dec 27, 2024 14:42:10.154556036 CET	49704	443	192.168.2.5	23.55.153.106
Dec 27, 2024 14:42:10.154582024 CET	443	49704	23.55.153.106	192.168.2.5
Dec 27, 2024 14:42:10.154633045 CET	49704	443	192.168.2.5	23.55.153.106
Dec 27, 2024 14:42:10.184969902 CET	443	49704	23.55.153.106	192.168.2.5
Dec 27, 2024 14:42:10.185028076 CET	443	49704	23.55.153.106	192.168.2.5
Dec 27, 2024 14:42:10.185049057 CET	443	49704	23.55.153.106	192.168.2.5
Dec 27, 2024 14:42:10.185111046 CET	49704	443	192.168.2.5	23.55.153.106
Dec 27, 2024 14:42:10.185142040 CET	49704	443	192.168.2.5	23.55.153.106
Dec 27, 2024 14:42:10.186616898 CET	49704	443	192.168.2.5	23.55.153.106
Dec 27, 2024 14:42:10.186634064 CET	443	49704	23.55.153.106	192.168.2.5
Dec 27, 2024 14:42:10.186666012 CET	49704	443	192.168.2.5	23.55.153.106
Dec 27, 2024 14:42:10.186671019 CET	443	49704	23.55.153.106	192.168.2.5
Dec 27, 2024 14:42:10.471261978 CET	49705	443	192.168.2.5	104.21.66.86
Dec 27, 2024 14:42:10.471295118 CET	443	49705	104.21.66.86	192.168.2.5
Dec 27, 2024 14:42:10.471405983 CET	49705	443	192.168.2.5	104.21.66.86
Dec 27, 2024 14:42:10.471724987 CET	49705	443	192.168.2.5	104.21.66.86
Dec 27, 2024 14:42:10.471736908 CET	443	49705	104.21.66.86	192.168.2.5
Dec 27, 2024 14:42:11.735599995 CET	443	49705	104.21.66.86	192.168.2.5
Dec 27, 2024 14:42:11.735795021 CET	49705	443	192.168.2.5	104.21.66.86
Dec 27, 2024 14:42:11.738404989 CET	49705	443	192.168.2.5	104.21.66.86
Dec 27, 2024 14:42:11.738415003 CET	443	49705	104.21.66.86	192.168.2.5
Dec 27, 2024 14:42:11.738660097 CET	443	49705	104.21.66.86	192.168.2.5
Dec 27, 2024 14:42:11.739911079 CET	49705	443	192.168.2.5	104.21.66.86
Dec 27, 2024 14:42:11.739943027 CET	49705	443	192.168.2.5	104.21.66.86
Dec 27, 2024 14:42:11.739974022 CET	443	49705	104.21.66.86	192.168.2.5
Dec 27, 2024 14:42:12.478039026 CET	443	49705	104.21.66.86	192.168.2.5
Dec 27, 2024 14:42:12.478125095 CET	443	49705	104.21.66.86	192.168.2.5
Dec 27, 2024 14:42:12.478204966 CET	49705	443	192.168.2.5	104.21.66.86
Dec 27, 2024 14:42:12.479253054 CET	49705	443	192.168.2.5	104.21.66.86
Dec 27, 2024 14:42:12.479264975 CET	443	49705	104.21.66.86	192.168.2.5
Dec 27, 2024 14:42:12.479321957 CET	49705	443	192.168.2.5	104.21.66.86
Dec 27, 2024 14:42:12.479326963 CET	443	49705	104.21.66.86	192.168.2.5
Dec 27, 2024 14:42:12.587532043 CET	49706	443	192.168.2.5	104.21.66.86
Dec 27, 2024 14:42:12.587646961 CET	443	49706	104.21.66.86	192.168.2.5
Dec 27, 2024 14:42:12.587768078 CET	49706	443	192.168.2.5	104.21.66.86
Dec 27, 2024 14:42:12.588351965 CET	49706	443	192.168.2.5	104.21.66.86
Dec 27, 2024 14:42:12.588390112 CET	443	49706	104.21.66.86	192.168.2.5
Dec 27, 2024 14:42:13.639065027 CET	49706	443	192.168.2.5	104.21.66.86

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 14:42:05.656321049 CET	61076	53	192.168.2.5	1.1.1.1
Dec 27, 2024 14:42:05.882987976 CET	53	61076	1.1.1.1	192.168.2.5
Dec 27, 2024 14:42:05.893053055 CET	49211	53	192.168.2.5	1.1.1.1
Dec 27, 2024 14:42:06.108191013 CET	53	49211	1.1.1.1	192.168.2.5
Dec 27, 2024 14:42:06.133317947 CET	60711	53	192.168.2.5	1.1.1.1
Dec 27, 2024 14:42:06.362277985 CET	53	60711	1.1.1.1	192.168.2.5
Dec 27, 2024 14:42:06.369553089 CET	58300	53	192.168.2.5	1.1.1.1
Dec 27, 2024 14:42:06.625237942 CET	53	58300	1.1.1.1	192.168.2.5
Dec 27, 2024 14:42:06.629198074 CET	55642	53	192.168.2.5	1.1.1.1
Dec 27, 2024 14:42:06.859333992 CET	53	55642	1.1.1.1	192.168.2.5
Dec 27, 2024 14:42:06.865273952 CET	59930	53	192.168.2.5	1.1.1.1
Dec 27, 2024 14:42:07.080535889 CET	53	59930	1.1.1.1	192.168.2.5
Dec 27, 2024 14:42:07.084786892 CET	58982	53	192.168.2.5	1.1.1.1
Dec 27, 2024 14:42:07.317307949 CET	53	58982	1.1.1.1	192.168.2.5
Dec 27, 2024 14:42:07.321388006 CET	60132	53	192.168.2.5	1.1.1.1
Dec 27, 2024 14:42:07.548424959 CET	53	60132	1.1.1.1	192.168.2.5
Dec 27, 2024 14:42:07.552143097 CET	50118	53	192.168.2.5	1.1.1.1
Dec 27, 2024 14:42:07.691637039 CET	53	50118	1.1.1.1	192.168.2.5
Dec 27, 2024 14:42:10.190224886 CET	59574	53	192.168.2.5	1.1.1.1
Dec 27, 2024 14:42:10.470422029 CET	53	59574	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 27, 2024 14:42:05.656321049 CET	192.168.2.5	1.1.1.1	0x2c0a	Standard query (0)	covery-mover.biz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:42:05.893053055 CET	192.168.2.5	1.1.1.1	0xf72d	Standard query (0)	se-blurry.biz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:42:06.133317947 CET	192.168.2.5	1.1.1.1	0x22c7	Standard query (0)	zinc-sneark.biz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:42:06.369553089 CET	192.168.2.5	1.1.1.1	0x33d8	Standard query (0)	dwell-exclaim.biz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:42:06.629198074 CET	192.168.2.5	1.1.1.1	0xad65	Standard query (0)	formy-spill.biz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:42:06.865273952 CET	192.168.2.5	1.1.1.1	0x336f	Standard query (0)	dare-curbys.biz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:42:07.084786892 CET	192.168.2.5	1.1.1.1	0x53dc	Standard query (0)	print-vexer.biz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:42:07.321388006 CET	192.168.2.5	1.1.1.1	0xab8c	Standard query (0)	impend-differ.biz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:42:07.552143097 CET	192.168.2.5	1.1.1.1	0x8aa8	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:42:10.190224886 CET	192.168.2.5	1.1.1.1	0xef56	Standard query (0)	lev-tolstoi.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 27, 2024 14:42:05.882987976 CET	1.1.1.1	192.168.2.5	0x2c0a	Name error (3)	covery-mover.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:42:06.108191013 CET	1.1.1.1	192.168.2.5	0xf72d	Name error (3)	se-blurry.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:42:06.362277985 CET	1.1.1.1	192.168.2.5	0x22c7	Name error (3)	zinc-sneark.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:42:06.625237942 CET	1.1.1.1	192.168.2.5	0x33d8	Name error (3)	dwell-exclaim.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:42:06.859333992 CET	1.1.1.1	192.168.2.5	0xad65	Name error (3)	formy-spill.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:42:07.080535889 CET	1.1.1.1	192.168.2.5	0x336f	Name error (3)	dare-curbys.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:42:07.317307949 CET	1.1.1.1	192.168.2.5	0x53dc	Name error (3)	print-vexer.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:42:07.548424959 CET	1.1.1.1	192.168.2.5	0xab8c	Name error (3)	impend-differ.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:42:07.691637039 CET	1.1.1.1	192.168.2.5	0x8aa8	No error (0)	steamcommunity.com		23.55.153.106	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:42:10.470422029 CET	1.1.1.1	192.168.2.5	0xef56	No error (0)	lev-tolstoi.com		104.21.66.86	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:42:10.470422029 CET	1.1.1.1	192.168.2.5	0xef56	No error (0)	lev-tolstoi.com		172.67.157.254	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

lev-tolstoi.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	23.55.153.106	443	428	C:\Users\user\Desktop\FXdg37pY22.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 13:42:09 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-12-27 13:42:09 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Fri, 27 Dec 2024 13:42:09 GMT Content-Length: 35121 Connection: close Set-Cookie: sessionid=8243cc0a5d084dc165582d3a; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2024-12-27 13:42:09 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2024-12-27 13:42:10 UTC	10097	IN	Data Raw: 2e 63 6f 6d 2f 3f 73 75 62 73 65 63 74 69 6f 6e 3d 62 72 6f 61 64 63 61 73 74 73 22 3e 0a 09 09 09 09 09 09 42 72 6f 61 64 63 61 73 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 62 6f 75 74 2f 22 3e 0a 09 09 09 09 41 62 6f 75 74 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 65 6c 70 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 65 6e 2f 22 3e 0a 09 09 09 09 53 55 50 50 4f 52 54 09 Data Ascii: .com/?subsection=broadcasts">Broadcasts</a></div><a class="menuitem " href="https://store.steampowered.com/about/">About</a><a class="menuitem " href="https://help.steampowered.com/en/">SUPPORT
2024-12-27 13:42:10 UTC	10545	IN	Data Raw: 4e 49 56 45 52 53 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 70 75 62 6c 69 63 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4c 41 4e 47 55 41 47 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 65 6e 67 6c 69 73 68 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4f 55 4e 54 52 59 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 55 53 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 43 4f 4d 4d 55 4e 49 54 59 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 64 6e 2e 66 61 73 74 6c 79 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 5c 2f 70 75 62 6c 69 63 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 Data Ascii: NIVERSE":"public","LANGUAGE":"english","COUNTRY":"US","MEDIA_CDN_COMMUNITY_URL":"https:\/\/cdn.fastly.steamstatic.com\/steamcommunity\/public\/","MEDIA_CDN_URL":"htt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	104.21.66.86	443	428	C:\Users\user\Desktop\FXdg37pY22.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 13:42:11 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: lev-tolstoi.com
2024-12-27 13:42:11 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-27 13:42:12 UTC	1121	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 13:42:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qvvpmpf656covdh7vftbnjc75p; expires=Tue, 22 Apr 2025 07:28:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=27i5jAUGiGckFjK8NKIaXK29RZr4x3ikOonboR8lG%2FjUHwAZgdiciWwnn3UEg8zhoJpbZzRbv5R32w7aV0Qf81L93nzxeHMel6H558pVcEi%2BaEHHey4bvY1ChisvU7iEs24%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89bb85098a7c78-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1787&min_rtt=1781&rtt_var=680&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2835&recv_bytes=906&delivery_rate=1593886&cwnd=252&unsent_bytes=0&cid=71a7d6eb9b11a815&ts=755&x=0"
2024-12-27 13:42:12 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-27 13:42:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	08:42:04
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\FXdg37pY22.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\FXdg37pY22.exe"
Imagebase:	0x70000
File size:	874'496 bytes
MD5 hash:	558A2574865079A1C4D69350493310DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	08:42:04
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8.9%
Total number of Nodes:	472
Total number of Limit Nodes:	19

Executed Functions

Function 01576F90 Relevance: 35.6, APIs: 11, Strings: 9, Instructions: 571
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(0158068C,00000000,00000001,0158067C), ref: 01577173
SysAllocString.OLEAUT32(D080DE8F), ref: 015771DB
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 01577218
SysAllocString.OLEAUT32(9F4F9D4B), ref: 01577268
SysAllocString.OLEAUT32(E8D216C6), ref: 0157731A
VariantInit.OLEAUT32(.'()), ref: 01577385
VariantClear.OLEAUT32(.'()), ref: 015774E0
SysFreeString.OLEAUT32(?), ref: 01577504
SysFreeString.OLEAUT32(?), ref: 0157750A
SysFreeString.OLEAUT32(00000000), ref: 01577517
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 01577552

Strings

"#$%, xrefs: 015775FC
C, xrefs: 015770CF
.;, xrefs: 01577282
!", xrefs: 015771A9
>C, xrefs: 015770D7
p*v,, xrefs: 01577199
.'(), xrefs: 01577008, 015770C1
{|, xrefs: 015773BF
{.] , xrefs: 015771A1

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID: String$AllocFree$Variant$BlanketClearCreateInformationInitInstanceProxyVolume
String ID: !"$"#$%$.'()$.;$>C$C$p*v,${.] ${|
API String ID: 2573436264-264043890
Opcode ID: afce31a9476f9d6ded99b8614869bd3d0a0bd272be8424da6b5e309c88f2a498
Instruction ID: 52e0233270e83c8b2e5702dd91a11f91e54cc566faaa4fc5719440779842589b
Opcode Fuzzy Hash: afce31a9476f9d6ded99b8614869bd3d0a0bd272be8424da6b5e309c88f2a498
Instruction Fuzzy Hash: 8702FF716083009FD310DF68E886B6FBBE5FBC9304F14892CF6959B291D679D849CB92

Function 00071127 Relevance: 15.1, APIs: 10, Instructions: 125
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 00071151
_amsg_exit.MSVCRT ref: 00071172
_initterm.MSVCRT ref: 0007119B
_initterm.MSVCRT ref: 000711C3
SetUnhandledExceptionFilter.KERNEL32 ref: 0007120B
malloc.MSVCRT ref: 0007123A
strlen.MSVCRT ref: 00071256
malloc.MSVCRT ref: 00071264
exit.MSVCRT ref: 000712D4
_cexit.MSVCRT ref: 000712E2

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: _inittermmalloc$ExceptionFilterSleepUnhandled_amsg_exit_cexitexitstrlen
String ID:
API String ID: 1058485957-0
Opcode ID: 9f6b1cb7c821d4b866b4b180e4a29b1a91441a578218f9b7f0b7669d006d1ad8
Instruction ID: 8283259ccef361c12e03ba13e46473b00b262fe27ed0dd699c130dce325a3608
Opcode Fuzzy Hash: 9f6b1cb7c821d4b866b4b180e4a29b1a91441a578218f9b7f0b7669d006d1ad8
Instruction Fuzzy Hash: AD512BB0D05205CFEB10EF69D8847A9BBF0FB49340F008429E5889B651DB7D9585EF9A

Function 0154A960 Relevance: 9.2, Strings: 7, Instructions: 401
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

#xDz, xrefs: 0154AACE
A|}~, xrefs: 0154AAD6
N[\D, xrefs: 0154AD01, 0154ABC5, 0154ACD2, 0154ADC0, 0154ADEE, 0154ADB7, 0154ACF6, 0154ABA4
'D F, xrefs: 0154AAC6
N[\D, xrefs: 0154AC00
kl, xrefs: 0154AB2D
n, xrefs: 0154A982

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: #xDz$'D F$A|}~$N[\D$N[\D$kl$n
API String ID: 0-490458541
Opcode ID: 60a2ceb516fab472129ec488ec0b0ae98a4756701c3be729293d6a933c58fa0a
Instruction ID: bb68ef8bc32c3a46a5bfb6a04600a4b5545046d5e983b98fdf57693c0b040c29
Opcode Fuzzy Hash: 60a2ceb516fab472129ec488ec0b0ae98a4756701c3be729293d6a933c58fa0a
Instruction Fuzzy Hash: CCC1267264C3504BD764CF6888905AFFBD3ABC1208F1E892CE9D65F342D675950AC786

Function 0154CE55 Relevance: 9.0, Strings: 7, Instructions: 275
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

F^, xrefs: 0154D0B9
lev-tolstoi.com, xrefs: 0154D27A
I@, xrefs: 0154D0C4
C87B982DF57FAA5523D904AF30EFEBBC, xrefs: 0154CEAF
z@(, xrefs: 0154CF5B
VgfW, xrefs: 0154CF2F
N~ :, xrefs: 0154CF45

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: C87B982DF57FAA5523D904AF30EFEBBC$F^$I@$N~ :$VgfW$lev-tolstoi.com$z@(
API String ID: 0-2114970069
Opcode ID: e4475e5426abe6753dc3cdd87b6c2c7702135b57c7156ceaa17472dabedb3a5b
Instruction ID: 55e0848506340de6378ba8d2140addbb503bc119e5920b15c45c8379e4c1a798
Opcode Fuzzy Hash: e4475e5426abe6753dc3cdd87b6c2c7702135b57c7156ceaa17472dabedb3a5b
Instruction Fuzzy Hash: 9891B0B06493C18BD335CF25D4A0BEFBBE0AB96354F14896CD4D95B242E738414ADB52

Function 015487F0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 127
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 01548811
GetCurrentThreadId.KERNEL32 ref: 0154881A
GetForegroundWindow.USER32 ref: 015488CE
ExitProcess.KERNEL32 ref: 0154897B

Strings

YO9W, xrefs: 01548822

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID: CurrentProcess$ExitForegroundThreadWindow
String ID: YO9W
API String ID: 3118123366-386669604
Opcode ID: 5b0491f41edbe259583b45c51a9dc0fa909e6f201c837b01b1c17fe21cdb7d27
Instruction ID: a65a7aa5c4f803073b9937d94fda7bd1aa8ff4a37d24bb196641f6c16124a86c
Opcode Fuzzy Hash: 5b0491f41edbe259583b45c51a9dc0fa909e6f201c837b01b1c17fe21cdb7d27
Instruction Fuzzy Hash: 16314537F50A1907C35C6DB99C4636EB9875BC4614F0F863C9DA9AF385E9B88C0882D1

Function 0157B480 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0157D4FB,005C003F,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 0157B4AE

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 01549CC0 Relevance: 1.3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

\U^_, xrefs: 01549CE5

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: \U^_
API String ID: 0-352632802
Opcode ID: 7a8a7d7e43c2971df9a46420487099b6d69401517a3f706c2caf02c41a4d1cbb
Instruction ID: c26af2f00f6fe208649588b92ed0499027c11b9800d5fca8b6a5ae9c96aa310b
Opcode Fuzzy Hash: 7a8a7d7e43c2971df9a46420487099b6d69401517a3f706c2caf02c41a4d1cbb
Instruction Fuzzy Hash: D111E27060C3808FC3249F34A4559AFBBE5EBD7248F545A2CE0D56F245C731980ACF96

Function 000E8EAC Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 130
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.MSVCRT ref: 000E8F03
strtoul.MSVCRT ref: 000E8FD5
strchr.MSVCRT ref: 000E8FFA
malloc.MSVCRT ref: 000E9033

Strings

=, xrefs: 000E8FAF
@, xrefs: 000E8F39
:, xrefs: 000E8FF2
., xrefs: 000E8F79
:, xrefs: 000E8F48

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: getenvmallocstrchrstrtoul
String ID: .$:$:$=$@
API String ID: 3906490709-779014836
Opcode ID: 151e2395f0c7df7b15d76c870f711a70ee2af4bcbf37354b46a8793318ab72dc
Instruction ID: 37dc8df0e5d370bb1fd16e3898fd6daeeb22ed2356d5a38da3fab6b636ebcb8b
Opcode Fuzzy Hash: 151e2395f0c7df7b15d76c870f711a70ee2af4bcbf37354b46a8793318ab72dc
Instruction Fuzzy Hash: A5516CB0D043859FEB54EFAAD4846AEBBF2BF48304F11C46ED598A7252E7788444CB51

Function 0007FF35 Relevance: 12.1, APIs: 8, Instructions: 84
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00080564), ref: 0007FF4B

Part of subcall function 0007FD82: calloc.MSVCRT ref: 0007FDAF

GetCurrentThreadId.KERNEL32 ref: 0007FF74
CreateEventA.KERNEL32 ref: 0007FF92

Part of subcall function 0007FE4A: GetCurrentThreadId.KERNEL32 ref: 0007FE6E
Part of subcall function 0007FE4A: OutputDebugStringA.KERNEL32 ref: 0007FE93
Part of subcall function 0007FE4A: abort.MSVCRT(00000000), ref: 0007FE9A

GetCurrentThread.KERNEL32 ref: 0007FFC2
DuplicateHandle.KERNELBASE ref: 0007FFF3
abort.MSVCRT(00000000,00000000), ref: 00080000
GetThreadPriority.KERNEL32(00000000,00000000), ref: 0008000B
TlsSetValue.KERNEL32 ref: 00080032

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: Thread$Current$Valueabort$CreateDebugDuplicateEventHandleOutputPriorityStringcalloc
String ID:
API String ID: 3659382012-0
Opcode ID: 2b0a03252c4064cacce1bf8a1b029a092fd292256bf75e9a8ac23ca362e838c7
Instruction ID: 9a8bfe2193691c8e44efd07907db31b38f298c1121e90ecc302d094c463f1b6a
Opcode Fuzzy Hash: 2b0a03252c4064cacce1bf8a1b029a092fd292256bf75e9a8ac23ca362e838c7
Instruction Fuzzy Hash: 183108B1A053018FDB40AF79D88856ABFE4AF89350F01856AE898C7256E778C444CF92

Function 0008702C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 60
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingA.KERNEL32 ref: 00087080
MapViewOfFile.KERNELBASE ref: 000870B2
CloseHandle.KERNELBASE ref: 000870C7

Strings

@, xrefs: 00087064
", xrefs: 0008709F

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: File$CloseCreateHandleMappingView
String ID: "$@
API String ID: 1187395538-1136454570
Opcode ID: 3ad287c3e960851305e6cf53030cfb63512f05009fc767a68182760feb27aef9
Instruction ID: ac07e974776da11388136b8449f2040e5170bbd33de5041dbff7829058865249
Opcode Fuzzy Hash: 3ad287c3e960851305e6cf53030cfb63512f05009fc767a68182760feb27aef9
Instruction Fuzzy Hash: BE2160B4A082069FDB40EF6CD584B5EBBF0BB49304F108569E868E73A0D379E945DF52

