Edit tour

Windows Analysis Report
XhlpAnBmIk.exe

Overview

General Information

Sample name:	XhlpAnBmIk.exe renamed because original name is a hash value
Original sample name:	b6c22e7ae8a0058a9c51edd8941feac20f88a86a3db2038689161368bd802875.exe
Analysis ID:	1590538
MD5:	cd085e87a78dfa2159e476479f538da8
SHA1:	0535f44a1f2cff10a3bda1984bd3a71a4db395ba
SHA256:	b6c22e7ae8a0058a9c51edd8941feac20f88a86a3db2038689161368bd802875
Tags:	exeTHSUPPORTSERVICESLTDuser-JAMESWT_MHT
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

LummaC encrypted strings found

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Contains functionality to call native functions

Contains functionality to read the PEB

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

XhlpAnBmIk.exe (PID: 2508 cmdline: "C:\Users\user\Desktop\XhlpAnBmIk.exe" MD5: CD085E87A78DFA2159E476479F538DA8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["spookycappy.biz", "punishzement.biz", "littlenotii.biz", "nuttyshopr.biz", "fraggielek.biz", "truculengisau.biz", "marketlumpe.biz", "grandiouseziu.biz", "whisperusz.biz"], "Build id": "BbL7Kk--03"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x50f54:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49 0x544ea:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T08:55:30.909117+0100	2028371	3	Unknown Traffic	192.168.2.5	49762	104.102.49.254	443	TCP
2025-01-14T08:55:33.066480+0100	2028371	3	Unknown Traffic	192.168.2.5	49779	188.114.96.3	443	TCP
2025-01-14T08:55:33.742092+0100	2028371	3	Unknown Traffic	192.168.2.5	49785	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T08:55:33.489179+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49779	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T08:55:33.489179+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49779	188.114.96.3	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fraggielek .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T08:55:29.979124+0100	2059133	1	Domain Observed Used for C2 Detected	192.168.2.5	59904	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grandiouseziu .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T08:55:30.001215+0100	2059135	1	Domain Observed Used for C2 Detected	192.168.2.5	54824	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (littlenotii .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T08:55:30.018914+0100	2059137	1	Domain Observed Used for C2 Detected	192.168.2.5	54641	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (marketlumpe .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T08:55:30.038534+0100	2059141	1	Domain Observed Used for C2 Detected	192.168.2.5	52867	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (nuttyshopr .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T08:55:30.053249+0100	2059143	1	Domain Observed Used for C2 Detected	192.168.2.5	58129	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (punishzement .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T08:55:30.068046+0100	2059145	1	Domain Observed Used for C2 Detected	192.168.2.5	59188	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spookycappy .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T08:55:30.106007+0100	2059151	1	Domain Observed Used for C2 Detected	192.168.2.5	56127	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (truculengisau .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T08:55:30.119673+0100	2059153	1	Domain Observed Used for C2 Detected	192.168.2.5	53864	1.1.1.1	53	UDP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T08:55:32.455076+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.5	49762	104.102.49.254	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: whisperusz.biz	Avira URL Cloud: Label: malware
Source: https://truculengisau.biz/	Avira URL Cloud: Label: malware

Found malware configuration

Source: XhlpAnBmIk.exe.2508.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["spookycappy.biz", "punishzement.biz", "littlenotii.biz", "nuttyshopr.biz", "fraggielek.biz", "truculengisau.biz", "marketlumpe.biz", "grandiouseziu.biz", "whisperusz.biz"], "Build id": "BbL7Kk--03"}

Multi AV Scanner detection for submitted file

Source: XhlpAnBmIk.exe	ReversingLabs: Detection: 39%
Source: XhlpAnBmIk.exe	Virustotal: Detection: 12%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.9% probability

Machine Learning detection for sample

Source: XhlpAnBmIk.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp	String decryptor: truculengisau.biz
Source: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp	String decryptor: spookycappy.biz
Source: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp	String decryptor: punishzement.biz
Source: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp	String decryptor: nuttyshopr.biz
Source: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp	String decryptor: marketlumpe.biz
Source: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp	String decryptor: littlenotii.biz
Source: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp	String decryptor: grandiouseziu.biz
Source: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp	String decryptor: fraggielek.biz
Source: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp	String decryptor: whisperusz.biz
Source: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp	String decryptor: BbL7Kk--03

Source: XhlpAnBmIk.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: XhlpAnBmIk.exe