Function 0157B720 Relevance: 3.0, APIs: 2, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32 ref: 0157B720
GetForegroundWindow.USER32 ref: 0157B740

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 988be425a465278c1b7489aeb6d2082521036326e843caa931271b68c072f09b
Instruction ID: a4299145e1cd27117db61fe475399438ff6fe2d7bc0f2f812e048a00a34c3c4f
Opcode Fuzzy Hash: 988be425a465278c1b7489aeb6d2082521036326e843caa931271b68c072f09b
Instruction Fuzzy Hash: EBD0A7B5D21112EBD724BB30FC4A93F3A2AFF911257556514E813AF38DEA21740E97C2

Function 000718C7 Relevance: 1.6, APIs: 1, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNELBASE ref: 00071A34

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 8c8bb236ef9a2f90900036517dafd4e65be8fbc17c407416fac55b01204b74ea
Instruction ID: 2bb9d726e581d05ef23e57796f0b3a2ff34626b78b5ee62559be1ae35c7366fb
Opcode Fuzzy Hash: 8c8bb236ef9a2f90900036517dafd4e65be8fbc17c407416fac55b01204b74ea
Instruction Fuzzy Hash: 7141E674A043198FDB14EF64D885BDDBBF5BB88300F10856AD888A7351EB389A45CF56

Function 0007AE66 Relevance: 1.6, APIs: 1, Instructions: 104
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.MSVCRT ref: 0007AE78

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: _errno
String ID:
API String ID: 2918714741-0
Opcode ID: 2228ab25664df53025319954a1af550892e51b2d1b7359287560bc1ae8667168
Instruction ID: e2b1c07d0c56e66b683d12509e9e9c7fa14aad68b0209b0c989557af25082734
Opcode Fuzzy Hash: 2228ab25664df53025319954a1af550892e51b2d1b7359287560bc1ae8667168
Instruction Fuzzy Hash: 2E411A75A083858FD770CF29C48079FBBE1AB89324F148B19E4AC8B291D33895428B57

Function 00080AE2 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00080B87

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: fprintf
String ID:
API String ID: 383729395-0
Opcode ID: 5a068ce2e6c35365072d7660bf6e9b590a97c1296a35dab790d204f62c650bd4
Instruction ID: 9c5d03a24af3dc8349cd7896f5c412037dffc478c2f71e2f4e29446f2ee29b61
Opcode Fuzzy Hash: 5a068ce2e6c35365072d7660bf6e9b590a97c1296a35dab790d204f62c650bd4
Instruction Fuzzy Hash: 59114CB0A042058FD760BF68C4855AEBBF1FF84314F11C869E8885B312E7399845CF95

Function 0157B420 Relevance: 1.5, APIs: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?,?,?,0154B29B,?,00000001,?,?,?,?,?,?,?), ref: 0157B452

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 938f6f24a6e9e6930382cfb005965ce6b32f17df7d6c685daf78d6654f93ed55
Instruction ID: 37b6b554bbf7fb456b977e323bf198616d338851f6fcf0cc70b96d8f8769d778
Opcode Fuzzy Hash: 938f6f24a6e9e6930382cfb005965ce6b32f17df7d6c685daf78d6654f93ed55
Instruction Fuzzy Hash: 0FE02B32908113EFC3102E34BC06B1B3679BFD6621F470830E4456E108DA35E800C6F6

Function 00079FD8 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

fputc.MSVCRT ref: 0007A001

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: fputc
String ID:
API String ID: 1992160199-0
Opcode ID: 6e43812b830da307458a2b4cbff3996d19f1e998b98e22eee2657815703c183c
Instruction ID: 8a753be0891bf91646776056e2b0856d433d0d60910a0e7cdf59b016d5022f19
Opcode Fuzzy Hash: 6e43812b830da307458a2b4cbff3996d19f1e998b98e22eee2657815703c183c
Instruction Fuzzy Hash: 49E06DB0A05204CBDB089B19C1C5466BBA5FB8A300751C6ADD98E4B247D239D841CB9B

Function 0154CDF0 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0154CE03

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 31a9f31bd1341db979f5c724849a7c5c6191d2136e86a76a2030e265e3561bbd
Instruction ID: a1af9cd0c90ed06445792be276ae3a6cae5d87ae0e2ec557ef719c125a696f7d
Opcode Fuzzy Hash: 31a9f31bd1341db979f5c724849a7c5c6191d2136e86a76a2030e265e3561bbd
Instruction Fuzzy Hash: F5D0A7301505486BE270651CDC4BF5E3A9C9B02B39F001229B273EE2C5D9906918E761

Function 0154CE23 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0154CE35

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: a106520565be54470aad6b186a89c72b14903186a9f40abdc607bb2d5112cc1c
Instruction ID: 6944edc0e539e753f3c3d9a5ceebdbaba9b70f6957f2e19b8eb15d60de727da1
Opcode Fuzzy Hash: a106520565be54470aad6b186a89c72b14903186a9f40abdc607bb2d5112cc1c
Instruction Fuzzy Hash: 6AD092303C42007AE6348A08AC53F1826169701F21F711619B372FE6C9C9E07115D619

Function 01579B60 Relevance: 1.5, APIs: 1, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,00000000,01552F5C), ref: 01579B80

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: efe686fa2d32e8a6fd0e689589dff945e79ad96543aeb22b33dbc16d430f6723
Instruction ID: 027cf26a604414b8d6c0a28bf04be3735fc72cdbe701d1717846c847e5b3a87b
Opcode Fuzzy Hash: efe686fa2d32e8a6fd0e689589dff945e79ad96543aeb22b33dbc16d430f6723
Instruction Fuzzy Hash: D9D0C931505533EBCA606E28B815BCB3A59AF49631F070891B4006E168C6A5AC919AD4

Function 00086CF8 Relevance: 1.5, APIs: 1, Instructions: 11libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,?,?,?,?,?,?,?,?,00086D78), ref: 00086D0C

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c43b7ba5005cfa61f355da0522674109e74f5a70c1b5ce42aa388f4bee675b61
Instruction ID: 4d878c69eed7ff34aea098905b401a0511016315d9401b8cd1fc28b311bf9b39
Opcode Fuzzy Hash: c43b7ba5005cfa61f355da0522674109e74f5a70c1b5ce42aa388f4bee675b61
Instruction Fuzzy Hash: 83C012B0A042045BC700FF7DE84140D7BF45705214F008134E854D3350D134E554CF96

Function 01579B40 Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,01554E57,00000400), ref: 01579B50

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 25d208905323756ed43591c66ae2c310dfdfdbb7a94f748e746986e1b88121aa
Instruction ID: 6e5d660223e5eece1c7301ca6c22aaa87b0acac0b671b9a32f803e61e7321435
Opcode Fuzzy Hash: 25d208905323756ed43591c66ae2c310dfdfdbb7a94f748e746986e1b88121aa
Instruction Fuzzy Hash: 94C04C31545122AACA106E14FC05B863A54AF55661F170491B0056A07486606C8196D5

Function 000E781C Relevance: 1.3, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 000E7833

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: e6f2bfa2c51966b4457e41eaacb08405af7226090f00bf99629cd2cca18eaa49
Instruction ID: 808382b0b1627a90c3e589801c542d7e578649bdda2d86eed27e9884fb4a4c10
Opcode Fuzzy Hash: e6f2bfa2c51966b4457e41eaacb08405af7226090f00bf99629cd2cca18eaa49
Instruction Fuzzy Hash: 8FF0A0B09483896ED7003FB6D98521E7AD89F20344F81486CE98DAB303EB74D840C763

Function 0154D2C5 Relevance: 1.3, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

CoUninitialize.COMBASE ref: 0154D2C5

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID: Uninitialize
String ID:
API String ID: 3861434553-0
Opcode ID: f8d68ee376024a94e2e40b1c6354b542a3cfc32548088aaa9b8ae0fa785fe2bf
Instruction ID: e1a3a8fc9b7b8a45a3c88da712a30adc49c8dcfd1d913865e442f0dd1af53133
Opcode Fuzzy Hash: f8d68ee376024a94e2e40b1c6354b542a3cfc32548088aaa9b8ae0fa785fe2bf
Instruction Fuzzy Hash: DBB09236A060059E8B104AA5B8490DCF3A0F6881BA7419863E22ADA000D231112A4651

Non-executed Functions

Function 01552670 Relevance: 165.6, Strings: 131, Instructions: 1885COMMON

Download Yara Rule

Strings

O, xrefs: 01553D37
D, xrefs: 01554338
", xrefs: 01552D1F
v, xrefs: 015539D1
D, xrefs: 01553F09
p, xrefs: 015539A1
*, xrefs: 01552CDF
m, xrefs: 015536D8
8, xrefs: 01552D4F
3, xrefs: 01552861
', xrefs: 01552D47
H, xrefs: 01553AE1
e, xrefs: 01553CD7
L, xrefs: 01553D87
q, xrefs: 01552D17
c, xrefs: 01553FAB
`, xrefs: 01553FBA
w, xrefs: 01553CB7
r, xrefs: 01552D07
Z, xrefs: 01553DF7
W, xrefs: 0155308E
a, xrefs: 01554282
J, xrefs: 01553AF1
A, xrefs: 01552757
L, xrefs: 01553B01
b, xrefs: 015543E7
a, xrefs: 0155341A
, xrefs: 015532C8
\, xrefs: 01553A81
U, xrefs: 0155307E
V, xrefs: 01552E52
c, xrefs: 015543E2
4, xrefs: 015526D2
b, xrefs: 015541A9
9, xrefs: 015528B7
g, xrefs: 01553CA7
a, xrefs: 01553903
`, xrefs: 01554287
X, xrefs: 01553A61
t, xrefs: 015539C1
D, xrefs: 01553908
], xrefs: 015530BE
q, xrefs: 015536F8
/, xrefs: 0155294E
Y, xrefs: 01552B84
N, xrefs: 01553B11
u, xrefs: 01553718
a, xrefs: 01553C97
{, xrefs: 01553748
F, xrefs: 01553912
J, xrefs: 01552F04
R, xrefs: 01553AB1
\, xrefs: 015530B6
h, xrefs: 01552CF7
I, xrefs: 01552EFF
I, xrefs: 01552D37
`, xrefs: 015543F1
., xrefs: 01552CFF
b, xrefs: 01553415
&, xrefs: 01552D3F
P, xrefs: 01553AA1
h, xrefs: 015539E1
V, xrefs: 01553AD1
@, xrefs: 01553D27
x, xrefs: 01553197
, xrefs: 01552D0F
j, xrefs: 015539F1
8, xrefs: 01553527
Z, xrefs: 01552B89
@, xrefs: 01553B21
T, xrefs: 01553AC1
., xrefs: 015540F1
|, xrefs: 01553750
{, xrefs: 01552B7F
r, xrefs: 01553D17
p, xrefs: 01553CE7
s, xrefs: 01553708
l, xrefs: 01552EFA
,, xrefs: 01552CEF
r, xrefs: 015539B1
[, xrefs: 015530AE
O, xrefs: 01553B19
`, xrefs: 015544B8
Y, xrefs: 0155309E
a, xrefs: 015543EC
!, xrefs: 015532D0
|, xrefs: 01553981
b, xrefs: 01553A31
6, xrefs: 01553288
p, xrefs: 01553D07
o, xrefs: 015536E8
`, xrefs: 015541B6
Z, xrefs: 01553A71
c, xrefs: 01554278
b, xrefs: 015544AE
a, xrefs: 01553FB5
x, xrefs: 01553961
b, xrefs: 01553FB0
`, xrefs: 01553A21
:, xrefs: 01553076
d, xrefs: 01553A41
f, xrefs: 015535CA
c, xrefs: 015541A4
y, xrefs: 01553738
~, xrefs: 01553187
/, xrefs: 015532B8
`, xrefs: 0155341F
c, xrefs: 015544A9
w, xrefs: 01553728
E, xrefs: 0155390D
a, xrefs: 015541AE
n, xrefs: 01553A11
`, xrefs: 015533A8
|, xrefs: 01553C87
1, xrefs: 0155352C
f, xrefs: 01553A51
y, xrefs: 01552A62
^, xrefs: 01553A91
K, xrefs: 01552F09
3, xrefs: 015527E6
t, xrefs: 01553177
b, xrefs: 0155427D
l, xrefs: 01553A01
a, xrefs: 015544B3
f, xrefs: 01553CC7
~, xrefs: 01553991
}, xrefs: 01553758
c, xrefs: 01553410
$, xrefs: 01552D2F
M, xrefs: 015540E9
z, xrefs: 01553971

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: $ $!$"$$$&$'$*$,$.$.$/$/$1$3$3$4$6$8$8$9$:$@$@$A$D$D$D$E$F$H$I$I$J$J$K$L$L$M$N$O$O$P$R$T$U$V$V$W$X$Y$Y$Z$Z$Z$[$\$\$]$^$`$`$`$`$`$`$`$`$a$a$a$a$a$a$a$a$b$b$b$b$b$b$b$c$c$c$c$c$c$d$e$f$f$f$g$h$h$j$l$l$m$n$o$p$p$p$q$q$r$r$r$s$t$t$u$v$w$w$x$x$y$y$z${${$|$|$|$}$~$~
API String ID: 0-970517751
Opcode ID: 0255fea9e1c77111387bb5d9dfc76eba18e9e0458520c4d4637603f388b3bcb0
Instruction ID: 6afae14da58e86c87807b239019cb0ec4de0988467b019aa574f76b2661b13c1
Opcode Fuzzy Hash: 0255fea9e1c77111387bb5d9dfc76eba18e9e0458520c4d4637603f388b3bcb0
Instruction Fuzzy Hash: 78035B3150C7C18AD3659B3884943AFBBE2BBD6314F088E6ED5E98B392D7798445CB13

Function 01563E4B Relevance: 33.2, Strings: 26, Instructions: 700COMMON

Download Yara Rule

Strings

5I, xrefs: 015649F5
3d4f, xrefs: 01564551
\, xrefs: 0156443E
;=, xrefs: 01564BC6
tv, xrefs: 015641D1
:xz, xrefs: 015645E9, 015640D9, 015643BF, 01564826, 01564391, 015645A0
*;, xrefs: 01564347
.p r, xrefs: 0156451A
$h+j, xrefs: 01564530
#l%n, xrefs: 0156453B
?1, xrefs: 01564BCE
.`1b, xrefs: 01564546
KM, xrefs: 015646F9
LM, xrefs: 015646EE
;H, xrefs: 015644D8
5, xrefs: 0156435D
*;, xrefs: 015649DF
:xz, xrefs: 01564A64
96, xrefs: 01564352
5;, xrefs: 0156433C
96, xrefs: 015649EA
3M, xrefs: 01564BD6
5;, xrefs: 015649D4
*|.~, xrefs: 0156450F
\], xrefs: 0156407B
KX&Z, xrefs: 015644AC

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: #l%n$$h+j$*|.~$*;$*;$.`1b$.p r$3d4f$3M$5$5;$5;$5I$96$96$:xz$:xz$;H$;=$?1$KX&Z$KM$LM$\$\]$tv
API String ID: 0-2044070504
Opcode ID: 36e753b6435b235d5739ca924148e167e2376f4ad8575e23947b9810887fafc2
Instruction ID: 8cfcbfe7d8d615728a17c8d9af72848746c26d2a31da47c53a2cdf849dab1898
Opcode Fuzzy Hash: 36e753b6435b235d5739ca924148e167e2376f4ad8575e23947b9810887fafc2
Instruction Fuzzy Hash: 3C6240B560C3818AD330CF14D841B9FBAF2FB82304F408D2DDAD9AB215D675954ADB97

Function 015615F0 Relevance: 28.1, Strings: 22, Instructions: 608COMMON

Download Yara Rule

Strings

y, xrefs: 01561C69
`, xrefs: 01561D60
$, xrefs: 01561A76
b, xrefs: 01561AE8
/, xrefs: 01561A7B
c, xrefs: 01561AE3
c, xrefs: 0156168A
a, xrefs: 01561AED
a, xrefs: 01561D5B
b, xrefs: 0156168F
=, xrefs: 015618E5
`, xrefs: 01561699
,, xrefs: 01561BCF
x, xrefs: 01561C64
c, xrefs: 01561D51
/, xrefs: 01561A80
a, xrefs: 01561694
!@, xrefs: 01561623
`, xrefs: 01561AF2
?, xrefs: 015618EF
,, xrefs: 01561A71
b, xrefs: 01561D56

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: !@$$$,$,$/$/$=$?$`$`$`$a$a$a$b$b$b$c$c$c$x$y
API String ID: 0-2322859148
Opcode ID: 11d54956331a99820397159e1e7241417e9b710f7c5547530e123e464785104d
Instruction ID: 86611ec8bc53498c68a9ccf51925b1627b3c8c446ab7f5427c7b4bad113c1baa
Opcode Fuzzy Hash: 11d54956331a99820397159e1e7241417e9b710f7c5547530e123e464785104d
Instruction Fuzzy Hash: DC32D37160CB808FD3249B28C49537EFBE5BBD5314F09892DE5D58B392D6B98845CB83

Function 01576690 Relevance: 19.0, Strings: 15, Instructions: 246COMMON

Download Yara Rule

Strings

Z, xrefs: 015766F5
5, xrefs: 0157689D
X, xrefs: 0157669E
Y, xrefs: 015766F0
~, xrefs: 0157674F
C, xrefs: 01576898
j, xrefs: 01576795
#, xrefs: 015768ED
\, xrefs: 0157688E
Z, xrefs: 015766A8
Y, xrefs: 015766A3
e, xrefs: 01576786
X, xrefs: 015766EB
`, xrefs: 0157678B
i, xrefs: 01576893

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: #$5$C$X$X$Y$Y$Z$Z$\$`$e$i$j$~
API String ID: 0-3294723363
Opcode ID: 218b22c1c0bb5ff38fa90c5a0a5a95447d190bf781458c7b06e1a19171da4b10
Instruction ID: 32ef475796a1cb9d05bb94d405f548b438a4c81d5aef0458ab657053ab447e0c
Opcode Fuzzy Hash: 218b22c1c0bb5ff38fa90c5a0a5a95447d190bf781458c7b06e1a19171da4b10
Instruction Fuzzy Hash: 41911523A0CBD14AE305857C980535FEED31BE2124F1DCA6DE4E59B3C6D5B9C90683A3

Function 01559C10 Relevance: 15.3, APIs: 2, Strings: 6, Instructions: 1297COMMON

Download Yara Rule

APIs

Part of subcall function 0157B480: LdrInitializeThunk.NTDLL(0157D4FB,005C003F,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 0157B4AE

FreeLibrary.KERNEL32(?), ref: 0155A21A
FreeLibrary.KERNEL32(?), ref: 0155A29B

Strings

cba`, xrefs: 0155AA31
cba`, xrefs: 0155A13D
wEtG, xrefs: 01559F94
I,~M, xrefs: 0155AA47
cba`, xrefs: 01559C63
PQ, xrefs: 01559FAC

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID: FreeLibrary$InitializeThunk
String ID: I,~M$PQ$cba`$cba`$cba`$wEtG
API String ID: 764372645-3803835663
Opcode ID: 48f1b55862a3a6587083e5367ed6cf8be7bb9944cff49260c2ee888507042a76
Instruction ID: 4abbda764d0e877fc896b7f3e482d088d8128e4e8cd045916be1b3d32d1f0823
Opcode Fuzzy Hash: 48f1b55862a3a6587083e5367ed6cf8be7bb9944cff49260c2ee888507042a76
Instruction Fuzzy Hash: 389228706083409FE765CF69D8A1B3FBBE2BBC0708F18992DE9858F242D7759845C792

Function 0154E2A9 Relevance: 14.0, APIs: 2, Strings: 7, Instructions: 529COMMON

Download Yara Rule

APIs

CoUninitialize.OLE32 ref: 0154E2B5
CoUninitialize.OLE32 ref: 0154E673

Strings

lev-tolstoi.com, xrefs: 0154E649, 0154E9DD
"# `, xrefs: 0154E70A
s, xrefs: 0154E736
qx, xrefs: 0154E8EE
,, xrefs: 0154E688
I~, xrefs: 0154E8E3
`~, xrefs: 0154E8CD

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID: Uninitialize
String ID: "# `$,$I~$`~$lev-tolstoi.com$qx$s
API String ID: 3861434553-2978658354
Opcode ID: 71227bb779aba482fa3e807ee8efe8cd1245f13a5598148c24f16567c82d3978
Instruction ID: a1ac91c2c7fd1281d0399da75146414dfb7a1a900dfd3259ca6a6254c7bd80ca
Opcode Fuzzy Hash: 71227bb779aba482fa3e807ee8efe8cd1245f13a5598148c24f16567c82d3978
Instruction Fuzzy Hash: 25029DB010C3D18BD776CF2984A17EFBFE1FF92204F1899ACD5DA5B246D679040A8B52

Function 00078A1F Relevance: 13.7, APIs: 4, Strings: 3, Instructions: 1487stringCOMMON

Download Yara Rule

APIs

localeconv.MSVCRT ref: 00078A2E
strlen.MSVCRT ref: 00078A38
_errno.MSVCRT ref: 00079C50
_errno.MSVCRT ref: 00079D3C

Strings

, xrefs: 00079904
P, xrefs: 00079D0C
5, xrefs: 00078EF3

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: _errno$localeconvstrlen
String ID: $5$P
API String ID: 2486237476-2425386841
Opcode ID: a7cfa924f482b2d22e7e8b7e496e30d7bb38ba802f1f04adaef8a0eb5d6660b2
Instruction ID: f23c565baac84dc0cf35d29eb9493413d62b31fca219482070e7457f57f4fb87
Opcode Fuzzy Hash: a7cfa924f482b2d22e7e8b7e496e30d7bb38ba802f1f04adaef8a0eb5d6660b2
Instruction Fuzzy Hash: C6D246B0E04619CFCB64CFA8C98469DBBF1FF48300F24C56AD449AB256DB389985CF59

Function 01565920 Relevance: 12.9, Strings: 10, Instructions: 398COMMON

Download Yara Rule

Strings

cba`, xrefs: 01565C50
cba`, xrefs: 01565E6C
Z\, xrefs: 015659FF
=j9l, xrefs: 0156599F
z%|, xrefs: 015659BF
^P, xrefs: 01565A07
3v#H, xrefs: 015659D7
<b"d, xrefs: 015659AF
&f?x, xrefs: 015659B7
"r,t, xrefs: 015659CF

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: z%|$"r,t$&f?x$3v#H$<b"d$=j9l$cba`$cba`$Z\$^P
API String ID: 0-3047316687
Opcode ID: ecb25055e9c5e794c0a47339c77426a4709e10382b36c901557eec1277484510
Instruction ID: bf9bf90ba3761f62a329123d6177bb85a2ba0f956d556b18f90cf137b50a7b55
Opcode Fuzzy Hash: ecb25055e9c5e794c0a47339c77426a4709e10382b36c901557eec1277484510
Instruction Fuzzy Hash: 9CD10EB15583819FE7248F24E88176FBBE6FBD0304F55982CE595AB251EB34D805CF82

Function 015633A0 Relevance: 12.7, APIs: 1, Strings: 6, Instructions: 471COMMON

Download Yara Rule

Strings

VW, xrefs: 015633E5
$^<P, xrefs: 0156363F
#R,T, xrefs: 01563647
KM, xrefs: 015637FB
ij, xrefs: 0156397D
]~"p, xrefs: 0156367F

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: #R,T$$^<P$VW$]~"p$ij$KM
API String ID: 0-788320361
Opcode ID: 8bccf5334f8a4c2fa67e420f35ed227ded6f4a6f351b7ab12de627ca266c6f7a
Instruction ID: 80c0995970076f41880b40b519c0fbd634842b39da275a387711961a430e8677
Opcode Fuzzy Hash: 8bccf5334f8a4c2fa67e420f35ed227ded6f4a6f351b7ab12de627ca266c6f7a
Instruction Fuzzy Hash: 7AF1CAB06083418FD3109F69D88162FBBE5FFD5704F04892CE5AA8F255EB789909CB93

Function 01571A30 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 109clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 01571A40
GetWindowLongW.USER32 ref: 01571A65
GetClipboardData.USER32 ref: 01571A75
GlobalLock.KERNEL32 ref: 01571A8E
GlobalUnlock.KERNEL32 ref: 01571B90
CloseClipboard.USER32 ref: 01571B99

Strings

K, xrefs: 01571B1E

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: K
API String ID: 2832541153-856455061
Opcode ID: 92cc8822a0008c4340f790f93f2715a9043e6df63c3f72ee27fee43349a7fe36
Instruction ID: 7ebb8d063fd21b6e148109103ff29a3a4d05c836f140d43d07963d1ee7868a94
Opcode Fuzzy Hash: 92cc8822a0008c4340f790f93f2715a9043e6df63c3f72ee27fee43349a7fe36
Instruction Fuzzy Hash: 5D41817150C7828FD310AF7C948926EBFE06B92224F054F6DE4E98B2C6E6348549C793

Function 01564D70 Relevance: 11.9, Strings: 9, Instructions: 627COMMON

Download Yara Rule

Strings

cba`, xrefs: 01564B66
AK, xrefs: 01564DBC
NO, xrefs: 01564EC2
sF, xrefs: 01564DC4
;=, xrefs: 01564BC6
3M, xrefs: 01564BD6
?1, xrefs: 01564BCE
~, xrefs: 01564DCC
_A, xrefs: 01564F11, 01564F27, 01564F60

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: 3M$;=$?1$AK$NO$cba`$sF$~$_A
API String ID: 0-385988797
Opcode ID: e3541d1b5ab8e76d7841b388dfa8a4e5a92115ff61adecab54dc5d13f98ce222
Instruction ID: d0bb747968a8e7cccdfb3cd60743691d5bdb7b1bef3f02b8b151749ab7a56ffd
Opcode Fuzzy Hash: e3541d1b5ab8e76d7841b388dfa8a4e5a92115ff61adecab54dc5d13f98ce222
Instruction Fuzzy Hash: 8812FF36918312CBC324DF28C8906AFB7F1FF85754F56892CE9D69B260E7309905DB82

Function 0007C720 Relevance: 11.0, APIs: 5, Strings: 1, Instructions: 537stringCOMMON

Download Yara Rule

APIs

localeconv.MSVCRT ref: 0007C72B
strlen.MSVCRT ref: 0007C9FC
_errno.MSVCRT ref: 0007CB24
_errno.MSVCRT ref: 0007CBEB
_errno.MSVCRT ref: 0007CC03

Strings

, xrefs: 0007CA32

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: _errno$localeconvstrlen
String ID:
API String ID: 2486237476-3916222277
Opcode ID: c4f9cdc1f8bda86191455fb47de7c997f7e417ab905aa990271118333a8fb1c7
Instruction ID: db4eb2ac56d45155fc4087c56dfcec8dbb6ce73e9db29cbcbf29574fc3f95593
Opcode Fuzzy Hash: c4f9cdc1f8bda86191455fb47de7c997f7e417ab905aa990271118333a8fb1c7
Instruction Fuzzy Hash: 5322AF71D042598FEB65CF68C484AADBBF1BF48310F19C16EE859AB342C7389D41CB99

Function 00075D2F Relevance: 10.4, APIs: 8, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 115adc365c6a7a7d7ebea708b54a6e10b5ec0353e89553731849df89d1fcd662
Instruction ID: 25788b401747438f923e2906a4ca8e35d1bfa1050d3085507bd65f1fd9640919
Opcode Fuzzy Hash: 115adc365c6a7a7d7ebea708b54a6e10b5ec0353e89553731849df89d1fcd662
Instruction Fuzzy Hash: 7EE19270F04E418FDBA4AF398C853AAA7D2AB44311F54C479E44E8B247DA7ECD468B4D

Function 01549360 Relevance: 10.4, Strings: 8, Instructions: 405COMMON

Download Yara Rule

Strings

, xrefs: 015496A0, 0154977E
/37), xrefs: 015494A7
}x, xrefs: 015493C0
YAG~u, xrefs: 015495EE
u, xrefs: 01549549
`;;2, xrefs: 01549734
8>&:, xrefs: 015494B7
`;;2, xrefs: 0154960E

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: /37)$8>&:$YAG~u$`;;2$`;;2$u$}x$
API String ID: 0-2031701488
Opcode ID: afbf182f086d4cb3678fef5cd9cf034a3b5aeb1cf8c39da1fee8d2667e1554dd
Instruction ID: 57dfddd123d43a8d73ca6f59db1fbdec1c1b8160664665841c6ca087fdf3d64c
Opcode Fuzzy Hash: afbf182f086d4cb3678fef5cd9cf034a3b5aeb1cf8c39da1fee8d2667e1554dd
Instruction Fuzzy Hash: 92C1F67150C3914FD316CF2984A13AFBFD2AFD7219F18899CE4D24F282D6398909C792

Function 000765B4 Relevance: 9.3, APIs: 4, Strings: 2, Instructions: 297stringCOMMON

Download Yara Rule

APIs

strncmp.MSVCRT ref: 000765F3
strlen.MSVCRT ref: 00076658
strlen.MSVCRT ref: 00076875
strlen.MSVCRT ref: 000768C8

Strings

F, xrefs: 0007664C
_GLOBAL_, xrefs: 000765E8

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: strlen$strncmp
String ID: F$_GLOBAL_
API String ID: 2920004640-3892140033
Opcode ID: 50fa886feaa2e486ccff98ede4eb7c32752cb5672309e04ee33fb1a2784acf45
Instruction ID: b752767e8aed41d7049f3d8e5fc4152799b403849885f64cbca1381770f55044
Opcode Fuzzy Hash: 50fa886feaa2e486ccff98ede4eb7c32752cb5672309e04ee33fb1a2784acf45
Instruction Fuzzy Hash: 15C16E70D086598FEB65DF28C8813DDFBF1AF4A304F4481AAC45EA7242E7399A85CF45

Function 015696D8 Relevance: 9.1, Strings: 7, Instructions: 340COMMON

Download Yara Rule

Strings

9nI9, xrefs: 015699D6
[93=, xrefs: 015699E6
fa, xrefs: 015699F6
cba`, xrefs: 0156974C
='0{, xrefs: 015699DE
);?g, xrefs: 015699EE
;>*2, xrefs: 015699CE

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: );?g$9nI9$;>*2$='0{$[93=$cba`$fa
API String ID: 0-154584671
Opcode ID: 55da0ad24151448404b27225d4b8e2404780cbea41262d9db1175a504f65ee38
Instruction ID: 80bfc6a80fdffd5679d703579a167823c1076cfa9531bf993808e0f4799dee8d
Opcode Fuzzy Hash: 55da0ad24151448404b27225d4b8e2404780cbea41262d9db1175a504f65ee38
Instruction Fuzzy Hash: 94C1027550C3A18FC3218F29C49066EBBE6BF86314F088A6DF9E15B396C3358945CB92

Function 0155DE40 Relevance: 8.4, Strings: 6, Instructions: 886COMMON

Download Yara Rule

Strings

n, xrefs: 0155E55E
P9&', xrefs: 0155E146
I6F8, xrefs: 0155E54E
@@=:, xrefs: 0155E269
J:<<, xrefs: 0155E556
-+, xrefs: 0155E238

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: @@=:$I6F8$J:<<$P9&'$n$-+
API String ID: 0-2611983443
Opcode ID: 9ab627e7325968820aa3c67b873a09a26ff1ef6d95c6cb999cac34a8de330007
Instruction ID: b0691e6079b68ddb32bddebbeec3fc0ce8fb3b21bd61ece57cff03e389389139
Opcode Fuzzy Hash: 9ab627e7325968820aa3c67b873a09a26ff1ef6d95c6cb999cac34a8de330007
Instruction Fuzzy Hash: 415246715083918FD725CF28D85166EBFE1FFD6204F098A6EE8E85F392D6318905C792

Function 0155C360 Relevance: 8.1, Strings: 6, Instructions: 626COMMON

Download Yara Rule

Strings

CE, xrefs: 0155C76D
GI, xrefs: 0155C775
=z9|, xrefs: 0155C917
Vj)l, xrefs: 0155C9D2
}~, xrefs: 0155C91F
JK, xrefs: 0155C77D

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: =z9|$JK$Vj)l$}~$CE$GI
API String ID: 0-2837980318
Opcode ID: 6a3b9e2d5daf200a27f5627cf5dcf1a23389df3e9476f2ab3d6d2ee72a596930
Instruction ID: 04b98aad076986133078b0c61fd7f7819373fccca155aafdb8e5ca1a68369277
Opcode Fuzzy Hash: 6a3b9e2d5daf200a27f5627cf5dcf1a23389df3e9476f2ab3d6d2ee72a596930
Instruction Fuzzy Hash: 4B02DAB550C3408BC710DF69D8A266FBBE2FFD5314F08985DE4C68B352E6348609CB96

Function 000CB240 Relevance: 7.6, Strings: 6, Instructions: 112COMMON

Download Yara Rule

Strings

Auth, xrefs: 000CB33A
Auth, xrefs: 000CB392
Genu, xrefs: 000CB333
random_device::random_device(const std::string&): unsupported token, xrefs: 000CB2FD
random_device::random_device(const std::string&): device not available, xrefs: 000CB3B6
Genu, xrefs: 000CB38B

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: memcmpstrlen
String ID: Auth$Auth$Genu$Genu$random_device::random_device(const std::string&): device not available$random_device::random_device(const std::string&): unsupported token
API String ID: 3108337309-320053920
Opcode ID: d6b5c38bc100756270d972a60ec45fc01d8eda182ab24ecd09e724f32481da3d
Instruction ID: b47a606cbf49b3e5266d96a9c5ac189363374ff28b16e246892d2f44f8bc3796
Opcode Fuzzy Hash: d6b5c38bc100756270d972a60ec45fc01d8eda182ab24ecd09e724f32481da3d
Instruction Fuzzy Hash: 1231F7B0504388CBDF60AF25D682BBE7BE0AF50354F10983CD585AB643C779CE069751

Function 0156D085 Relevance: 6.6, Strings: 5, Instructions: 368COMMON

Download Yara Rule

Strings

AGsW, xrefs: 0156D496
#, xrefs: 0156D4AC
0, xrefs: 0156D430
P, xrefs: 0156D554
k, xrefs: 0156D4B6

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: #$0$AGsW$P$k
API String ID: 0-1629916805
Opcode ID: 2cd846922415a2fd05508be4b878acde3fd620c22dd6e51575a52c09f39a1528
Instruction ID: 74d28dde7eeceeee4fb77f5d88a76e8d04a8514490c383c7bb4efa284efc13b8
Opcode Fuzzy Hash: 2cd846922415a2fd05508be4b878acde3fd620c22dd6e51575a52c09f39a1528
Instruction Fuzzy Hash: 85C1E4713083818ED328CF79C4913ABBBE6BFD2314F588A6DE4D98B2D1D6798449C752

Function 01576C40 Relevance: 6.5, Strings: 5, Instructions: 265COMMON

Download Yara Rule

Strings

cba`cba`, xrefs: 01576DDF
a, xrefs: 01576ED4
b, xrefs: 01576ED0
c, xrefs: 01576ECC
`, xrefs: 01576ED8

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: `$a$b$c$cba`cba`
API String ID: 0-3925122358
Opcode ID: 534751f0ba35b4ff9d7c859c2f26b235b59c1e1dd1fdacebca8f3f0d7fd752d7
Instruction ID: 3999ba750acb5f1ffbb815d6837e192039dd9fd9e032cf6f3d23c365db850f5c
Opcode Fuzzy Hash: 534751f0ba35b4ff9d7c859c2f26b235b59c1e1dd1fdacebca8f3f0d7fd752d7
Instruction Fuzzy Hash: 68A12771E087548FEB05CAACD4563AEBFF2BB85304F0D886DC856AB386C6758944CB52

Function 0154C36E Relevance: 6.5, Strings: 5, Instructions: 203COMMON

Download Yara Rule

Strings

F'k), xrefs: 0154C706
4cde, xrefs: 0154C79C
CJ, xrefs: 0154C67E
){+}, xrefs: 0154C788
GS, xrefs: 0154C677

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: ){+}$4cde$CJ$F'k)$GS
API String ID: 0-4192230409
Opcode ID: 4b114a3422fe73ed5f5f1ee8a396e36ed052a29f3028d0b545873efc2472e1f7
Instruction ID: d62cda8fbe8ae883e9b0d764416ae50f63a2434ebfa7b5b34bacec5febde9eae
Opcode Fuzzy Hash: 4b114a3422fe73ed5f5f1ee8a396e36ed052a29f3028d0b545873efc2472e1f7
Instruction Fuzzy Hash: 9CB11BB84053058FE354DF629588FAA7BB0FB25314F1A82E8E0992F776D7748405CF96

Function 00081866 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

_strdup.MSVCRT ref: 000818C4
free.MSVCRT ref: 000818D9
IsDebuggerPresent.KERNEL32 ref: 000818F9
RaiseException.KERNEL32 ref: 00081928

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: DebuggerExceptionPresentRaise_strdupfree
String ID:
API String ID: 2994003445-0
Opcode ID: 5d360c4c386e15a41418cab5674f1074edc21731b35c9b7496c369adb714d1dd
Instruction ID: ee6d8fe496f2d4629553d89f332ee6bad3b1fb6a4b131c86f1a54f71d1c5268d
Opcode Fuzzy Hash: 5d360c4c386e15a41418cab5674f1074edc21731b35c9b7496c369adb714d1dd
Instruction Fuzzy Hash: 02216970A04204CBEB50EF69C45479ABBE9FF44360F05906AE8D89B341D775C942CB92

Function 0007DE7C Relevance: 6.0, APIs: 4, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0007DE8E
GetProcAddress.KERNEL32 ref: 0007DEA6
LoadLibraryW.KERNEL32 ref: 0007DEB5
GetProcAddress.KERNEL32 ref: 0007DEC7

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID:
API String ID: 384173800-0
Opcode ID: 0a9dea491f9071e2753ff9e4807552efd7eef91a9e0ded3c71fa1fb46fe9f320
Instruction ID: 4d0d02c840f0f1f41e47bf62fa0966ecec92b3280e50f2074b018191c753e1b8
Opcode Fuzzy Hash: 0a9dea491f9071e2753ff9e4807552efd7eef91a9e0ded3c71fa1fb46fe9f320
Instruction Fuzzy Hash: 66F0FFF1505309AFE7506F68DC4447ABBF8EB49750F00841DF68887611D7795940DBA6

Function 0156B763 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 308COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 0156BA82

Strings

qjjw, xrefs: 0156B9A6
3, xrefs: 0156D6CD

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID: FreeLibrary
String ID: 3$qjjw
API String ID: 3664257935-3235754969
Opcode ID: 10f1fbb386154418d7630b4ce3a3dcfd0a7265c254a2468e085d4d265db82a72
Instruction ID: 7d0a0e32673bbc11b3f8d835554e75c9bfaa40648dc90d16ff487ec7b14da2d4
Opcode Fuzzy Hash: 10f1fbb386154418d7630b4ce3a3dcfd0a7265c254a2468e085d4d265db82a72
Instruction Fuzzy Hash: F6A137717083819FE7258F28C8917AFBBE6AFD2344F18896DD5C98F386D6748409C792

Function 015680B0 Relevance: 5.4, Strings: 4, Instructions: 440COMMON

Download Yara Rule

Strings

i>}0, xrefs: 015683AC
12, xrefs: 015683B8
'|, xrefs: 01568275
-., xrefs: 01568576

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: '|$-.$12$i>}0
API String ID: 0-2215797287
Opcode ID: 06a87ad9f9924d144ffa3aca3b7d0b6414d98c352102060e405bc7b31e188a34
Instruction ID: 140524a0b8d52dd76dc6fea9e490d6daab5e79e8d779288f3e80529135bdbc2d
Opcode Fuzzy Hash: 06a87ad9f9924d144ffa3aca3b7d0b6414d98c352102060e405bc7b31e188a34
Instruction Fuzzy Hash: C9D1DE722083118FD725CF28D89179FB7E2FFC5314F05892DE5A58B285EB74950ACB92

Function 01571BB0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 179COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 01571BF9
GetSystemMetrics.USER32 ref: 01571C09

Strings

, xrefs: 01571CF6

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: 67a3f2f65880e1f8cff5b4eac55945c5b385090ff85bdb48cf124e91d23b3c1b
Instruction ID: 3d822928e9ae8299b6710f28a6973fb077144b2a2de730e140f11250f67077fb
Opcode Fuzzy Hash: 67a3f2f65880e1f8cff5b4eac55945c5b385090ff85bdb48cf124e91d23b3c1b
Instruction Fuzzy Hash: 08B16BB01193818BD375EF18D48879FBBE0BB85308F514D1DE5E9AB250EBB594489F82

Function 0157533A Relevance: 5.4, Strings: 4, Instructions: 405COMMON

Download Yara Rule

Strings

a, xrefs: 015757ED
c, xrefs: 015757E5
`, xrefs: 015757F1
b, xrefs: 015757E9

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: `$a$b$c
API String ID: 0-1877310501
Opcode ID: 4d883f5f1d6c5dbb0ffa2925b471e06381496d5e7b0765e622db2667ce186b4e
Instruction ID: 94cbde077a6553b04e43f3dabed49368c5ed5b1098fab07053282c20e210f1c2
Opcode Fuzzy Hash: 4d883f5f1d6c5dbb0ffa2925b471e06381496d5e7b0765e622db2667ce186b4e
Instruction Fuzzy Hash: F312812150CBD2DED326C63C8848749BF913B67328F0C8398D4E55BBD2D3A9A565C7E2

Function 015497B0 Relevance: 5.4, Strings: 4, Instructions: 396COMMON

Download Yara Rule

Strings

C87B982DF57FAA5523D904AF30EFEBBC, xrefs: 0154987B
EIFT, xrefs: 01549875, 01549880, 015498C1
_P, xrefs: 01549C05
w, xrefs: 0154995C

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: C87B982DF57FAA5523D904AF30EFEBBC$EIFT$_P$w
API String ID: 0-783153403
Opcode ID: 423f2ea22939bd4f5246afe25b17d651880dd586b69700b30c32daf258dcd82c
Instruction ID: c9a066fc3a32cc2eaddb355031d4d64bd1aa7fbf61221c97f10af1b4684c9b63
Opcode Fuzzy Hash: 423f2ea22939bd4f5246afe25b17d651880dd586b69700b30c32daf258dcd82c
Instruction Fuzzy Hash: 6DC1257160C3409BD718CF39C8526AFBBE6BBD5218F18892DE4D68B391DA38C509CB56

Function 01566170 Relevance: 5.3, Strings: 4, Instructions: 318COMMON

Download Yara Rule

Strings

cba`, xrefs: 015661C1
4zVc, xrefs: 0156621C
8zVc, xrefs: 0156627D
YNMZ, xrefs: 01566446

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID: InitializeThunk
String ID: 4zVc$8zVc$YNMZ$cba`
API String ID: 2994545307-1799417857
Opcode ID: ee4d73902316c71aba888d1e1614a8f2beba59c3f3002d817856adee3604f909
Instruction ID: bb297d23e15730b251ee22ba77bef8cec07c279e9763137a51777be6376b50e9
Opcode Fuzzy Hash: ee4d73902316c71aba888d1e1614a8f2beba59c3f3002d817856adee3604f909
Instruction Fuzzy Hash: 019135B2E042119BD724DE29D881B3FB6AAFBD1318F19852CE9859F245E674A800C7E1

Function 01555ADC Relevance: 4.1, Strings: 3, Instructions: 398COMMON

Download Yara Rule

Strings

WL, xrefs: 01555C75
1/3T, xrefs: 0155611F
^Q, xrefs: 01555C83

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: 1/3T$WL$^Q
API String ID: 0-4254228366
Opcode ID: 7662fe259715a5f7ee9c038ae43cb50b02cd749cb08904767362a8afc4d2b8e0
Instruction ID: 156a5cc8ea5e5d51c427ccdfa17d4662709347f94ef47f0e3598c3fc282d019e
Opcode Fuzzy Hash: 7662fe259715a5f7ee9c038ae43cb50b02cd749cb08904767362a8afc4d2b8e0
Instruction Fuzzy Hash: F7D1F0B0110702CFD7658F29C8A1B62BBB1FF46314F198A8DC8964F7A2E778E455CB90

Function 01558731 Relevance: 4.1, Strings: 3, Instructions: 330COMMON

Download Yara Rule

Strings

tuv, xrefs: 01558856
lfpu, xrefs: 01558991
t~x}, xrefs: 0155899F

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: lfpu$t~x}$tuv
API String ID: 0-2272480740
Opcode ID: c1ee53870d69103a3a29a8916330ce48494baeeae95550a6fadaf944e657ec4e
Instruction ID: 1f41d18c4ac34410e45504c280a99b6b3f3ce0aa49dc26ba6b596e282b8415c8
Opcode Fuzzy Hash: c1ee53870d69103a3a29a8916330ce48494baeeae95550a6fadaf944e657ec4e
Instruction Fuzzy Hash: ABA177B5600602CFE721CF2AE891B267BB2FF95314F0A85ACD5468F366E735E805CB51

Function 01558FAD Relevance: 4.1, Strings: 3, Instructions: 307COMMON

Download Yara Rule

Strings

Z7]9, xrefs: 01559011
t3]5, xrefs: 0155900A
B? !, xrefs: 0155901F

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: B? !$Z7]9$t3]5
API String ID: 0-3999537062
Opcode ID: 1e471f9ead2c2c90b5814883833d34960af53ea37627d8851a58631726faec95
Instruction ID: 5fed846c8a61ab62952ebab453f114518b736542e5721e70dd592f1cfc4f33ce
Opcode Fuzzy Hash: 1e471f9ead2c2c90b5814883833d34960af53ea37627d8851a58631726faec95
Instruction Fuzzy Hash: 2E811170500712CBCB25CF29C8A0667B7F2FF96764B19C65EC8864FA66E339E442CB40

Function 015592BA Relevance: 4.0, Strings: 3, Instructions: 300COMMON

Download Yara Rule

Strings

Z7]9, xrefs: 0155931E
B? !, xrefs: 0155932C
t3]5, xrefs: 01559317

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: B? !$Z7]9$t3]5
API String ID: 0-3999537062
Opcode ID: 511423f0a0889b0305dcf414e9d2eecaa842387d103bd69e006b687535c51f25
Instruction ID: f21b107c1a0d9b4671a370769a141f59c4f74e6ae3430249fd0303a6e7d99d7b
Opcode Fuzzy Hash: 511423f0a0889b0305dcf414e9d2eecaa842387d103bd69e006b687535c51f25
Instruction Fuzzy Hash: CC810171600712CBC321CF29C491667F7B2FF95758B1AD69EC8860F762E339A852CB90

Function 0156BFDA Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 461COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 0156C0D7

Strings

x, xrefs: 0156C2F2

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID: FreeLibrary
String ID: x
API String ID: 3664257935-2363233923
Opcode ID: d97be11bc0fdb6cb4efed582d22c4bbc99e0625f6bbad7e83afa12f1d7290680
Instruction ID: ecfd034c8d0d50dd5551766fd876ef816a1b5aa1f59a73338e596423d7632ace
Opcode Fuzzy Hash: d97be11bc0fdb6cb4efed582d22c4bbc99e0625f6bbad7e83afa12f1d7290680
Instruction Fuzzy Hash: 8CD1C26060C3D18EDB368B2984503AFBFD5AFD7244F5849ADD1C99B282D739450ACBA3

Function 0154D44C Relevance: 3.9, Strings: 3, Instructions: 187COMMON

Download Yara Rule

Strings

P, xrefs: 0154D5A5
OK, xrefs: 0154D44C
$, xrefs: 0154D4B7

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: $$OK$P
API String ID: 0-279604475
Opcode ID: 7ef919200a3009686c932eab3bbdc63914b73aac80722462ac020bd0dcbd76e0
Instruction ID: 4908504952c9dd96eb3ebd6e5ed77ed67e864c6c22d3b2cf7f51c9fe48b7c766
Opcode Fuzzy Hash: 7ef919200a3009686c932eab3bbdc63914b73aac80722462ac020bd0dcbd76e0
Instruction Fuzzy Hash: 03514C72A583914BD334CB38DC917EFBAD2ABD5209F1DC97DC4CDAB209EA3805458742

Function 0007B858 Relevance: 3.7, Strings: 2, Instructions: 1157COMMON

Download Yara Rule

Strings

, xrefs: 0007C535
9, xrefs: 0007C51E

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: $9
API String ID: 0-1776416348
Opcode ID: 4210d1d11f95449cb52a9993d8aaa8dc86aff6e012ea0359615a3df0ed9ab7b8
Instruction ID: 61fa7b99794d2f0c08e17edae28a7f58fda8e83d7d90a237cf41c256d59e79ac
Opcode Fuzzy Hash: 4210d1d11f95449cb52a9993d8aaa8dc86aff6e012ea0359615a3df0ed9ab7b8
Instruction Fuzzy Hash: 3FB215B1E04219CFDB61DFA8C88479DBBF1FF48304F24846AD849A7251E7799982CF85

Function 01560717 Relevance: 3.4, Strings: 2, Instructions: 854COMMON

Download Yara Rule

Strings

F>?0, xrefs: 01560D09
B:@<, xrefs: 01560D02

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: B:@<$F>?0
API String ID: 0-4011826714
Opcode ID: 5eecaa4ca99577fb81cb18c400fd04cedb475e43d7f6c9835b7b2d1eb354d7e0
Instruction ID: 8e4bedd62cde8cf61b2a4e4519fdadc42e2b9d77670c9a7449f8bbf7e00edf0c
Opcode Fuzzy Hash: 5eecaa4ca99577fb81cb18c400fd04cedb475e43d7f6c9835b7b2d1eb354d7e0
Instruction Fuzzy Hash: 4A3225B19007128BDB24CF28C89226BBBB1FF92314F19825CE9925F7D5E775A851CBD0

Function 01544BA0 Relevance: 3.3, Strings: 2, Instructions: 815COMMON

Download Yara Rule

Strings

0, xrefs: 01545501
8, xrefs: 015454F9

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 474762f9f0d7e1bc1449aeb430963a4a820bfed9510dabdab1212daa97db26f7
Instruction ID: c403ddfa82928d62fcf692d8c52d38f7a3b741eddba47ff22ef3accf62f7a7cd
Opcode Fuzzy Hash: 474762f9f0d7e1bc1449aeb430963a4a820bfed9510dabdab1212daa97db26f7
Instruction Fuzzy Hash: 757226716083419FD724CF18C884B9EBBE1BF85318F48891DF9898B392D775D958CB92

Function 0157A3F0 Relevance: 3.2, Strings: 2, Instructions: 711COMMON

Download Yara Rule

Strings

cba`, xrefs: 0157A429
f, xrefs: 0157A671

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID: InitializeThunk
String ID: cba`$f
API String ID: 2994545307-1109690103
Opcode ID: 48d89d7ad504a90db0be385f52a03d3b677f46ec13821615e0bafbb489d2805f
Instruction ID: e9a6af57487e9bb19d5e91dc65dfecdeb2ff436ed8f1e81f5bab6564d3c75d3d
Opcode Fuzzy Hash: 48d89d7ad504a90db0be385f52a03d3b677f46ec13821615e0bafbb489d2805f
Instruction Fuzzy Hash: D62212716083419FE715CF28D882B2EBBE2BBC4304F1D892CE5A69B396D770D905CB52

Function 0156C6D7 Relevance: 3.1, Strings: 2, Instructions: 614COMMON

Download Yara Rule

Strings

iJ, xrefs: 0156CAF5
', xrefs: 0156CC09

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: '$iJ
API String ID: 0-30662343
Opcode ID: 5d2e5c4e35d8559189cfc57d52d00f8e14f35a0c5ff93fa068bd37f23ecc5e49
Instruction ID: e18ea2a1ef3ed905881d296639b2af70549f35ccba4fdbdedeaddac54c927a93
Opcode Fuzzy Hash: 5d2e5c4e35d8559189cfc57d52d00f8e14f35a0c5ff93fa068bd37f23ecc5e49
Instruction Fuzzy Hash: D502E47060C3D18FD73ACF2980603ABBFE1AF97204F58496DD4DA9B282D77985058B97

Function 01562270 Relevance: 3.0, Strings: 2, Instructions: 501COMMON

Download Yara Rule

Strings

c!", xrefs: 0156242F
TU, xrefs: 01562296

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: TU$c!"
API String ID: 0-3813282519
Opcode ID: 8cf15e1294f2f7ab7c1e78d352b2401322ed5be1abf266d566933d05e9114091
Instruction ID: 9bb376d3acd437d2379bcf7503be7e8c870d44c97a6c231854c436b424b612ea
Opcode Fuzzy Hash: 8cf15e1294f2f7ab7c1e78d352b2401322ed5be1abf266d566933d05e9114091
Instruction Fuzzy Hash: 82C144726043014BD7149B28DC9277BB7EAFFD5218F18892CE9968F381F738E9018792

Function 01562CF8 Relevance: 2.9, Strings: 2, Instructions: 399COMMON

Download Yara Rule

Strings

cba`, xrefs: 01562FC8
cba`, xrefs: 01563303, 01563273

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: cba`$cba`
API String ID: 0-1405727707
Opcode ID: 8f6a6c890073bd700cabb1a8107314bc244ad7c9142c118c138cf2886e68cf86
Instruction ID: 5e8d46a1b5dc6592a6745f34241b9e4c99867af2d919b629400c9c969dc5f0c6
Opcode Fuzzy Hash: 8f6a6c890073bd700cabb1a8107314bc244ad7c9142c118c138cf2886e68cf86
Instruction Fuzzy Hash: 0ED1F770608202DFE714DF29D85173EB3E6FB88315F0A886CE5A6EB284D734E955DB81

Function 01544270 Relevance: 2.8, Strings: 2, Instructions: 329COMMON

Download Yara Rule

Strings

), xrefs: 015442EB
IEND, xrefs: 01544661

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: )$IEND
API String ID: 0-707183367
Opcode ID: 35770a4bb6e28ed8b527147825c220ce6f596338bbd6ba74f99bf2cfb0439d35
Instruction ID: aa4e0e80fd470d3bc20284a11b7c1eaf4301b813382eb01d62d8879f2bfdd648
Opcode Fuzzy Hash: 35770a4bb6e28ed8b527147825c220ce6f596338bbd6ba74f99bf2cfb0439d35
Instruction Fuzzy Hash: 2BD1BEB1948345AFE720CF58D844B5EBBE4BB94308F14892DF9989B381D775E908CB92

Function 01549070 Relevance: 2.8, Strings: 2, Instructions: 292COMMON

Download Yara Rule

Strings

(,"-, xrefs: 01549134
&$(-, xrefs: 0154913C

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: &$(-$(,"-
API String ID: 0-2940422652
Opcode ID: 842e3b4bad717ffb86fa21b0642b285fa84ec43394ca04797a762ceea37fb35b
Instruction ID: e1a2506c06bfe268e45577e3a342b69bc49d5e92b092563b5e84034b26c7ae7a
Opcode Fuzzy Hash: 842e3b4bad717ffb86fa21b0642b285fa84ec43394ca04797a762ceea37fb35b
Instruction Fuzzy Hash: F971227110C3868FD7158F29949077FBFE1AFE6208F1849AEE4D59B283D735860AC762

Function 0155BA48 Relevance: 2.8, Strings: 2, Instructions: 254COMMON

Download Yara Rule

Strings

BzJ, xrefs: 0155BAD5
%, xrefs: 0155BB80

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: %$BzJ
API String ID: 0-1159491165
Opcode ID: 43d929933fd7d99dc9fcc4b00ced0e4a1c4e56e19c921109f5211eb6634249a6
Instruction ID: 9fa05cd5ebdaab96dec0c033346ab8cc19d9527cce8a518f491b5311d47dd817
Opcode Fuzzy Hash: 43d929933fd7d99dc9fcc4b00ced0e4a1c4e56e19c921109f5211eb6634249a6
Instruction Fuzzy Hash: 7B514A6010C3838BD7158B3C94747BBBFE2AFA3215F68045DD4D28B293DA66850ACB67

Function 00074CDD Relevance: 2.7, Strings: 2, Instructions: 231COMMON

Download Yara Rule

Strings

string literal, xrefs: 00074DE8
std, xrefs: 00074EB0

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: std$string literal
API String ID: 0-2980153874
Opcode ID: 4c2cc9b100ac51b56c9fd6335e25f7b8cfa0b45060da22fd1dff453dcebbf005
Instruction ID: 3b7eb7c58eceb8924229013675368397a2c2f2056298068cdd03c1c7a3270de8
Opcode Fuzzy Hash: 4c2cc9b100ac51b56c9fd6335e25f7b8cfa0b45060da22fd1dff453dcebbf005
Instruction Fuzzy Hash: D7718470F046018BDBA49F7D88412AAB6E6BB45320F15C539E85ECB396EB7CCC058B48

Function 0155D074 Relevance: 2.7, Strings: 2, Instructions: 211COMMON

Download Yara Rule

Strings

pr, xrefs: 0155D112
|~, xrefs: 0155D10A

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: pr$|~
API String ID: 0-4145297803
Opcode ID: 57470e8d66d91d4f11f41b05cc94507fdc1299217b700b5425368020ee11ea76
Instruction ID: 54aa2465909be69b8fd0b9c203bd02cb209b82a44494b9c3bcecb9f68983a902
Opcode Fuzzy Hash: 57470e8d66d91d4f11f41b05cc94507fdc1299217b700b5425368020ee11ea76
Instruction Fuzzy Hash: 5F510DB160C3518BD7509F24D82266FBBF1FF82314F08846DE8845F251E33AD505CB5A

Function 0155D087 Relevance: 2.7, Strings: 2, Instructions: 207COMMON

Download Yara Rule

Strings

pr, xrefs: 0155D112
|~, xrefs: 0155D10A

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: pr$|~
API String ID: 0-4145297803
Opcode ID: 2f2ca81ce3b8ddff3e0a5848e262e408977cd1a8292647fe6c3c67abd8526fc9
Instruction ID: a7a084ee6c7e9ce70384372ac9f95f10d2bfebbbc700f98e759e0db6a0675a4b
Opcode Fuzzy Hash: 2f2ca81ce3b8ddff3e0a5848e262e408977cd1a8292647fe6c3c67abd8526fc9
Instruction Fuzzy Hash: EC510DB160C3518BD7509F24C82266FBBF1FF82314F1899ADE8845F295E33AC506CB5A

Function 015776B0 Relevance: 2.7, Strings: 2, Instructions: 196COMMON

Download Yara Rule

Strings

cba`, xrefs: 0157773A
c!", xrefs: 015776B2

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: c!"$cba`
API String ID: 0-3815079656
Opcode ID: dab8ea017703b1711589bf7a9c954b21931f0cf0d5b130669c54c1b78ad5cce1
Instruction ID: d1606562fff395c72d5f722a7a04549fe2cae6cd6994c403f2403ba178e18f78
Opcode Fuzzy Hash: dab8ea017703b1711589bf7a9c954b21931f0cf0d5b130669c54c1b78ad5cce1
Instruction Fuzzy Hash: 3B51F5746482019BE720DF29F886B3E77A6FBD8308F15882CE5969F245D7709844DBA2

Function 0156536C Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

BLJB, xrefs: 01565554
X, xrefs: 0156556A

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: BLJB$X
API String ID: 0-2222927247
Opcode ID: 0dd1c71836a3a1e5a79ddcef908140f50a0414fb94b279b352920adf108b367a
Instruction ID: fd1bd3d8c19553ae2d34f654ab7e536f5d06b0c88c32ede801707fb17f077e27
Opcode Fuzzy Hash: 0dd1c71836a3a1e5a79ddcef908140f50a0414fb94b279b352920adf108b367a
Instruction Fuzzy Hash: D65128317A83428BD7308E6884512EBBBE5FF55290F48496ED9D58F382F234D505D7D2

Function 01567653 Relevance: 2.6, Strings: 2, Instructions: 86COMMON

Download Yara Rule

Strings

ij, xrefs: 015676D3
H.s , xrefs: 015676E0

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: H.s $ij
API String ID: 0-4017226643
Opcode ID: f56604d393f9a4f8f46d5cdcef4c97cf41f73866cc33ab392765fb2e16c68856
Instruction ID: b81fcb66a624f4b2c5a3e2e722caff6c65253bc5d60e52c5dfb96200c6f6bbf5
Opcode Fuzzy Hash: f56604d393f9a4f8f46d5cdcef4c97cf41f73866cc33ab392765fb2e16c68856
Instruction Fuzzy Hash: 1B31CD7261D3908FD315CF65C48126FBBE2FBC6704F56892CE4956B345CBB4990ACB42

Function 01555EE0 Relevance: 1.9, Strings: 1, Instructions: 625COMMON

Download Yara Rule

Strings

1/3T, xrefs: 0155611F

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID: InitializeThunk
String ID: 1/3T
API String ID: 2994545307-3266294232
Opcode ID: 769a666aae431cf8a61ea95b1706f822ad2b97f6f3b6a356b94168b7aec53168
Instruction ID: cd7dd42cef137c84a775c615bf5bdb9d88540c5c01127de278fdc5d5f2964a46
Opcode Fuzzy Hash: 769a666aae431cf8a61ea95b1706f822ad2b97f6f3b6a356b94168b7aec53168
Instruction Fuzzy Hash: DDF10534204781CFE7228F29C8A0B36BBE2FB56304F58599DD9E68F396D735A845CB50

Function 01554F08 Relevance: 1.9, Strings: 1, Instructions: 609COMMON

Download Yara Rule

Strings

cba`, xrefs: 01555565

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: cba`
API String ID: 0-1926275841
Opcode ID: 6345f76e979aa42fd71cead5533c0439124d92918cbf4489b3ec14d2b9eb8b31
Instruction ID: 4ab355945b1c58b06bd9c2e887f665000f07ec435ffd14b1073e091ab4cc8b46
Opcode Fuzzy Hash: 6345f76e979aa42fd71cead5533c0439124d92918cbf4489b3ec14d2b9eb8b31
Instruction Fuzzy Hash: 7D020630618301DFD7259F28D862B3F7BA1FB95308F55682DE5A1AF291E731E809CB42

Function 01577900 Relevance: 1.7, Strings: 1, Instructions: 497COMMON

Download Yara Rule

Strings

cba`, xrefs: 0157799B

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: cba`
API String ID: 0-1926275841
Opcode ID: a8d2b8aa8ef47e175de14aa5bb8a3305f6815240a46080fe3dff86b5f475e31f
Instruction ID: 2e276f78cff6f6427e7353aa198ede4a96f3015c0da95a7b3546f0319b2eff24
Opcode Fuzzy Hash: a8d2b8aa8ef47e175de14aa5bb8a3305f6815240a46080fe3dff86b5f475e31f
Instruction Fuzzy Hash: E5C159729083114BE324DE15F8C6A3FBBA6BBC9214F09892CD9962F351E770AD04C7E1

Function 01554A40 Relevance: 1.7, Strings: 1, Instructions: 471COMMON

Download Yara Rule

Strings

K%, xrefs: 01554CC8

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: K%
API String ID: 0-424693878
Opcode ID: 4e4ef7bba58e65979442b7533640694e3defb87ad13d6d9b0f1e0d12d79ef0bd
Instruction ID: 3834b58108059c35645b06a3baf6518e06d50372f311d575710dfe2eb961fec9
Opcode Fuzzy Hash: 4e4ef7bba58e65979442b7533640694e3defb87ad13d6d9b0f1e0d12d79ef0bd
Instruction Fuzzy Hash: A8C125716083018BDB159F28DCA277BB7E1FF95324F085A2DE9928B291F3B8D544C792

Function 0156BFD3 Relevance: 1.7, Strings: 1, Instructions: 456COMMON

Download Yara Rule

Strings

x, xrefs: 0156C2F2

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: x
API String ID: 0-2363233923
Opcode ID: 646f46fd0f3cf418521af49cd0ebbe3bede70b49c58225827aec84209c84e567
Instruction ID: 0d53607b6865e42f523fb425a60042c161875920aa4eb41cfe2798d0c3e5997c
Opcode Fuzzy Hash: 646f46fd0f3cf418521af49cd0ebbe3bede70b49c58225827aec84209c84e567
Instruction Fuzzy Hash: 40D1F56060C7D18ED7398B2988903BBBFD5AFE7254F08496DD0D94F282D739850AC7A3

Function 0156297F Relevance: 1.7, Strings: 1, Instructions: 408COMMON

Download Yara Rule

Strings

cba`, xrefs: 015629EB

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: cba`
API String ID: 0-1926275841
Opcode ID: e13154e2a487b39567b180f5d469c1d9597002bd30ec6bf087d61b1c5cd87cd4
Instruction ID: 719ba849b411cc553176c5817ce25a92c1b073368911017fd89907f8b09d2a70
Opcode Fuzzy Hash: e13154e2a487b39567b180f5d469c1d9597002bd30ec6bf087d61b1c5cd87cd4
Instruction Fuzzy Hash: 34C122716082508FD324CF29D89162EBBE2FBC5714F098A6CE8A25F395DB35D805DB81

Function 0156A630 Relevance: 1.6, Strings: 1, Instructions: 396COMMON

Download Yara Rule

Strings

", xrefs: 0156A918

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 4abfa2479a0e4305d02d5d5ee4678300abeb872efe24ce69da09627c08f165b8
Instruction ID: 6ec26e04d00ef3e3065c72497166a154e4aea614c932cb0abb41ad0af46ba308
Opcode Fuzzy Hash: 4abfa2479a0e4305d02d5d5ee4678300abeb872efe24ce69da09627c08f165b8
Instruction Fuzzy Hash: 25C148B2A043025FD7158E28C44076FBBEDBFC5210F19892EE996AF382E774D84587D2

Function 0157E690 Relevance: 1.6, Strings: 1, Instructions: 384COMMON

Download Yara Rule

Strings

@CDE, xrefs: 0157E8D1

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID: InitializeThunk
String ID: @CDE
API String ID: 2994545307-1513065382
Opcode ID: 34217d3e5097cdc6d1fd83cd059aa64faea56fa94ffed866863985aaed852bea
Instruction ID: 3d486534e8538369d847b200c9a02b0da3f983cbf1bd962550d1eb25158910c7
Opcode Fuzzy Hash: 34217d3e5097cdc6d1fd83cd059aa64faea56fa94ffed866863985aaed852bea
Instruction Fuzzy Hash: FBB143717483414FD329CA29E8D293FBBE6FBD5218F1C896CE5868B392C634D805C792

Function 01567C9D Relevance: 1.6, Strings: 1, Instructions: 357COMMON

Download Yara Rule

Strings

cba`, xrefs: 01567D0F

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: cba`
API String ID: 0-1926275841
Opcode ID: 2509468ed53057fd3a90e87cdf1adcb0c434374c3a413b026ce02b73467ee95c
Instruction ID: 24bd2c6e4b386e3f57b0f40bf9f9b986326404bc7603f383cf4a5da164e2ef66
Opcode Fuzzy Hash: 2509468ed53057fd3a90e87cdf1adcb0c434374c3a413b026ce02b73467ee95c
Instruction Fuzzy Hash: DAB1E771A187158FD729CF28D85072EB7E6BBC9204F09896CD9669F386DB309805DBC1

Function 01561EE0 Relevance: 1.6, Strings: 1, Instructions: 332COMMON

Download Yara Rule

Strings

x%, xrefs: 0156207D

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: x%
API String ID: 0-3980080454
Opcode ID: fa208b6efb196a27301bc76a8cfd0c5b36204eb1c24ab7ace2746165d0fb290a
Instruction ID: 22fe7302b1ef6c7ccbab8514717c350c98529bc6c5d18510eae7bc944551217b
Opcode Fuzzy Hash: fa208b6efb196a27301bc76a8cfd0c5b36204eb1c24ab7ace2746165d0fb290a
Instruction Fuzzy Hash: 5CA1F0B16043019BDB20DF28CC91B6B77E9FF94358F08492CEA858F391E775A904C7A2

Function 01574C4D Relevance: 1.6, Strings: 1, Instructions: 311COMMON

Download Yara Rule

Strings

cba`, xrefs: 01574F8D

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: cba`
API String ID: 0-1926275841
Opcode ID: df556fcd1a04c2253b303a7e651f9efadabaa1e71c205fdd42cadd36a25d4656
Instruction ID: e0039c124af0b839f656a145bd58c6a541e9de0ab3faf504f5eed00de9739fb0
Opcode Fuzzy Hash: df556fcd1a04c2253b303a7e651f9efadabaa1e71c205fdd42cadd36a25d4656
Instruction Fuzzy Hash: 60E1E521508BD18ED336CA3C880435BBFE16B57214F0DCB9CC4EA5B7D2C679A945C7A6

Function 0155CB5A Relevance: 1.6, Strings: 1, Instructions: 304COMMON

Download Yara Rule

Strings

^@, xrefs: 0155CCDE

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: ^@
API String ID: 0-1015691136
Opcode ID: e2b45ff364ee5896287fa6586afcabda63dfc51b146e58c7961ff3132735b772
Instruction ID: db15e9e248f579df54a8eada33fbacaac04233af84e782beaa93dbffcb113c50
Opcode Fuzzy Hash: e2b45ff364ee5896287fa6586afcabda63dfc51b146e58c7961ff3132735b772
Instruction Fuzzy Hash: 3971AAB66483108BC725CF59C4A222BB7F2FFC5714F09981DE8D99B350E3789901C79A

Function 01563A00 Relevance: 1.5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

Strings

vw, xrefs: 01563A86

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: vw
API String ID: 0-4141688848
Opcode ID: b67d6c7e3e715f3b3ab420dd60191820cabaf821306a18ee19e0c0d999cc627a
Instruction ID: 86fdb6456ae57719b123e32031412243ff082ca3a0bb8e04495e5f66ce079f70
Opcode Fuzzy Hash: b67d6c7e3e715f3b3ab420dd60191820cabaf821306a18ee19e0c0d999cc627a
Instruction Fuzzy Hash: DB91257260C3558BD324CE68DC8175FBBE5FBC4718F154A2DE9A86B280D7B19905CB82

Function 015701D0 Relevance: 1.5, Strings: 1, Instructions: 285COMMON

Download Yara Rule

Strings

0, xrefs: 01570251

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 407765910401b4d00b6aabb63cf1577fc74080cc5757a0ca0083ee06eb900012
Instruction ID: e66811065b254755e182f9630b8b0978d03f761e91cee03050df0ab6b5c11c52
Opcode Fuzzy Hash: 407765910401b4d00b6aabb63cf1577fc74080cc5757a0ca0083ee06eb900012
Instruction Fuzzy Hash: 42912533618A904BC72C5D7C5C622BE7AD35BD7230B2E876EB9B2CF3D6D91988094350

Function 0007F3E3 Relevance: 1.5, APIs: 1, Instructions: 19timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,0007F486), ref: 0007F3EF

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: Time$FileSystem
String ID:
API String ID: 2086374402-0
Opcode ID: fb1137b4e8efbc364f3f6bc42dd39e5c356da0f16e82c5d93d848f4cb622fca3
Instruction ID: f4370d6d13f15f2673639cef8883d13ab758b358d1e43281d5adfba1fe55e8a9
Opcode Fuzzy Hash: fb1137b4e8efbc364f3f6bc42dd39e5c356da0f16e82c5d93d848f4cb622fca3
Instruction Fuzzy Hash: 32E09AB49087099FCB44EF68D88556EBBF8AF48344F01C82DA499D3345D738D4419B56

Function 0155D420 Relevance: 1.5, Strings: 1, Instructions: 268COMMON

Download Yara Rule

Strings

~, xrefs: 0155D4EB

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: ~
API String ID: 0-1707062198
Opcode ID: a44821d65fd0741bc4347a458d99cc41d7b689ed42fba0cb375ea50f4e19c086
Instruction ID: f6f303776c0cbb9886f2fecf4e64974f5061faf5c7ee81d8d353b5225eacb26f
Opcode Fuzzy Hash: a44821d65fd0741bc4347a458d99cc41d7b689ed42fba0cb375ea50f4e19c086
Instruction Fuzzy Hash: 038149739042614FCB228E6CC85039EBBE1BB85224F19C63DECB99F392D6349846D7D1

Function 01545E60 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

,, xrefs: 01545F96

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 7fae2f255a8fd2d56763f8beb58fcdc8fb186e5576eac22f9c3d66becbf538f0
Instruction ID: 37a3b48b8686359593a9384655441ac8a867a6931fa923abca22ad9b3f81064b
Opcode Fuzzy Hash: 7fae2f255a8fd2d56763f8beb58fcdc8fb186e5576eac22f9c3d66becbf538f0
Instruction Fuzzy Hash: 70B127711097819FD325CF18C88061FBBE0AFAA608F448A6DF5D99B742D631E918CB67

Function 0007A967 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

., xrefs: 0007AABA

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 021aba50e82c8cd3dc8493c7607a4a3bc533dfa9f72cb4aca3287125ce1711b9
Instruction ID: 579183336e3f554bf2d253ba276d0b44630bdc2ead3f1de3cf0fe63dfc4e43ee
Opcode Fuzzy Hash: 021aba50e82c8cd3dc8493c7607a4a3bc533dfa9f72cb4aca3287125ce1711b9
Instruction Fuzzy Hash: 1BA1AC71F006098BDB24CAA9C88579EB7E2EFC6340F14C12AE45AD7646D77CEC45CB4A

Function 0157A030 Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

cba`, xrefs: 0157A1DF

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID: InitializeThunk
String ID: cba`
API String ID: 2994545307-1926275841
Opcode ID: b8446e5adf3f1417b40608fd4d564c437ed9c0d4ae5ea76683f14d87180e9c17
Instruction ID: 17f94188b062b9fe2c0f4089ffd76868f35f08e9eb5273ccf13bc68b25a822ff
Opcode Fuzzy Hash: b8446e5adf3f1417b40608fd4d564c437ed9c0d4ae5ea76683f14d87180e9c17
Instruction Fuzzy Hash: EF714672B093505FE7189E2CE892B3EBBA2FB84314F1D492CD5978F691E7319804CB42

Function 0156A100 Relevance: 1.5, Strings: 1, Instructions: 241COMMON

Download Yara Rule

Strings

", xrefs: 0156A346

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 1bde58d3ad00dbcf7b211c85afe0c87ae7ec8536041c5ee7d742fbdcfbaf8b1e
Instruction ID: b21ab318f81541096b4922b359343f4ce4bccaca04da3b761f772e7d1d9ef112
Opcode Fuzzy Hash: 1bde58d3ad00dbcf7b211c85afe0c87ae7ec8536041c5ee7d742fbdcfbaf8b1e
Instruction Fuzzy Hash: D971E332B097558BD724996D888021EB6CB7BC6370F198768E9B5AF3E5D7748C0183C1

Function 0156AAD0 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

", xrefs: 0156ACCE

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction ID: 04d11720cbc1765c5349013afb8074a1581aa2b05080b7ecfdecffb4e4e97257
Opcode Fuzzy Hash: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction Fuzzy Hash: C371E232A083155BE725CE2CC48032EBBEBBBC5720F19896DE594AF3A5D635DC4487C2

Function 01557E82 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

tuv, xrefs: 01558856

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: tuv
API String ID: 0-2475268160
Opcode ID: 435871983d9ad21cce09f420eecfaf6673cce76a27373b627c1af84510029d69
Instruction ID: f15da3744a088cc7b0545afcd87ecdc1fdde73f944e0ffd8ecd149eda4e92d3a
Opcode Fuzzy Hash: 435871983d9ad21cce09f420eecfaf6673cce76a27373b627c1af84510029d69
Instruction Fuzzy Hash: 056101B2500701CFD7618F28D8A176BB7E1FF99318F18492AEAA64B7A1E335E904D750

Function 015556D0 Relevance: 1.5, Strings: 1, Instructions: 219COMMON

Download Yara Rule

Strings

gfff, xrefs: 0155582C

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: gfff
API String ID: 0-1553575800
Opcode ID: 9566b89fc8239d8ebbd18da7a08276d4bfdad40d50f217aff0b543367313f073
Instruction ID: dd21d6978ab701dc9d82b3c0b83eb0e4a524f54b21cb04c506645dd4da689376
Opcode Fuzzy Hash: 9566b89fc8239d8ebbd18da7a08276d4bfdad40d50f217aff0b543367313f073
Instruction Fuzzy Hash: 3A7104756107018FE765CF29C8A1B6AB7E2FB85314F08862ED9968F395EB34E445CB80

Function 0156BA8D Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

`pd-, xrefs: 0156BBB2

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: `pd-
API String ID: 0-182301337
Opcode ID: 1cbccd1031b6357d54be6e8d3e5021dbe6ddc33acce2d06a5fd5997b679a7485
Instruction ID: 386a7e130d501888ffb9c6f3da61e238c8fb895e3c507146f907e673d1d5faf8
Opcode Fuzzy Hash: 1cbccd1031b6357d54be6e8d3e5021dbe6ddc33acce2d06a5fd5997b679a7485
Instruction Fuzzy Hash: 3751E1313083818EE7358F29C8507AFBBE2AFE3214F58495CC4C59B296DB79454ACB93

Function 0154E06A Relevance: 1.5, Strings: 1, Instructions: 210COMMON

Download Yara Rule

Strings

cba`, xrefs: 0154E085

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID: InitializeThunk
String ID: cba`
API String ID: 2994545307-1926275841
Opcode ID: 15bbefc99aeff0fc676dd0d784ad6eee7206807ea8fbb8c9db36788a2f3ae102
Instruction ID: 13d1dbff9dff7fccabcaa8899fb6973a648546259775e8266b3cd1938b2b0056
Opcode Fuzzy Hash: 15bbefc99aeff0fc676dd0d784ad6eee7206807ea8fbb8c9db36788a2f3ae102
Instruction Fuzzy Hash: 4A51F6342482818FE7658A2DD892BBF7796FB9121CF24AC3CD19EAF252C7349845C710

Function 0156B4BB Relevance: 1.4, Strings: 1, Instructions: 138COMMON

Download Yara Rule

Strings

CUUI, xrefs: 0156B588

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID: CUUI
API String ID: 0-173970609
Opcode ID: 1bd52bac9d4ff49e7c6f12a5daa057b703040dedcd2641909da19e1666e63c56
Instruction ID: 11760e820d5358be52002bbae168a1bc65e7108c512e4bce3e2a81ba1619adbe
Opcode Fuzzy Hash: 1bd52bac9d4ff49e7c6f12a5daa057b703040dedcd2641909da19e1666e63c56
Instruction Fuzzy Hash: A741D8A120C3D08ADB358F2985903AFBBE5AFD3204F5885ADC6C56B247D67584068B56

Function 0157DBD0 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

@, xrefs: 0157DC39

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: a7ca09b110878a14947d2df4a3e9c11b6a73fb50dd731b1f05f83d64a1dda667
Instruction ID: fb68e1c792b2e30fa7b9464dc44881e3c6789da74350df7b5d689177eb7199a8
Opcode Fuzzy Hash: a7ca09b110878a14947d2df4a3e9c11b6a73fb50dd731b1f05f83d64a1dda667
Instruction Fuzzy Hash: 673124B11083048FC314DF58D4C262FBBF9FF95314F04992CE6869B291D3719908CB96

Function 01565230 Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

cba`, xrefs: 015652B6

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID: InitializeThunk
String ID: cba`
API String ID: 2994545307-1926275841
Opcode ID: 697ced13b2e7fb2cb1f32a47213a0592c3ca3bb9787a0c8b9ad79d7efc288c8c
Instruction ID: 03f957cb428c807ec160a6592b1d6d3128b0f621ab552dde6f758fe744ee6a6a
Opcode Fuzzy Hash: 697ced13b2e7fb2cb1f32a47213a0592c3ca3bb9787a0c8b9ad79d7efc288c8c
Instruction Fuzzy Hash: E9115736A987104BC320CE28CDC153A77E5BB84218F562B3CD9A9EB391F260DC0497D5

Function 01550FD6 Relevance: .9, Instructions: 882COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c445c4d335d077f383af58120351ce7b0a8d545206047b3165b34e6febf7caf
Instruction ID: 749a08396489ad64aeea4e2fb4940e38d4f258443dd0f5d2aff1d288a7c5c5b7
Opcode Fuzzy Hash: 6c445c4d335d077f383af58120351ce7b0a8d545206047b3165b34e6febf7caf
Instruction Fuzzy Hash: 947203B5A04B418FD754DF38C4D535ABFE1BB95214F098A2ED8EB8B792E634E405CB02

Function 01542EA0 Relevance: .7, Instructions: 675COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91a38e4529c36de74ff26fee965bbeb5ddc6bc03bf17c30f507e3f2912a04248
Instruction ID: f2e55a57a7d204a17fc6f228dd0b8f7c44d5c97a4e6ce3c77b8bb97426b1a581
Opcode Fuzzy Hash: 91a38e4529c36de74ff26fee965bbeb5ddc6bc03bf17c30f507e3f2912a04248
Instruction Fuzzy Hash: 1252DF315083658FDB55CF18C0906EEBBE1BF88318F198A6DF8995B362D734E849CB81

Function 01546690 Relevance: .7, Instructions: 665COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ed54d4d4a53e4f2ae26eafaba22ed5426aec498bf63995b27166bf18d6b84a8
Instruction ID: cdbe0c9085045b30c5ac2f9663d0cfb9a50542f487ff84b9617fab3b9f19b530
Opcode Fuzzy Hash: 5ed54d4d4a53e4f2ae26eafaba22ed5426aec498bf63995b27166bf18d6b84a8
Instruction Fuzzy Hash: E252C6B0908B859FF735CB28C4883ABBBE1BB46318F148D5DD5E60A783C379A589C751

Function 0155EF30 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 981a9962cab50a616993852e7380171429e2bc172919ceff3e0d7779405d96c3
Instruction ID: 76d7b677a3c4fc4df34269ec8ec26d5cf35da54e92218d6b79c0f536977f9855
Opcode Fuzzy Hash: 981a9962cab50a616993852e7380171429e2bc172919ceff3e0d7779405d96c3
Instruction Fuzzy Hash: 826259B0608B818ED369CB3CC85579BBFE5AB5A314F044A5DE0EF9B392C7756001CB66

Function 01547470 Relevance: .6, Instructions: 625COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4f2b084faef48d893cec2519f241ff843f37aefc35a02b9a69ce986de1685e5
Instruction ID: 8e577bc0b71b528c3095b2792022d08677ddb4246267360fb5fbb1e6d70ccb53
Opcode Fuzzy Hash: b4f2b084faef48d893cec2519f241ff843f37aefc35a02b9a69ce986de1685e5
Instruction Fuzzy Hash: 5222B532A087128BD725DF1CD9806AFB7E1FFC8319F19892DDAC69B285D734A451C742

Function 01551B1B Relevance: .6, Instructions: 612COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71160075585170d664aa525e16d841e6bc4410e3e7ee0330b106fddf6cc99902
Instruction ID: be719c9ab9e8106025e769b8406617167e9d74f09e4c454c2415ce3ef7215178
Opcode Fuzzy Hash: 71160075585170d664aa525e16d841e6bc4410e3e7ee0330b106fddf6cc99902
Instruction Fuzzy Hash: 3832F775A04B41CFD754EF38C49536ABFE1BF99214F09892EC8EB8B791E635A405CB02

Function 015438C0 Relevance: .6, Instructions: 600COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f6f948132de32a256b2a15cf8e50ebe7104b74a727ed79fa9ed8ed195fe8408
Instruction ID: 9271f21935c6ae539cd0b75686f182fbb1d58b69806208ae317d3404ca80c9e7
Opcode Fuzzy Hash: 4f6f948132de32a256b2a15cf8e50ebe7104b74a727ed79fa9ed8ed195fe8408
Instruction Fuzzy Hash: AC322570515B218FC3B8CF29C59062ABBF1BF45618B544A2ED6A78BFA0D736F844CB14

Function 000900D0 Relevance: .6, Instructions: 572COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee11da9c34b7495dab9cb03031c376cf5635392035d69ba50d7dba8772c91724
Instruction ID: 621da676b9f4197ad2811a08c3aa833a00304f34e9432d302053a4ca45a7cab0
Opcode Fuzzy Hash: ee11da9c34b7495dab9cb03031c376cf5635392035d69ba50d7dba8772c91724
Instruction Fuzzy Hash: AC5204B0904748CFDB48DFA9C584A9DBBF1BF88310F15C66EE498AB362D7749842DB41

Function 0008F80C Relevance: .6, Instructions: 572COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 746b9225fe7a360547291949ee19338c106fe898a71e8ea541c4a1db286b63df
Instruction ID: 021c4f369bbf53906f1841f8656753bc36e4c477a2b922bbaaf2f845d2c468c6
Opcode Fuzzy Hash: 746b9225fe7a360547291949ee19338c106fe898a71e8ea541c4a1db286b63df
Instruction Fuzzy Hash: 2D52C5B0904748CFCB58DFA9C584AADBBF1BF88310F15C56EE498AB362D7749842DB41

Function 0157CAC0 Relevance: .5, Instructions: 548COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dbe72fd06470c5bcc62740dda281750076a6aff515369a9158f37e1f912a4e2
Instruction ID: f1570cc5f5c00e5385048e69044f01bf612cd76d246791d99b0a960dc947c642
Opcode Fuzzy Hash: 5dbe72fd06470c5bcc62740dda281750076a6aff515369a9158f37e1f912a4e2
Instruction Fuzzy Hash: B0020132A14216CFC714CF68E8916AFB7F1FB89311F0A8879D555AB349D330E995DB80

Function 000A4934 Relevance: .5, Instructions: 516COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af54f7deb99a661b18e7fa8b757a96f10ca1f60bad46a75a80833933ecea6dcd
Instruction ID: 2a91e63f6ba8e1cafd7292e72e017762ed2def4ad6e13c0c67311b0c892fb106
Opcode Fuzzy Hash: af54f7deb99a661b18e7fa8b757a96f10ca1f60bad46a75a80833933ecea6dcd
Instruction Fuzzy Hash: 4C42C378904358CEDF60DFA8C9807DDBBB0BF59354F14819AE898AB352D7709A84CF51

Function 000A5120 Relevance: .5, Instructions: 514COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ecf64942e5076b23117187aca83b3e4efc64b773fb3ad9d9b96f934f6d9b1f0
Instruction ID: 5c6ff049ede598cdc01096a1535ba0aea38506fa4092cbd2649e07fdfb505183
Opcode Fuzzy Hash: 0ecf64942e5076b23117187aca83b3e4efc64b773fb3ad9d9b96f934f6d9b1f0
Instruction Fuzzy Hash: AE420674D04668CFDF60DFA8C8847DDBBB0BF0A315F14819AD898AB242DB749A85CF51

Function 000A79A0 Relevance: .5, Instructions: 514COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71245cd5e587656b3323974c1941f6939d61a793beccfeeeff5e08833e2c269b
Instruction ID: a2cc73d502b575753df39969dfc6669629d69fc9eb03f0996fb8b0801b594262
Opcode Fuzzy Hash: 71245cd5e587656b3323974c1941f6939d61a793beccfeeeff5e08833e2c269b
Instruction Fuzzy Hash: EE32D274D083989FDB60DFA8C8846DDBBF0BF0A310F248159E898AB392D7749985CF51

Function 0009ED70 Relevance: .5, Instructions: 504COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd9319d355d451977ac30412ea0892dacaae4e8a944c186766c280435cbc29ac
Instruction ID: 1a3180e49440012ce70ee04959a026874ddd03d0c6584e5461c438d1b85522af
Opcode Fuzzy Hash: cd9319d355d451977ac30412ea0892dacaae4e8a944c186766c280435cbc29ac
Instruction Fuzzy Hash: 6E32F7749042999FDF20CFA8C8807EDBBF1BF49314F2481AAD899A7382D7709985DF51

Function 0009F4D8 Relevance: .5, Instructions: 502COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ce8367c39f83568afada3cfceba7ee40bbc10c3f11c5f59416e3d567638546c
Instruction ID: d8987bed4e87513030b99bb6f511b75c9bf88e4d419d67e45f880ddfe52112c0
Opcode Fuzzy Hash: 0ce8367c39f83568afada3cfceba7ee40bbc10c3f11c5f59416e3d567638546c
Instruction Fuzzy Hash: 8332E474D042599EDF61CFA8C8847ECBBF1BF09314F2481AAD898AB382D7709985DF51

Function 000A1AA4 Relevance: .5, Instructions: 502COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7afddd0d6c105cfeac4ce7799103c722977b4340be6f1571c4f77329c347af16
Instruction ID: 867824a464c3c12c5194be520948f99257a9219117886b5797f4d2f72f4d0338
Opcode Fuzzy Hash: 7afddd0d6c105cfeac4ce7799103c722977b4340be6f1571c4f77329c347af16
Instruction Fuzzy Hash: 2432E374D043989FDB21DFA8C4846DDBBF1BF1A310F24816AD8A8AB392D7709985CF51

Function 0157CBD6 Relevance: .5, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12fdd74098ed5c224caa0fc9a9d7a5e7fe27f707ea7d6f189500344584965cdd
Instruction ID: 5febd3605159688bf3b8181829e6b5442e9334401ee4a4a2f63a0e116e3a8408
Opcode Fuzzy Hash: 12fdd74098ed5c224caa0fc9a9d7a5e7fe27f707ea7d6f189500344584965cdd
Instruction Fuzzy Hash: 53E1FF31A14216CFC714CF68E8906AFB7F2FB89311F0A8479E555AB349D334E955DB80

Function 01545910 Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72ef3389d17b5c2d7356fca882b754ee43f181ee348d4ceda7fd19fbe0bcaa8a
Instruction ID: d604336235bb3360d097a66120b63c34ffa2018075aadaee63ce6586841dce87
Opcode Fuzzy Hash: 72ef3389d17b5c2d7356fca882b754ee43f181ee348d4ceda7fd19fbe0bcaa8a
Instruction Fuzzy Hash: C7F1DE356087418FD329CF29C88076BFBE2BFD9204F08892DE5D98B751EA75E904CB56

Function 015666E7 Relevance: .4, Instructions: 424COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07c82060fa0e0593dd7f641c5c10c0ea94ed69e4a68c0a0acdb4f8ca88c945ab
Instruction ID: c73c693120ff42296d733a964e74c453ca8099153c3c2c14449b79b00f36c111
Opcode Fuzzy Hash: 07c82060fa0e0593dd7f641c5c10c0ea94ed69e4a68c0a0acdb4f8ca88c945ab
Instruction Fuzzy Hash: BDE153B59083428FDB209F28D45036EBBE5BF95204F09486DE9D59F242E339E945CBC2

Function 015780D9 Relevance: .4, Instructions: 422COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78f5f75ecdc5544092b2c91efa1eff98bde50f35504451e781c701c4165da449
Instruction ID: 86788390b7d9830f4874e108d03684c6e2a3893728d3eeb3e28442f817516479
Opcode Fuzzy Hash: 78f5f75ecdc5544092b2c91efa1eff98bde50f35504451e781c701c4165da449
Instruction Fuzzy Hash: 6DD11136628356CBCB288F38EC5136AB7E1FF49311F4A98BCD4819B294E77AC954D350

Function 015481F0 Relevance: .4, Instructions: 408COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5deb4402bb6ba59138c9260d6121aa5f51a2643c4b50e7399083721f342fa2d
Instruction ID: 4b8885de17fce81628ef3b12584437f1ee4d44ac9652a6ffedc65d6fc98c01d0
Opcode Fuzzy Hash: c5deb4402bb6ba59138c9260d6121aa5f51a2643c4b50e7399083721f342fa2d
Instruction Fuzzy Hash: 57E108716087415BC319CE6DD8A026EFBE2BFC5324F18CA1DE5A64F3E5D7349A058B81

Function 0157CCE0 Relevance: .4, Instructions: 394COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f46b5f9a99eeb1e87751ee64043a03bcdd7139566a4dc9e56b9cd5a2ec5a44d5
Instruction ID: a095dfb49a93ad6156ac9ca7477974a7639d1f09c3a3eb3ed0d98debe7bd2dac
Opcode Fuzzy Hash: f46b5f9a99eeb1e87751ee64043a03bcdd7139566a4dc9e56b9cd5a2ec5a44d5
Instruction Fuzzy Hash: 62C1DF32A14216CFC714CF68E89066FB7F1FB89311F0A4479E955AB349D731E958DB80

Function 015686F0 Relevance: .4, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56f769fc0f620298efe04d3055cec1460623753f8e3c4c90cff3b8a37f283c6a
Instruction ID: 1e755cb1224c35919ad214de056663e44f3f0f863eeb9eedde719939169007a5
Opcode Fuzzy Hash: 56f769fc0f620298efe04d3055cec1460623753f8e3c4c90cff3b8a37f283c6a
Instruction Fuzzy Hash: 0BC1DAB45083028AD714DF18C86262BB7F2FF92364F08890CE4D69F796E7799506CB96

Function 01557190 Relevance: .4, Instructions: 375COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b1f51ea0787f601a3a15363686d098c13df5db1209767d949473b5f6b1306ca
Instruction ID: cddf57cff6d51e708cce150898a2707f4879c2e89bccd9257fe7f2fc6f833f67
Opcode Fuzzy Hash: 1b1f51ea0787f601a3a15363686d098c13df5db1209767d949473b5f6b1306ca
Instruction Fuzzy Hash: 5CB1F030204742CFE7658F39D461B36BBE2FB4A314F5889ADD9968F282D734E845CB60

Function 00074751 Relevance: .4, Instructions: 368COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3afacdb30c24e488121541c91a95ff0563fe23db9fd20e7422cd8f864616467d
Instruction ID: 46fdfc9239118275f0914a1974e6b875d7170e60e441b6ae9e2bc335e2715cbd
Opcode Fuzzy Hash: 3afacdb30c24e488121541c91a95ff0563fe23db9fd20e7422cd8f864616467d
Instruction Fuzzy Hash: A2C1B030F096058BDBEA9E3988843AAB7D2AB85300F29C579C45DCF256D73DDC498B5C

Function 0157CD60 Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90e9d407c19360dc4319b24eb608c0d5a9b718df39847b99e96d4bdc1a5e6a13
Instruction ID: dabeaed708e6e06f535068eed78db5a4a1582962615564f25cbb08a34c03df10
Opcode Fuzzy Hash: 90e9d407c19360dc4319b24eb608c0d5a9b718df39847b99e96d4bdc1a5e6a13
Instruction Fuzzy Hash: 89B1ED72A14216CFC714CF68E8906AFB7F1FB89311F0A446DE955AB388D730E958DB80

Function 01566EBE Relevance: .4, Instructions: 350COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 027ac8baff18f01da5dab10807dd34ab775e31aa4969b906b916aefd69904093
Instruction ID: f44ee08bcbaf71fd8a9bc28cafc4337947d2c25d959bcf73108f7d95e3ac2d35
Opcode Fuzzy Hash: 027ac8baff18f01da5dab10807dd34ab775e31aa4969b906b916aefd69904093
Instruction Fuzzy Hash: 4DC1F531908382CFD325CF38D85075ABBA2BF8A314F5946ACF9A55F291D3719948DB81

Function 0157E2C0 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 93c78b05dfa5d6bf99a6d756930f3895cbd452118b5189bc71f33949af87d953
Instruction ID: 602810f66858eabae44064ffbefb152fe7d38759f622555af6406dbec571c94d
Opcode Fuzzy Hash: 93c78b05dfa5d6bf99a6d756930f3895cbd452118b5189bc71f33949af87d953
Instruction Fuzzy Hash: DFB159357083558FC725CE29D892A3EBBE2FFD5218F09C67CE9954B352EA349801C791

Function 01556B7E Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dca430dc1b13f0e79f667f758987e3110e06fb6a0e81298e12ccbeb9bac739e6
Instruction ID: 44bc9ab465b21f82857b2286daf71a5c54fa128a181387a517f4a59fd5b1b1bd
Opcode Fuzzy Hash: dca430dc1b13f0e79f667f758987e3110e06fb6a0e81298e12ccbeb9bac739e6
Instruction Fuzzy Hash: E7A126B15007828FCB65CF38C8A1627BBE2FF95310B098A5DD89A8F792E735E445CB50

Function 0157CE00 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ec45bd29c7e9e237d7c8f38be03ceebf9ecc8c2acf6e2c693b62277da2ab039
Instruction ID: 41bc4ad58cdf1a5b0bfda410bb714defb95a5205e613e2be43950104d60dadb1
Opcode Fuzzy Hash: 0ec45bd29c7e9e237d7c8f38be03ceebf9ecc8c2acf6e2c693b62277da2ab039
Instruction Fuzzy Hash: 5FB10031A14216CFC714CF68E8906AFB7F1FB89311F0A486DE895A7348D734E955DB80

Function 01556E97 Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a6d4428f76d3c403ca9b388ee664dad311797076f2cb59fcac8a4eccca01e45
Instruction ID: d6e9a5be56589154dd3c80484a654a1d24a37c7fd2d976bfbda22bf321a41e18
Opcode Fuzzy Hash: 4a6d4428f76d3c403ca9b388ee664dad311797076f2cb59fcac8a4eccca01e45
Instruction Fuzzy Hash: 44A123B16047828FD735CF29C4E1B27B7E2BB99304F54896ED9AA8B746D330E805CB50

Function 01558C1E Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5769e26f6e56509c4c42d421dfc7d4192d0d4fcdeb5a35112c7c8b43625bb274
Instruction ID: 8e2df16b08e86cd23aec77e7db92b765c883125e26439287ad17df847c88ce39
Opcode Fuzzy Hash: 5769e26f6e56509c4c42d421dfc7d4192d0d4fcdeb5a35112c7c8b43625bb274
Instruction Fuzzy Hash: 4CB1EF76600701CFC7258F2AC890B66B7F2FF95710B1A859ED8968F7A4EB34E402CB10

Function 01546200 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc1db6a217cb8f63b2a4c53b2a12e6814aef47cb0c90e13827f5475dc9e5d2a9
Instruction ID: c2b96f1d94a33ef353c621c9f8a54aa56ca8d34693c1e5327577a342376a40d4
Opcode Fuzzy Hash: dc1db6a217cb8f63b2a4c53b2a12e6814aef47cb0c90e13827f5475dc9e5d2a9
Instruction Fuzzy Hash: E6C17DB2A187418FC320CF68CC86BABB7F1BF85318F08492DD1D9C6242E778A155CB46

Function 0157DFB0 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: cbb46faa58f8cf08225412fbce3aab0a1411b7f77e25c56728e84c461d54db33
Instruction ID: 1a9a96bef244dbc284b6d2fa8bd1d9275e83dfdef8bae97b332e8af95209c323
Opcode Fuzzy Hash: cbb46faa58f8cf08225412fbce3aab0a1411b7f77e25c56728e84c461d54db33
Instruction Fuzzy Hash: D191E0756083028FD715DE18E89292EB7E6FF99714F1989ACE9858F351E730EC00CB82

Function 0157DCF0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7782f7594703a9bbedfbf459afe30d713aa247e034687b0aeb66ca8b7a4bcde3
Instruction ID: 6703b3d701d781f65a8fb5c9323f2970ea9bd1c65006b7965bf2cfad51e4b168
Opcode Fuzzy Hash: 7782f7594703a9bbedfbf459afe30d713aa247e034687b0aeb66ca8b7a4bcde3
Instruction Fuzzy Hash: 897168326043015FD725AE6DE851A3FB7B6FFD9750F1AC82CE9859F265EB3098408782

Function 01568F5D Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25de9eb5de5e130ba40f56309e8188060599233b601be11fd0932edeb34f4ab7
Instruction ID: f018491baec0682bd48cfd596885ea93b40f3dced18d476945f28dba86c34208
Opcode Fuzzy Hash: 25de9eb5de5e130ba40f56309e8188060599233b601be11fd0932edeb34f4ab7
Instruction Fuzzy Hash: 45914CB29083418FCB14CF68C45126FFBE6BFD1218F59896DE4D64F242E635E945CB82

Function 0154CA54 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b2f66222d8167d267b310cb8624940337a2ebaff6b5613430ac462e1dd12a02
Instruction ID: b926ede4e02a7b82dbeb07930a3978787169051575850c975ce253ff7080cece
Opcode Fuzzy Hash: 2b2f66222d8167d267b310cb8624940337a2ebaff6b5613430ac462e1dd12a02
Instruction Fuzzy Hash: 995159765453118BCB25CF18D8D01AB7B72FF86324319929CCC916F3AAE7349802CBA9

Function 0154B351 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55f47e1f3903968cbf8ff7344882906fb5c5ff2c3237bec8519964d7e567ab54
Instruction ID: 67bcd6316d06845baabe246dbfedaf976d7b7a63e3c40a0723b5753e321715bf
Opcode Fuzzy Hash: 55f47e1f3903968cbf8ff7344882906fb5c5ff2c3237bec8519964d7e567ab54
Instruction Fuzzy Hash: 24816072650B018FC724CF29DC51B5BB7E6FB88314B098A2DD5A6CBB94D778F8058B50

Function 01579B90 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 614b61cacfd9fe8ad6dda3783f1bf869fdf91b181dca45fbf1effa4e2293ee39
Instruction ID: 7812d5c48d14ef10b093604b0f6a0686d61e4d5a6682d5ab6b657504c4309dbc
Opcode Fuzzy Hash: 614b61cacfd9fe8ad6dda3783f1bf869fdf91b181dca45fbf1effa4e2293ee39
Instruction Fuzzy Hash: 70613A726082045FE724DF29E851A7FBBA3FBD0318F29846DD5869F355EA319801C7A1

Function 015567A5 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f20bdff412f8ae2e37f90a06e26b118bbc246b999e8beb74b55ad1603c72d09c
Instruction ID: 1d91b808d134b02f4567df1d8ba4fc1598c846521a8221ecc39ebcbf113675ec
Opcode Fuzzy Hash: f20bdff412f8ae2e37f90a06e26b118bbc246b999e8beb74b55ad1603c72d09c
Instruction Fuzzy Hash: 0F51E0747053808FE7668E59C8A1B3A77E3FB94308F98A46DDA964F756C374A801CB21

Function 0155D8E0 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c66368fe6470ad38cbf805ef7c1facb880b03d4b2371c70eb472cc268c438e65
Instruction ID: fe2b18698ba96acfb6bdcd5b476d63ef746c33440ddd91a64b2aedf0d403e619
Opcode Fuzzy Hash: c66368fe6470ad38cbf805ef7c1facb880b03d4b2371c70eb472cc268c438e65
Instruction Fuzzy Hash: BC71153364969147D36988BC4C222AABAE31BD2134F1EC76AEDF5CB3E5D5A58C098341

Function 01556571 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c394f4903588c33cacf7afd076fdbce5b8eb0da744e9ee0ddd47e8511d0b63e0
Instruction ID: 077de521ea9e7af81f7c38574627f1d4cbb2a608ade54a87027fff55fdeed00b
Opcode Fuzzy Hash: c394f4903588c33cacf7afd076fdbce5b8eb0da744e9ee0ddd47e8511d0b63e0
Instruction Fuzzy Hash: 9351E4743457808FE7658E19C8A1B3A7BA3FB94308F9995ADDA924F756D374AC00CB20

Function 01565670 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 268e6a86c9647423a3e0406f1efe1fb1f3a43167bedebd64417b2eb9c2239687
Instruction ID: 60084acbd4122b0313dd943d719c3d794ba0a017b6c29b2ea39212f8ba11c493
Opcode Fuzzy Hash: 268e6a86c9647423a3e0406f1efe1fb1f3a43167bedebd64417b2eb9c2239687
Instruction Fuzzy Hash: 4361C0B01583009BD7249F28D89166BBBE5FF823A4F548A1DE4D68F3A1E7388505CB96

Function 01563D30 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 211de89b369f8dc5991dbef31542f4381427bd323d9afbd528b9bb93cc1b6e51
Instruction ID: bf06e74c735e95b7c86d6edbfc2fa823eece54c72f8503eefa3f67be74d4af82
Opcode Fuzzy Hash: 211de89b369f8dc5991dbef31542f4381427bd323d9afbd528b9bb93cc1b6e51
Instruction Fuzzy Hash: A75148722083469FE334CF54EC41B9FBBE5FBC5318F01492DE9A8AB281D77494098B82

Function 01576430 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee3221d44487f1b55dcfb0cb7b306b7a5088c2c108d24d47baceea343636d859
Instruction ID: 53ccb4808360ba7750c7a10037bcef618d8c61716621dcc4c00f139cefe497e8
Opcode Fuzzy Hash: ee3221d44487f1b55dcfb0cb7b306b7a5088c2c108d24d47baceea343636d859
Instruction Fuzzy Hash: 49516AB16087548FE314DF29D89535FBBE1BBC8318F044A2DE5E987390E379D6088B82

Function 0155CEA5 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8790ee0d8d56edd7fabd9cf1ac68d7142ab2ac0e53c02a66035e209d82ee198
Instruction ID: 04eaa86085c129d8da4180fe58502b0153217fa03d77890c115fb3ff3729fa20
Opcode Fuzzy Hash: c8790ee0d8d56edd7fabd9cf1ac68d7142ab2ac0e53c02a66035e209d82ee198
Instruction Fuzzy Hash: D8412EA551835287CB209F28C82127FF3F4BF92358F59894EE8D59B380E734D545C36A

Function 0155AE00 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40a983e801754689feb8aafebcae9660adcb1d41678f22a04849496a7e32c976
Instruction ID: b04b09a45208e00beb170aa48043f20ab114d5c538004eea9d8329572fbdc90f
Opcode Fuzzy Hash: 40a983e801754689feb8aafebcae9660adcb1d41678f22a04849496a7e32c976
Instruction Fuzzy Hash: D7510732759A804BE37C883C9C3227E79835FD2234B2D976FE9B68F3E5D56548095350

Function 0155DC20 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e39b642201ac8f5ea1651ba19e7fcbc2ae92bff50c836461074e1756971b08ea
Instruction ID: 57e6e2159d15d43fa79e934132aedadbebdbf8a8774287427e8067361fa62207
Opcode Fuzzy Hash: e39b642201ac8f5ea1651ba19e7fcbc2ae92bff50c836461074e1756971b08ea
Instruction Fuzzy Hash: 725108336499814BD379887C9C323AA7AE35BD6130B2DC76FE9B2CF3E5D59548099340

Function 01563E30 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8676b587c5a67e17e52d8bcf24997217304052b34be73be071e99fb4551ff4a7
Instruction ID: 9f63d7012c2dd795ddb29f7fa03cee378ebda2911b3ddba1d7d5e5ae325f928e
Opcode Fuzzy Hash: 8676b587c5a67e17e52d8bcf24997217304052b34be73be071e99fb4551ff4a7
Instruction Fuzzy Hash: FE5115727183019FD324CE58EC41B5FBBE5FBD8314F06492DE9A9AB281D7759808CB82

Function 01567307 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0190613180785c849a5cd58755e787a5423b59f690d4bfebbd6a910683cbae8
Instruction ID: e3f1de67f81e13ec32730c8e27a65ffad53b57bb13412f610d1c1d3c67445eda
Opcode Fuzzy Hash: d0190613180785c849a5cd58755e787a5423b59f690d4bfebbd6a910683cbae8
Instruction Fuzzy Hash: E151C8B011C3118BC724DF68D4A122FBBF0FFA6249F004A2DD9E64B765E7798508DB96

Function 01565F7D Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53492e136e45b1faa56474b7332ed2b0d8d22f113580ff20cb65705147d96a44
Instruction ID: d75a29daa549d0ba9df52157baa7df7266164bba2e74225af2f990b51c9e8da2
Opcode Fuzzy Hash: 53492e136e45b1faa56474b7332ed2b0d8d22f113580ff20cb65705147d96a44
Instruction Fuzzy Hash: 62416AB3C497658BC6309A68985017FB6E9FBC5250F49887DEED29B245FB34AD0183C2

Function 00077794 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa20cfbcd7b5cc72b940c3cff0acd792b6791bbd3311bffdab1565aaef271c20
Instruction ID: 29c750c9329ad65c4175808f356772b25eb222f6d58c1d8a340ac2b8e6519166
Opcode Fuzzy Hash: aa20cfbcd7b5cc72b940c3cff0acd792b6791bbd3311bffdab1565aaef271c20
Instruction Fuzzy Hash: BF511775E0422A8B8F55CFA9C4945EEFBF1AB8C360B24C16AD858B3304E6359C05CFA4

Function 01548990 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 367c31638055309794f69e9f1362a6cfb166745821b7f7e74973013f3529307c
Instruction ID: 98f065be63e99968fc6e30f395216c7daa11fadb2a9b470fcedd4e13915c8dfa
Opcode Fuzzy Hash: 367c31638055309794f69e9f1362a6cfb166745821b7f7e74973013f3529307c
Instruction Fuzzy Hash: 76317633A2181147E354CA2ACC0479532D3ABD9338F3ECAB8D865DF697C97799038780

Function 015692D0 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f66b2dde0a7fa289d88fb84d004448df9a381ece124c9bc2621585e26d9cc5b
Instruction ID: 5806ea3acf2e5c00b43f8437533f792f2c3ec6bb5708930f6a139f939a576b3b
Opcode Fuzzy Hash: 1f66b2dde0a7fa289d88fb84d004448df9a381ece124c9bc2621585e26d9cc5b
Instruction Fuzzy Hash: B74138B2B193414FD71CCF25C8A276FFBA2FBC5308F16982CE5869B285CA7494078B45

Function 01576B20 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91220374a97f5aff33aa7e71888e41c88829f78e25f822e198eb2ef461918297
Instruction ID: 6a01ba4c42d8fa6adde1cc3727ea9e80fe2b5300487dc74df245ab74f9cd2dbd
Opcode Fuzzy Hash: 91220374a97f5aff33aa7e71888e41c88829f78e25f822e198eb2ef461918297
Instruction Fuzzy Hash: 10313676E083284B83249E5E89820BBF7E8EBC9614F0AD52ED898EB311E570DD0147C5

Function 000868D8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2800aabcff5c521bed1532af4c6f777cc4f781d53872384f4b3fd4599258c280
Instruction ID: b64bfa9065f0eb8fcdca77f3b26e435a258cef1320e435b0db138cf14881d2bd
Opcode Fuzzy Hash: 2800aabcff5c521bed1532af4c6f777cc4f781d53872384f4b3fd4599258c280
Instruction Fuzzy Hash: B531C5B4A04219CFDB40EF68C84476EBBF0FB49300F11852AE8D5DB390D7799994DB92

Function 0155597D Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bce6e2b113d03b1f1e088ec0c7c64365c9f1e65142dd2f6368c32a71357b1a92
Instruction ID: 060d0cb4b01ced680f2f4d2de648a8c6df0106fcec711fe44d25165ad4b72675
Opcode Fuzzy Hash: bce6e2b113d03b1f1e088ec0c7c64365c9f1e65142dd2f6368c32a71357b1a92
Instruction Fuzzy Hash: 94017B306303019BF726891ED861B3A77B3FB82305FD4A42DE9826B285EBA4B451C750

Function 015745F0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: d6e2e642d7fab8f476044348bbe0f86fecad6c5d7650b6261be00cca71ef1028
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 7D11E533A051E48EC3168D3CA400569BFE32A93234B5D8399F4B99F2D6D6228D8A8354

Function 0156A060 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a62376ffa6d90c1baa96e3dbf302ab3dfe7742f197fede568b4cb05d9ce342f2
Instruction ID: 1ec5749400639319bf0b3647d26e52f19e5a3802da3c8af1e895e1d2b2d15f94
Opcode Fuzzy Hash: a62376ffa6d90c1baa96e3dbf302ab3dfe7742f197fede568b4cb05d9ce342f2
Instruction Fuzzy Hash: 940184F570070357E731AE59A4C072BB6AC7FD5628F19442CDA096F241EB76E805C6D1

Function 01542B70 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ca34e302d4d56d94d28b15cd99d5fbb098d083d07c8a62181b29cb62c21485b
Instruction ID: 8aefc5738caa558aa4b3b88aec7f0038adcea6db793045bdaf9aa6757ffb0b7b
Opcode Fuzzy Hash: 5ca34e302d4d56d94d28b15cd99d5fbb098d083d07c8a62181b29cb62c21485b
Instruction Fuzzy Hash: D9F0E237B195250BB221CD2BBCC093BB7A6E7C6218F1A443DF955DB201C935E80692A0

Function 0156B3DE Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e211f1809208d1be008752d4f5be6e180d8f7cc2b630f07baaef95f9961d3e00
Instruction ID: e05235b2135355419b2895447e12f907882e84f5e43a3baa44e8523f1d0d33e8
Opcode Fuzzy Hash: e211f1809208d1be008752d4f5be6e180d8f7cc2b630f07baaef95f9961d3e00
Instruction Fuzzy Hash: E1F0E925B896C385D31A8A3E8070335FFE59F77251F2C6568C4E29B3C3E72684099754

Function 0156B475 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 882197bb862302f85da4311849e1011a11471047094316412d1343de527cf5c0
Instruction ID: 2ef0d14e07e8d9e23948255d518462383c03d2ca2012b7fcc686a0d346cb673b
Opcode Fuzzy Hash: 882197bb862302f85da4311849e1011a11471047094316412d1343de527cf5c0
Instruction Fuzzy Hash: 7ED02278B140035BC318EB24F95143DB3A8AF9719AB013038C407FF302FA30E820864A

Function 0154C274 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2319d458cb043476912ef35907aa2110204a5abaad1b493db3e0a7fdfd84fe6b
Instruction ID: 21d458cdf6095a75455b97d248b21806e040d751e9a852c937961220b0fbda24
Opcode Fuzzy Hash: 2319d458cb043476912ef35907aa2110204a5abaad1b493db3e0a7fdfd84fe6b
Instruction Fuzzy Hash: 36D0123094A2994AD3169E3898A1735BBB1EB03100F053548C152EF285C7D0901AD758

Function 0007E774 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 0007E7B1
CreateSemaphoreA.KERNEL32(?,?,00000000,00000014), ref: 0007E7F4
CreateSemaphoreA.KERNEL32 ref: 0007E813
CloseHandle.KERNEL32 ref: 0007E829
CloseHandle.KERNEL32(00000000), ref: 0007E83A
free.MSVCRT ref: 0007E844
InitializeCriticalSection.KERNEL32 ref: 0007E860
InitializeCriticalSection.KERNEL32(00000000), ref: 0007E869
InitializeCriticalSection.KERNEL32 ref: 0007E872

Strings

l, xrefs: 0007E7A2

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: CriticalInitializeSection$CloseCreateHandleSemaphore$callocfree
String ID: l
API String ID: 3701386200-2517025534
Opcode ID: 7e0eee1c2944c693a25c84afa70a88d41e324eb4e797aa02c1a1e9e7a3871d15
Instruction ID: 4ed8b19ff5d31d3e1dd23a7dbaf8a01e893a40ee2810b5896fb0ac1a94cfe9be
Opcode Fuzzy Hash: 7e0eee1c2944c693a25c84afa70a88d41e324eb4e797aa02c1a1e9e7a3871d15
Instruction Fuzzy Hash: 3B3107B1A053409FDB94EF69C88465ABBE4EF88310F1589ADE89CCB346E739D440CB52

Function 00087520 Relevance: 15.1, APIs: 10, Instructions: 138COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00087574

Part of subcall function 00077D78: abort.MSVCRT ref: 00077DB2

fputs.MSVCRT ref: 000875E5
fputs.MSVCRT ref: 0008761D
fputs.MSVCRT ref: 00087641
free.MSVCRT ref: 00087652
fputs.MSVCRT ref: 00087682
abort.MSVCRT ref: 0008768E
fputs.MSVCRT ref: 000876E3
fputs.MSVCRT ref: 000876FF
fputc.MSVCRT ref: 0008771C

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: fputs$abort$fputcfree
String ID:
API String ID: 193835883-0
Opcode ID: 9642eae56b72bc8ff1c4225ee2c9856bab54f96a437bab6a10733c3e6884e7ae
Instruction ID: 443c552fdb1e0d42155c18968a58a6b37be7270afb548a771de39acd308f9016
Opcode Fuzzy Hash: 9642eae56b72bc8ff1c4225ee2c9856bab54f96a437bab6a10733c3e6884e7ae
Instruction Fuzzy Hash: 6851B9B0C087888FDB10BFA9D44969DBBF0BF08310F15895DE4E9AB296D7788481CF56

Function 00081C6A Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00081C7E
GetCurrentProcessId.KERNEL32 ref: 00081C90
OpenProcess.KERNEL32 ref: 00081CAB
GetLastError.KERNEL32 ref: 00081CB8
_errno.MSVCRT ref: 00081CCD
CloseHandle.KERNEL32 ref: 00081CDD
_errno.MSVCRT ref: 00081CE8

Strings

`a2v`d5v, xrefs: 00081C7E, 00081CCD, 00081CE8

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: _errno$Process$CloseCurrentErrorHandleLastOpen
String ID: `a2v`d5v
API String ID: 1444142086-3364292874
Opcode ID: eaa4f34b6084dc9f7437c5202ee8aac3e7959a08e3ef12f7d367e41fda2e4826
Instruction ID: e0b9ac9916bce06f8c11af23eb1dacd24f3ad70b5b65036f09bcc6d30edee377
Opcode Fuzzy Hash: eaa4f34b6084dc9f7437c5202ee8aac3e7959a08e3ef12f7d367e41fda2e4826
Instruction Fuzzy Hash: 220156B16443059FE7607FA9DC882EA7BE8FF06321F014125FC9983250D7794941DBA3

Function 00080EE9 Relevance: 13.6, APIs: 9, Instructions: 139threadinjectionsynchronizationCOMMON

Download Yara Rule

APIs

GetHandleInformation.KERNEL32 ref: 00080F26
SetEvent.KERNEL32 ref: 00080F6E
SuspendThread.KERNEL32 ref: 00080FE7
WaitForSingleObject.KERNEL32(00000000), ref: 00080FFA
GetThreadContext.KERNEL32 ref: 00081017
SetThreadContext.KERNEL32 ref: 00081033
SetEvent.KERNEL32(?,?), ref: 0008105C
ResumeThread.KERNEL32(?,?), ref: 00081071
SetEvent.KERNEL32 ref: 0008109B

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: Thread$Event$Context$HandleInformationObjectResumeSingleSuspendWait
String ID:
API String ID: 56398499-0
Opcode ID: f4450b6118fcf5dbbc8f37304f68f8ade05e4c4c3e9bc329edc798546938f6de
Instruction ID: b489a0a5ac20561222ee6804a709de0323ca74515f145369d335060f3be6d8e2
Opcode Fuzzy Hash: f4450b6118fcf5dbbc8f37304f68f8ade05e4c4c3e9bc329edc798546938f6de
Instruction Fuzzy Hash: E15170B1A04B429BD750AF78DC446A9BBF8BF09310F00461CF4D9C7A82D778E591DB92

Function 0007EBEE Relevance: 13.6, APIs: 9, Instructions: 113COMMON

Download Yara Rule

APIs

TryEnterCriticalSection.KERNEL32 ref: 0007EC7B
LeaveCriticalSection.KERNEL32 ref: 0007ECCE
CloseHandle.KERNEL32 ref: 0007ECFA
CloseHandle.KERNEL32 ref: 0007ED03
LeaveCriticalSection.KERNEL32(75922EE0), ref: 0007ED0C
DeleteCriticalSection.KERNEL32(00000000), ref: 0007ED1F
DeleteCriticalSection.KERNEL32(00000000), ref: 0007ED28
DeleteCriticalSection.KERNEL32(00000000), ref: 0007ED31
free.MSVCRT ref: 0007ED37

Part of subcall function 0007E4C4: EnterCriticalSection.KERNEL32(?,?,?,?,?,00000001,?,?,0007EFF3,00000000), ref: 0007E4D7
Part of subcall function 0007E4C4: LeaveCriticalSection.KERNEL32(00000000,?,?,?,?,?,00000001,?,?,0007EFF3,00000000), ref: 0007E50D

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: CriticalSection$DeleteLeave$CloseEnterHandle$free
String ID:
API String ID: 1444599582-0
Opcode ID: 49cfff86533740be7b631afd8f61a991a8d48af63dd193da4a9d4892d00f1ab7
Instruction ID: 642b488532466a591589864b175f106192d7ecca5871fed9754f7e3b104a1500
Opcode Fuzzy Hash: 49cfff86533740be7b631afd8f61a991a8d48af63dd193da4a9d4892d00f1ab7
Instruction Fuzzy Hash: 1A415EB0A05744CFDB20EF69C4849AEB7F5EF88310F11896DE88997391D738A841CB66

Function 00081399 Relevance: 12.2, APIs: 8, Instructions: 158sleepthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 0007FD82: calloc.MSVCRT ref: 0007FDAF

CreateEventA.KERNEL32 ref: 000813F8
Sleep.KERNEL32 ref: 00081417
_beginthreadex.MSVCRT ref: 000814BA
CloseHandle.KERNEL32 ref: 000814D4
SetThreadPriority.KERNEL32 ref: 0008152D
ResetEvent.KERNEL32(00000000,00000000), ref: 0008153B
CloseHandle.KERNEL32(00000000), ref: 0008155B
Sleep.KERNEL32(00000000), ref: 00081571

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: CloseEventHandleSleep$CreatePriorityResetThread_beginthreadexcalloc
String ID:
API String ID: 1890343903-0
Opcode ID: 3c6d1e30e60e3e6d7fe5e1f658bd903e39cf118569ac553626ab1884c76acf5e
Instruction ID: 671a5f6696346f8ecf30842e9b3bbc11525a00f3458561331b1ae0d0909cf4b8
Opcode Fuzzy Hash: 3c6d1e30e60e3e6d7fe5e1f658bd903e39cf118569ac553626ab1884c76acf5e
Instruction Fuzzy Hash: C3513DB1A04A02DFD750EF79D4846AABBF8FF49310F008629F899C7651D734E981CB92

Function 0007E8DE Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 209synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,?,76EBFFB0,?,0007EBC4,00000000), ref: 0007E93A
ResetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,76EBFFB0,?,0007EBC4,00000000), ref: 0007E9AF
WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,?,76EBFFB0), ref: 0007EB49

Part of subcall function 0007F4A8: WaitForSingleObject.KERNEL32(?,?,?,?,?,?,0007EBC4,00000001,00000000,?,0007EB01), ref: 0007F4F5

WaitForSingleObject.KERNEL32 ref: 0007EAAD

Part of subcall function 00080DA5: ResetEvent.KERNEL32(0007EBC4,00000000,?,0007EB65,?,?,?,?,?,?,?,?,?,?,76EBFFB0), ref: 00080E00

WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,?,76EBFFB0,?,0007EBC4,00000000), ref: 0007E9F2

Part of subcall function 0007F4A8: WaitForSingleObject.KERNEL32(?,?,?,?,?,?,0007EBC4,00000001,00000000,?,0007EB01), ref: 0007F4CE

Strings

(, xrefs: 0007EA37

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: ObjectSingleWait$EventReset
String ID: (
API String ID: 466820088-3887548279
Opcode ID: 58f8f70cbc008fd325bfba7f267d8b5bdc0699d93b61ad703a6d81991935174a
Instruction ID: baef973e404157dde7fc975127eb6f0407970784c50a86e890bfa2d7f8d37d60
Opcode Fuzzy Hash: 58f8f70cbc008fd325bfba7f267d8b5bdc0699d93b61ad703a6d81991935174a
Instruction Fuzzy Hash: 3461D471E063959BEBB09A64C8802BF77E4BF4C710F15C4BAE98D97240D63D9C40975B

Function 0008090B Relevance: 10.6, APIs: 7, Instructions: 109sleepthreadCOMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32 ref: 0008094C
GetCurrentThreadId.KERNEL32 ref: 00080954

Part of subcall function 0007F7B0: GetCurrentThreadId.KERNEL32 ref: 0007F7DE

_setjmp3.MSVCRT ref: 00080977
CloseHandle.KERNEL32 ref: 000809EF
TlsSetValue.KERNEL32(00000000), ref: 00080A33
Sleep.KERNEL32(?,?), ref: 00080A73
_endthreadex.MSVCRT ref: 00080A7F

Part of subcall function 0007F7B0: SetEvent.KERNEL32(00000000,?,?,0007FF26,?,?,?,00000000,00000000,?,0007FF43), ref: 0007F814

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: CurrentThreadValue$CloseEventHandleSleep_endthreadex_setjmp3
String ID:
API String ID: 291999405-0
Opcode ID: cd348d939555ee6359af393edb4bc5d3328fc3a6c508e2ca97395ae437930ce6
Instruction ID: 603454f0d94c2e469c2ad91cee9000ae5f993592127d0297d1a99cfb57a41e7d
Opcode Fuzzy Hash: cd348d939555ee6359af393edb4bc5d3328fc3a6c508e2ca97395ae437930ce6
Instruction Fuzzy Hash: E141C6B4A082068FD744BFA4D88597EBBF4BF09300F01886DE9989B312D73CD846CB56

Function 00080BC9 Relevance: 10.6, APIs: 7, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 0007FF35: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00080564), ref: 0007FF4B
Part of subcall function 0007FF35: GetCurrentThreadId.KERNEL32 ref: 0007FF74
Part of subcall function 0007FF35: CreateEventA.KERNEL32 ref: 0007FF92
Part of subcall function 0007FF35: GetCurrentThread.KERNEL32 ref: 0007FFC2
Part of subcall function 0007FF35: DuplicateHandle.KERNELBASE ref: 0007FFF3
Part of subcall function 0007FF35: abort.MSVCRT(00000000,00000000), ref: 00080000
Part of subcall function 0007FF35: GetThreadPriority.KERNEL32(00000000,00000000), ref: 0008000B
Part of subcall function 0007FF35: TlsSetValue.KERNEL32 ref: 00080032

longjmp.MSVCRT ref: 00080C00
TlsGetValue.KERNEL32(?,0000001C,?,00080D4E,?,?,00000000,?,00080E14,0007EBC4,00000000,?,0007EB65), ref: 00080C0E
CloseHandle.KERNEL32(?,?,00080D4E,?,?,00000000,?,00080E14,0007EBC4,00000000,?,0007EB65), ref: 00080C31
CloseHandle.KERNEL32(?,?,00080D4E,?,?,00000000,?,00080E14,0007EBC4,00000000,?,0007EB65), ref: 00080C53
CloseHandle.KERNEL32(?,?,00080D4E,?,?,00000000,?,00080E14,0007EBC4,00000000,?,0007EB65), ref: 00080C71
TlsSetValue.KERNEL32(?,?,?,00080D4E,?,?,00000000,?,00080E14,0007EBC4,00000000,?,0007EB65), ref: 00080C92
_endthreadex.MSVCRT(?,?,00080D4E,?,?,00000000,?,00080E14,0007EBC4,00000000,?,0007EB65), ref: 00080C9D

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: HandleValue$CloseThread$Current$CreateDuplicateEventPriority_endthreadexabortlongjmp
String ID:
API String ID: 2786978526-0
Opcode ID: 5cbb876200fb9ce2c7a31ea5ce6d0feb9745e0d0b0758c0ed233b6be1b160c00
Instruction ID: af471dccdda25cbaaceab9552f2f440bc0f93a69e9674f75fc53a8ee03c7fb22
Opcode Fuzzy Hash: 5cbb876200fb9ce2c7a31ea5ce6d0feb9745e0d0b0758c0ed233b6be1b160c00
Instruction Fuzzy Hash: A6210EF06047018FEB80AF78D98862A7FE4FF09300F054968ED88CB216E779D844DB92

Function 00081BFD Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00081C0F
OpenProcess.KERNEL32 ref: 00081C2A
GetLastError.KERNEL32 ref: 00081C37
_errno.MSVCRT ref: 00081C4C

Strings

`a2v`d5v, xrefs: 00081C4C

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: Process$CurrentErrorLastOpen_errno
String ID: `a2v`d5v
API String ID: 1035239118-3364292874
Opcode ID: e57d203ba8158c15239347debe9c3212a51aa25cf901b64d36deeccae6380336
Instruction ID: a10fa6e60d7ef944a946028fb2b8c8542b1057a41e1556673f65d45a032264bf
Opcode Fuzzy Hash: e57d203ba8158c15239347debe9c3212a51aa25cf901b64d36deeccae6380336
Instruction Fuzzy Hash: 7BF062B0704701DBD790BF79D9C82A97BECBF59345F104528E58BC2261D6398842EB26

Function 00080774 Relevance: 8.9, APIs: 7, Instructions: 123COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 000807FA
CloseHandle.KERNEL32 ref: 00080838
CloseHandle.KERNEL32 ref: 00080845
TlsSetValue.KERNEL32 ref: 00080877
CloseHandle.KERNEL32 ref: 00080891
CloseHandle.KERNEL32 ref: 000808C8
CloseHandle.KERNEL32 ref: 000808DB

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: CloseHandle$Value
String ID:
API String ID: 2076415241-0
Opcode ID: 2f87dca4ec2c7e054ee91d59dacdea6c2ff070f76dfd1163e26ff8bc30da1f2e
Instruction ID: 5f91e7176c59e58807d42be4d502cad061a803e82e791518b9ddda88cbedf241
Opcode Fuzzy Hash: 2f87dca4ec2c7e054ee91d59dacdea6c2ff070f76dfd1163e26ff8bc30da1f2e
Instruction Fuzzy Hash: 8E412070A04742CFEB90FF79D88466A7BE4BF44310F054569E8C8CB652DB78D894DB92

Function 000CB400 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

_read.MSVCRT ref: 000CB431

Strings

random_device could not be read, xrefs: 000CB44E
`a2v`d5v, xrefs: 000CB448, 000CB45A

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: _read
String ID: `a2v`d5v$random_device could not be read
API String ID: 3312595324-473924143
Opcode ID: 95cccbda6735602f610f55f6c762bee72f8632a09bf815d40a6ce7f751c0a17a
Instruction ID: ebfdec660a4350bd9377143d064e2cfc041a2f83541b6e96f48dae93d91dfbfd
Opcode Fuzzy Hash: 95cccbda6735602f610f55f6c762bee72f8632a09bf815d40a6ce7f751c0a17a
Instruction Fuzzy Hash: 2E016271A082019FC7189FA9D486A7EB7E4EB46350F10402DF949C7262D735DC41DB92

Function 00077EE8 Relevance: 7.6, APIs: 5, Instructions: 120COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 00077F69
abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,000E7BF2), ref: 00077F74
realloc.MSVCRT ref: 00077F9E
malloc.MSVCRT ref: 00077FF2
malloc.MSVCRT ref: 00078010

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: malloc$abortcallocrealloc
String ID:
API String ID: 2175960609-0
Opcode ID: 7cc1722565a9f9f72f986a0f9f349545ebef841fa5f47f69db3ab5d17b7bd4b7
Instruction ID: 4d7a4eac787b1d53227127b3c9b7f36334c058c4c4391f7981edf348f29953df
Opcode Fuzzy Hash: 7cc1722565a9f9f72f986a0f9f349545ebef841fa5f47f69db3ab5d17b7bd4b7
Instruction Fuzzy Hash: BC417C71E082158FCB54EF68C5849ADBBE1FF88350B46C569E88C9B311EB38E905CB85

Function 00080901 Relevance: 7.6, APIs: 5, Instructions: 98sleepthreadCOMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32 ref: 0008094C
GetCurrentThreadId.KERNEL32 ref: 00080954

Part of subcall function 0007F7B0: GetCurrentThreadId.KERNEL32 ref: 0007F7DE

_setjmp3.MSVCRT ref: 00080977
CloseHandle.KERNEL32 ref: 000809EF
TlsSetValue.KERNEL32(00000000), ref: 00080A33
Sleep.KERNEL32(?,?), ref: 00080A73
_endthreadex.MSVCRT ref: 00080A7F

Part of subcall function 0007F7B0: SetEvent.KERNEL32(00000000,?,?,0007FF26,?,?,?,00000000,00000000,?,0007FF43), ref: 0007F814

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: CurrentThreadValue$CloseEventHandleSleep_endthreadex_setjmp3
String ID:
API String ID: 291999405-0
Opcode ID: 2927076cef72eef9beb63df0f8f64bb697eb5fdd11da2869065ca9ebb692e28a
Instruction ID: b739b49bed77221bc2cb665e922c5abca441d19a96c715b6777265cdb8f9b67d
Opcode Fuzzy Hash: 2927076cef72eef9beb63df0f8f64bb697eb5fdd11da2869065ca9ebb692e28a
Instruction Fuzzy Hash: 2D41B7B4A182068FD744AFA4D98597EBBF4BF09300F01886DE9989B312E739D845CB56

Function 000770EC Relevance: 7.6, APIs: 5, Instructions: 90COMMON

Download Yara Rule

APIs

signal.MSVCRT ref: 00077154
signal.MSVCRT ref: 00077190
signal.MSVCRT ref: 000771A9
signal.MSVCRT ref: 000771D3
signal.MSVCRT ref: 000771EC

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: signal
String ID:
API String ID: 1946981877-0
Opcode ID: 79e55037ae3bd352c64bbea6482fd553768f142b9d754357cf6f8697630fb457
Instruction ID: 8463e9f5283a2481cb1ec353c5474020ba14ab156b7451710e51de0b412defb0
Opcode Fuzzy Hash: 79e55037ae3bd352c64bbea6482fd553768f142b9d754357cf6f8697630fb457
Instruction Fuzzy Hash: 18318CB0C0D2049AE7606B68C44037E76D4AB413A4F65C81AE9EDC7292C73EC881D76F

Function 0007F630 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 9928df9178c7a3910f36ee61218ec31ee618541e637a65bf8d04fd7c5b0e293b
Instruction ID: 8f416da262e68a2203f1e1d3443bbce0b35dd21cd251bcb6e355707d487e84e2
Opcode Fuzzy Hash: 9928df9178c7a3910f36ee61218ec31ee618541e637a65bf8d04fd7c5b0e293b
Instruction Fuzzy Hash: 34314B70E082029FEF689F69C48427A77E0AF84354F14C47AE41DCB215EB3CC841DB5A

Function 0007E4C4 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,00000001,?,?,0007EFF3,00000000), ref: 0007E4D7
LeaveCriticalSection.KERNEL32(00000000,?,?,?,?,?,00000001,?,?,0007EFF3,00000000), ref: 0007E50D
LeaveCriticalSection.KERNEL32(00000000), ref: 0007E526

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: 2b2c9e102e814d8d378f48341899377d37c68dbda2cef82df367927f36e824e5
Instruction ID: c11700cbba06fb4214f77e9e44cc3286c1006b6597d88c298aa2af481b2e3423
Opcode Fuzzy Hash: 2b2c9e102e814d8d378f48341899377d37c68dbda2cef82df367927f36e824e5
Instruction Fuzzy Hash: 3F1176B0B046189FDB40DF6DDC80AAEBBE8FF8D714F008628E558C7210E638D8419B92

Function 0008AB4C Relevance: 7.6, APIs: 5, Instructions: 68stringCOMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 0008AB86
strlen.MSVCRT ref: 0008AB91
setlocale.MSVCRT ref: 0008ABC5
strftime.MSVCRT ref: 0008ABE5
setlocale.MSVCRT ref: 0008ABF9

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: setlocale$strftimestrlen
String ID:
API String ID: 2773559992-0
Opcode ID: 519e3925edd525cf987259fe97fc4815ff6d6415faf09a900d1934ab2ff48b89
Instruction ID: 3fdb98489bdd6a3d97faba51cdffd727c8b3fb697d098dbddc19dec55c9362e6
Opcode Fuzzy Hash: 519e3925edd525cf987259fe97fc4815ff6d6415faf09a900d1934ab2ff48b89
Instruction Fuzzy Hash: 0231A7B4D093489FCB54EFA9C58559DBBF0BF48310F11882EE498E7302D7389981CB56

Function 0008AE0C Relevance: 7.6, APIs: 5, Instructions: 68stringCOMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 0008AE46
strlen.MSVCRT ref: 0008AE51
setlocale.MSVCRT ref: 0008AE85
wcsftime.MSVCRT ref: 0008AEA5
setlocale.MSVCRT ref: 0008AEB9

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: setlocale$strlenwcsftime
String ID:
API String ID: 64219055-0
Opcode ID: 563c255b35d1c3b556e21ff62e42fc3c2586561fd6a8608fb402de6b6368ce0d
Instruction ID: d027fb4b9d4eb01fe897febe40c23ea431d1c629caa3cc058f2bf7da0890ab7f
Opcode Fuzzy Hash: 563c255b35d1c3b556e21ff62e42fc3c2586561fd6a8608fb402de6b6368ce0d
Instruction Fuzzy Hash: 1E31A4B4D097489FCB54EFA9C58559DBBF0FF48310F01886AE888E7302E7349981CB56

Function 000E423C Relevance: 7.6, APIs: 5, Instructions: 54stringCOMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 000E4254
strcmp.MSVCRT ref: 000E4266
strlen.MSVCRT ref: 000E4272
setlocale.MSVCRT ref: 000E429D
setlocale.MSVCRT ref: 000E42D3

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: setlocale$strcmpstrlen
String ID:
API String ID: 3672321321-0
Opcode ID: 731d0e22f3137b269ab8ca55426a05ea600570f942ef145c673ec40a3176fc7d
Instruction ID: 4b5b85246f31994ca1263bd93fa6037586c7b1e1f0e1691b58f418ebfb2dda18
Opcode Fuzzy Hash: 731d0e22f3137b269ab8ca55426a05ea600570f942ef145c673ec40a3176fc7d
Instruction Fuzzy Hash: 0A11DAB19093899FCB54EF75D88569EBBE4AF48350F01887DFA8C97302E7789840CB56

Function 00084DF8 Relevance: 7.6, APIs: 5, Instructions: 54stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00084E19
malloc.MSVCRT ref: 00084E25
_vsnprintf.MSVCRT ref: 00084E56
realloc.MSVCRT ref: 00084E6A
free.MSVCRT ref: 00084E80

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: _vsnprintffreemallocreallocstrlen
String ID:
API String ID: 2333638281-0
Opcode ID: 37330a604254a0719df7120e52ab6f769286636dc7b010894a82630928598e30
Instruction ID: 63fa4cbc27e918bf166b4782f5f93110eae4d38a141e239a74e6a0a07d9869d8
Opcode Fuzzy Hash: 37330a604254a0719df7120e52ab6f769286636dc7b010894a82630928598e30
Instruction Fuzzy Hash: 591184719057169BDB107F79C48566DBBE8BF44364F11862EF8D887382EB78C5408B93

Function 01567546 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 72fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(00000000,?,00000000), ref: 01567607

Strings

B\, xrefs: 0156759A
OR, xrefs: 0156758A
JC, xrefs: 01567592

Memory Dump Source

Source File: 00000000.00000002.2129992256.0000000001540000.00000040.10000000.00040000.00000000.sdmp, Offset: 01540000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FXdg37pY22.jbxd

Similarity

API ID: CopyFile
String ID: B\$JC$OR
API String ID: 1304948518-2992266057
Opcode ID: 5aa5d203e75c22d190f9ffd37b95c668672e06fd45a5ec849c9ae39fe71a7372
Instruction ID: 8d5f7d7716421bccf86a48f19c23121f124dd35a3b0ed01895c0d45c48f4b52c
Opcode Fuzzy Hash: 5aa5d203e75c22d190f9ffd37b95c668672e06fd45a5ec849c9ae39fe71a7372
Instruction Fuzzy Hash: 4421BF74649341CFC3309FA0A806B1FBBF4FB85300F02A81CE5E59B291EB78851ADB46

Function 0007FE4A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0007FE6E
OutputDebugStringA.KERNEL32 ref: 0007FE93
abort.MSVCRT(00000000), ref: 0007FE9A

Strings

5, xrefs: 0007FE80

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: CurrentDebugOutputStringThreadabort
String ID: 5
API String ID: 3512971422-2226203566
Opcode ID: 292aed241c69313a18440b313fbfc454d41a839225cfa363a9352aed64f34901
Instruction ID: b6a43b776a0309eea6cad26afa31f867ff7578be91f5773f606bfb28d54f62d7
Opcode Fuzzy Hash: 292aed241c69313a18440b313fbfc454d41a839225cfa363a9352aed64f34901
Instruction Fuzzy Hash: 3DF054B0904705ABDB10AF78D8840AEBBF8FB44354F40896DF59C87252EB7D5245CB56

Function 0007DCD8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19stringCOMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 0007DCEB
strchr.MSVCRT ref: 0007DCFB
atoi.MSVCRT ref: 0007DD0C

Strings

., xrefs: 0007DCF0

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: atoisetlocalestrchr
String ID: .
API String ID: 1223908000-248832578
Opcode ID: 9978535371c109d4dbfea5a99aba8db5fdd8f4c3d350cac8ed83c877284b4e6f
Instruction ID: 1936ef4747af62a53830b3efe745f9b6f7ce13b3197335cb7e5c0595224e223c
Opcode Fuzzy Hash: 9978535371c109d4dbfea5a99aba8db5fdd8f4c3d350cac8ed83c877284b4e6f
Instruction Fuzzy Hash: BDE012749097444AD710BF38C44621AB9E5AF88304F11D86C50CCC7247FB78C8409747

Function 00080048 Relevance: 6.4, APIs: 5, Instructions: 110COMMON

Download Yara Rule

APIs

memmove.MSVCRT(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,00080C84), ref: 000800E8
free.MSVCRT ref: 00080105
free.MSVCRT ref: 00080141
free.MSVCRT ref: 00080150
free.MSVCRT ref: 0008015F

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: free$memmove
String ID:
API String ID: 1534225298-0
Opcode ID: 47f03a3daad48485e60cc13ae1d7e798a0b37750e76e31a9ccf6e31b6531f6c1
Instruction ID: e0692534945fa9f1f045da20b266c1ae2c209127bc535fc35bba93ad38b7e384
Opcode Fuzzy Hash: 47f03a3daad48485e60cc13ae1d7e798a0b37750e76e31a9ccf6e31b6531f6c1
Instruction Fuzzy Hash: C2413870E04245CFDF90EF69D8886AEBBF1BB88314F158469D488E7B21E3399845CB91

Function 00076A0F Relevance: 6.3, APIs: 5, Instructions: 86stringCOMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00076A60
strlen.MSVCRT ref: 00076AA8
strcpy.MSVCRT ref: 00076ABE
free.MSVCRT ref: 00076AC6
free.MSVCRT ref: 00076AD9

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: free$strcpystrlen
String ID:
API String ID: 2746913497-0
Opcode ID: 8cf4cd34f226a15169c9a57579d0d26f2672540edfa81e5daa9ee9f18e3a849c
Instruction ID: ba4e167357f9ae0c95bf418d0c468cac61b499e7cc632175663a2926d7b82246
Opcode Fuzzy Hash: 8cf4cd34f226a15169c9a57579d0d26f2672540edfa81e5daa9ee9f18e3a849c
Instruction Fuzzy Hash: CA314B70D04A45ABCF219FA6C0806AEB7F0AF98320F14C129D85E77381D77A9841CF9B

Function 00081653 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

GetHandleInformation.KERNEL32 ref: 000816A2

Part of subcall function 0007F7B0: GetCurrentThreadId.KERNEL32 ref: 0007F7DE

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: CurrentHandleInformationThread
String ID:
API String ID: 2774142965-0
Opcode ID: dc6da832f8427f100342723922a1f6f51e67545a123f41c96eaf0bd780585d5a
Instruction ID: e23b89501469340a0d4fd3e949afd37fe2089292c1a150a1f96268641325d142
Opcode Fuzzy Hash: dc6da832f8427f100342723922a1f6f51e67545a123f41c96eaf0bd780585d5a
Instruction Fuzzy Hash: 3E3194B4A082018BEB54BF75D480ABA77E8FF45340F05842DE9C8CB342D738D842CBA2

Function 0007E08C Relevance: 6.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 0007E102
IsDBCSLeadByteEx.KERNEL32 ref: 0007E123
MultiByteToWideChar.KERNEL32 ref: 0007E180
_errno.MSVCRT ref: 0007E18D

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: Byte$CharMultiWide$Lead_errno
String ID:
API String ID: 2766522060-0
Opcode ID: 0014de5f234b38fde98c066826a30312d9880911d793e57d67bcdb7a6abc8b9d
Instruction ID: 8da92dd58987bf803d37a17fecab4c769742607ec5d1a817750941e0a220a1cc
Opcode Fuzzy Hash: 0014de5f234b38fde98c066826a30312d9880911d793e57d67bcdb7a6abc8b9d
Instruction Fuzzy Hash: C1315EB090A386DFDB509F19C44536EBBE0BF8A354F00C59EE89887351D3799544CB97

Function 000805AA Relevance: 6.1, APIs: 4, Instructions: 77COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00077AF0,?,?,00000000,?,00071B51), ref: 000805B3

Part of subcall function 0007FF35: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00080564), ref: 0007FF4B
Part of subcall function 0007FF35: GetCurrentThreadId.KERNEL32 ref: 0007FF74
Part of subcall function 0007FF35: CreateEventA.KERNEL32 ref: 0007FF92
Part of subcall function 0007FF35: GetCurrentThread.KERNEL32 ref: 0007FFC2
Part of subcall function 0007FF35: DuplicateHandle.KERNELBASE ref: 0007FFF3
Part of subcall function 0007FF35: abort.MSVCRT(00000000,00000000), ref: 00080000
Part of subcall function 0007FF35: GetThreadPriority.KERNEL32(00000000,00000000), ref: 0008000B
Part of subcall function 0007FF35: TlsSetValue.KERNEL32 ref: 00080032

realloc.MSVCRT ref: 000805F0
realloc.MSVCRT ref: 00080606
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00077AF0,?,?,00000000,?,00071B51), ref: 00080674

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: Thread$CurrentErrorLastValuerealloc$CreateDuplicateEventHandlePriorityabort
String ID:
API String ID: 1142088241-0
Opcode ID: d38268dcae4a5fe5a37bbc9beaf8ba2dee341b1b6fc8fea84025a73ff953ebbc
Instruction ID: 124a4a0d38338d7990651cc7127f1e6a1c953b2d7d144d1d33bd3fee4c3dff21
Opcode Fuzzy Hash: d38268dcae4a5fe5a37bbc9beaf8ba2dee341b1b6fc8fea84025a73ff953ebbc
Instruction Fuzzy Hash: D231C5B5A002199BCF40EF68C48499DBBF5EF48350F51856AE888DB306EB39E951CF91

Function 00081582 Relevance: 6.1, APIs: 4, Instructions: 76synchronizationCOMMON

Download Yara Rule

APIs

GetHandleInformation.KERNEL32 ref: 000815BA
WaitForSingleObject.KERNEL32 ref: 000815FD
CloseHandle.KERNEL32(?,?), ref: 00081611
CloseHandle.KERNEL32 ref: 0008161E

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: Handle$Close$InformationObjectSingleWait
String ID:
API String ID: 135186658-0
Opcode ID: c54aa37d873babd6a81ff7224acf8c19d430561884d1e4ef75d3cb8a6d377e64
Instruction ID: f885a80e15f52cb73a72b133c828bd8f6931119579e9cb65586bf4b88106e806
Opcode Fuzzy Hash: c54aa37d873babd6a81ff7224acf8c19d430561884d1e4ef75d3cb8a6d377e64
Instruction Fuzzy Hash: 352160706046049BDB50BF38D984AABBBE9FF84710F058569ECC8CB246E734D851CB92

Function 000801FA Relevance: 6.0, APIs: 4, Instructions: 46threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00080210
printf.MSVCRT ref: 0008022A
GetCurrentThreadId.KERNEL32 ref: 0008024C
printf.MSVCRT ref: 00080279

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: CurrentThreadprintf
String ID:
API String ID: 2356641437-0
Opcode ID: af11fcc257b7025693e506503dbb188a63b1d4a1f9edb0b4e47aaa2a2bddf710
Instruction ID: fe535ba4451dd9ac104a0e3d9c1d3b7a044f66df771e5cf90cfec7e5eb3ae030
Opcode Fuzzy Hash: af11fcc257b7025693e506503dbb188a63b1d4a1f9edb0b4e47aaa2a2bddf710
Instruction Fuzzy Hash: B311B7B46093049FCB40EF69D88449ABBE4FF89360F01882EF9D887712D674D944CB92

Function 00081E6F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00081EC9
exit.MSVCRT ref: 00081ED5

Strings

(, xrefs: 00081EA6

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: exitfprintf
String ID: (
API String ID: 4243785698-3887548279
Opcode ID: f88c8582ff0957c259374a9029aa32c8e929e174f0fff3497fc8a7446341d6dd
Instruction ID: 30b2f5673d07efb4ee4fb17049536390a988876d46220264f09d7dfcaec38513
Opcode Fuzzy Hash: f88c8582ff0957c259374a9029aa32c8e929e174f0fff3497fc8a7446341d6dd
Instruction Fuzzy Hash: CA0119B1505254DFE700AF99E489669BBE8FF45314F01C86CE5D88B202C7BD9984CB93

Function 0007ED46 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,00086694,?,00082475), ref: 0007ED87
LeaveCriticalSection.KERNEL32(00086694,?,?,?,?,?,?,00000000,?,00086694,?,00082475), ref: 0007EE08

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: c04d90c61c2700912e95481af34d234fbde2eb8b9c60dc05315deea29abd0ef8
Instruction ID: 5f9922c673080db0f7ecc2feb5b5d39323ec59def32dc443fde4d63f62dd8cba
Opcode Fuzzy Hash: c04d90c61c2700912e95481af34d234fbde2eb8b9c60dc05315deea29abd0ef8
Instruction Fuzzy Hash: F6318071A016448BDB64DF29D8C0AAAB7E9FF88310F14C5AAE9198B245D338DD41CB95

Function 0007EE35 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,00087796), ref: 0007EE76
LeaveCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00087796), ref: 0007EEC1
LeaveCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00087796), ref: 0007EEE2
LeaveCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00087796), ref: 0007EEF8

Part of subcall function 0007EB6F: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,00000001,?,?,0007EF8E), ref: 0007EB8C
Part of subcall function 0007EB6F: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,?,0007EF8E), ref: 0007EBA0
Part of subcall function 0007EB6F: EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000001,?,?,0007EF8E), ref: 0007EBC9
Part of subcall function 0007EB6F: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,?,?,0007EF8E), ref: 0007EBD9

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: 4d273d433054f21839252e414796c035a8cf9a39da8a324586e46cd62be6ec05
Instruction ID: 7efa7308a473f5e115d7f480be8c51b8fa42f43611d655e6e06507c125757a94
Opcode Fuzzy Hash: 4d273d433054f21839252e414796c035a8cf9a39da8a324586e46cd62be6ec05
Instruction Fuzzy Hash: 25315071E01649CFDB54DF29C8C05AAB7E5EF88320B14C5BAE81C8B245E338D951CBA5

Function 0007EB6F Relevance: 5.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,00000001,?,?,0007EF8E), ref: 0007EB8C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,?,0007EF8E), ref: 0007EBA0
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000001,?,?,0007EF8E), ref: 0007EBC9
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,?,?,0007EF8E), ref: 0007EBD9

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: eaeb41a4dd53ad005c01dbc2875589d9bbc6e41fe9ce891b4beca2efd7dc9b98
Instruction ID: 39f4fe3ba3bf43f3c14ea2280eefd58736d573a3a3689f4c1ced86850d8df9b9
Opcode Fuzzy Hash: eaeb41a4dd53ad005c01dbc2875589d9bbc6e41fe9ce891b4beca2efd7dc9b98
Instruction Fuzzy Hash: D21118B5A056199FCB149F69D8848AEBBB8FF8C311B01846EE94A97310C7399900CB95

Function 0007D0E4 Relevance: 5.0, APIs: 4, Instructions: 49sleepCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,?,?,0007D1EF,?,?,00000000,?,?,?,0007D99A), ref: 0007D106
InitializeCriticalSection.KERNEL32(00000000,?,?,0007D1EF,?,?,00000000,?,?,?,0007D99A), ref: 0007D12F
InitializeCriticalSection.KERNEL32(?,?,0007D1EF,?,?,00000000,?,?,?,0007D99A), ref: 0007D139
Sleep.KERNEL32(00000000,?,?,0007D1EF,?,?,00000000,?,?,?,0007D99A), ref: 0007D16A

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: CriticalSection$Initialize$EnterSleep
String ID:
API String ID: 1117354567-0
Opcode ID: c2bc2ad6497c8947f34083b0e5f67e198464ed08c5e5a557fb1e2e4a42b1e15c
Instruction ID: da5ed59fe81a3b0faf438077aeab5270d3667509022424bc179a3355b77b9cc0
Opcode Fuzzy Hash: c2bc2ad6497c8947f34083b0e5f67e198464ed08c5e5a557fb1e2e4a42b1e15c
Instruction Fuzzy Hash: 7C01ACB0D04204ABE7606B5DEC857BA7BF8EF45350F90840AE18DC2A20D77E8480DBDB

Function 00077230 Relevance: 5.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,00077409,?,?,?,?,00076BD0), ref: 0007723F
TlsGetValue.KERNEL32(?,?,?,?,00077409,?,?,?,?,00076BD0), ref: 00077255
GetLastError.KERNEL32(?,?,?,?,?,00077409,?,?,?,?,00076BD0), ref: 0007725E
LeaveCriticalSection.KERNEL32(?,?,?,?,00077409,?,?,?,?,00076BD0), ref: 00077280

Memory Dump Source

Source File: 00000000.00000002.2129741833.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000000.00000002.2129724498.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129785643.00000000000EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129799902.00000000000EE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129813947.00000000000FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2129831458.00000000000FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70000_FXdg37pY22.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 9c903d33163fa83ef3e849132a9d32e7608615c439208bc81bf0857c90aaab60
Instruction ID: b069386472574ee703ec5aa536fe3dcf4edf43ad93f486fb8b2eeb2b08d4a157
Opcode Fuzzy Hash: 9c903d33163fa83ef3e849132a9d32e7608615c439208bc81bf0857c90aaab60
Instruction Fuzzy Hash: 71F06271608200CFDB106FE8D98857A7BE8EB05750B004158FA8D87611C7385841DB96

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report FXdg37pY22.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
FXdg37pY22.exe

Function 01576F90 Relevance: 35.6, APIs: 11, Strings: 9, Instructions: 571
memorycomCOMMON

Function 00071127 Relevance: 15.1, APIs: 10, Instructions: 125
sleepstringCOMMON

Function 0154A960 Relevance: 9.2, Strings: 7, Instructions: 401
COMMON

Function 0154CE55 Relevance: 9.0, Strings: 7, Instructions: 275
COMMON

Function 015487F0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 127
threadCOMMON

Function 000E8EAC Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 130
stringCOMMON

Function 0007FF35 Relevance: 12.1, APIs: 8, Instructions: 84
threadCOMMON

Function 0008702C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 60
fileCOMMON

Function 0157B720 Relevance: 3.0, APIs: 2, Instructions: 31
COMMON

Function 000718C7 Relevance: 1.6, APIs: 1, Instructions: 108
COMMON

Function 0007AE66 Relevance: 1.6, APIs: 1, Instructions: 104
COMMON