Static PE information: certificate valid

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49779 version: TLS 1.2

Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then movzx esi, byte ptr [edx]	0_2_02214208
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+edx+05CAF138h]	0_2_0221D2F1
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then push dword ptr [esp+28h]	0_2_022382C8
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then jmp eax	0_2_0223A2CC
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+32DBB3B0h]	0_2_02239318
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_0224A3B8
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+2564CAB9h]	0_2_022503C8
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then mov ecx, eax	0_2_022323D8
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then mov esi, edx	0_2_0221A008
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_02241060
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then cmp dword ptr [ebp+edi*8+00h], 0EF2A4EDh	0_2_022540A8
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_022400B3
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then movzx ecx, byte ptr [ebx+eax]	0_2_0222908A
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 53585096h	0_2_022270CE
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then mov ecx, eax	0_2_0223C0D8
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then jmp eax	0_2_0223A134
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx+0Eh]	0_2_0221C1D8
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then mov word ptr [edi], cx	0_2_02238638
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edi+06h]	0_2_0223666A
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 01FCE602h	0_2_022506D8
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 53585096h	0_2_0221F73A
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then mov word ptr [ebx], cx	0_2_0222C71E
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then mov word ptr [esi], cx	0_2_0222C71E
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_0221A778
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	0_2_0222F778
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then push 00000000h	0_2_0221E40C
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 53585096h	0_2_022274ED
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+edx]	0_2_0222F508
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then add ebp, edi	0_2_0221A598
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then mov byte ptr [edx], cl	0_2_0223F5F8
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+esi+63115D0Dh]	0_2_02236A94
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then lea eax, dword ptr [eax+eax*4]	0_2_02219B68
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then push eax	0_2_02251BD8
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_02235866
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_0223F877
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 13884179h	0_2_0221F8B2
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then mov byte ptr [ebx], cl	0_2_0223F8CA
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then mov byte ptr [ebx], cl	0_2_0223F8CA
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then mov edx, ecx	0_2_0221AE68
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then movzx ebx, byte ptr [edi+edx+03D49333h]	0_2_02239E83
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then movzx ecx, byte ptr [edi+eax]	0_2_0223FE8A
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then mov dword ptr [esi+04h], eax	0_2_02227EC5
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+1Ch]	0_2_02238EC8
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then movzx ecx, byte ptr [edx+eax]	0_2_02226F11
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then cmp word ptr [eax+ebx+02h], 0000h	0_2_0223AFE8
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+48h]	0_2_02230FD8
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-000000DEh]	0_2_02230FD8
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_0223ECE8
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_0223CCF8
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	0_2_02218CC8
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	0_2_02218CC8
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then lea eax, dword ptr [esp+50h]	0_2_02238C74
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then cmp dword ptr [ebp+ebx*8+00h], 7E3E42A0h	0_2_0224DCD8
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then push esi	0_2_0224DCD8
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h	0_2_02225CF8

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2059141 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (marketlumpe .biz) : 192.168.2.5:52867 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059133 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fraggielek .biz) : 192.168.2.5:59904 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059153 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (truculengisau .biz) : 192.168.2.5:53864 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059143 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (nuttyshopr .biz) : 192.168.2.5:58129 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059137 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (littlenotii .biz) : 192.168.2.5:54641 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059135 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grandiouseziu .biz) : 192.168.2.5:54824 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059145 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (punishzement .biz) : 192.168.2.5:59188 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059151 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spookycappy .biz) : 192.168.2.5:56127 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49779 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49779 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.5:49762 -> 104.102.49.254:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: spookycappy.biz
Source: Malware configuration extractor	URLs: punishzement.biz
Source: Malware configuration extractor	URLs: littlenotii.biz
Source: Malware configuration extractor	URLs: nuttyshopr.biz
Source: Malware configuration extractor	URLs: fraggielek.biz
Source: Malware configuration extractor	URLs: truculengisau.biz
Source: Malware configuration extractor	URLs: marketlumpe.biz
Source: Malware configuration extractor	URLs: grandiouseziu.biz
Source: Malware configuration extractor	URLs: whisperusz.biz

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 104.102.49.254 104.102.49.254

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49785 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49762 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49779 -> 188.114.96.3:443

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: aleksandr-block.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: global traffic	DNS traffic detected: DNS query: whisperusz.biz
Source: global traffic	DNS traffic detected: DNS query: fraggielek.biz
Source: global traffic	DNS traffic detected: DNS query: grandiouseziu.biz
Source: global traffic	DNS traffic detected: DNS query: littlenotii.biz
Source: global traffic	DNS traffic detected: DNS query: marketlumpe.biz
Source: global traffic	DNS traffic detected: DNS query: nuttyshopr.biz
Source: global traffic	DNS traffic detected: DNS query: punishzement.biz
Source: global traffic	DNS traffic detected: DNS query: spookycappy.biz
Source: global traffic	DNS traffic detected: DNS query: truculengisau.biz
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: aleksandr-block.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: aleksandr-block.com

Source: XhlpAnBmIk.exe	String found in binary or memory: http://cevcsca2021.crl.certum.pl/cevcsca2021.crl0w
Source: XhlpAnBmIk.exe	String found in binary or memory: http://cevcsca2021.ocsp-certum.com07
Source: XhlpAnBmIk.exe	String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: XhlpAnBmIk.exe	String found in binary or memory: http://crl.certum.pl/ctnca2.crl0l
Source: XhlpAnBmIk.exe	String found in binary or memory: http://crl.certum.pl/ctsca2021.crl0o
Source: XhlpAnBmIk.exe	String found in binary or memory: http://repository.certum.pl/cevcsca2021.cer0
Source: XhlpAnBmIk.exe	String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: XhlpAnBmIk.exe	String found in binary or memory: http://repository.certum.pl/ctnca2.cer09
Source: XhlpAnBmIk.exe	String found in binary or memory: http://repository.certum.pl/ctsca2021.cer0A
Source: XhlpAnBmIk.exe, XhlpAnBmIk.exe, 00000000.00000003.2337249348.00000000005CD000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000002.2340621909.0000000000614000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000002.2340642872.0000000000627000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000002.2340351298.0000000000592000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337424519.0000000000613000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337379417.00000000005DE000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: XhlpAnBmIk.exe, 00000000.00000003.2337249348.000000000059C000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000002.2340642872.0000000000627000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000616000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: XhlpAnBmIk.exe, 00000000.00000003.2337249348.000000000059C000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000002.2340642872.0000000000627000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000616000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: XhlpAnBmIk.exe	String found in binary or memory: http://subca.ocsp-certum.com01
Source: XhlpAnBmIk.exe	String found in binary or memory: http://subca.ocsp-certum.com02
Source: XhlpAnBmIk.exe	String found in binary or memory: http://subca.ocsp-certum.com05
Source: XhlpAnBmIk.exe	String found in binary or memory: http://www.certum.pl/CPS0
Source: XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: XhlpAnBmIk.exe, XhlpAnBmIk.exe, 00000000.00000003.2337249348.00000000005CD000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000002.2340533160.00000000005CD000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339902073.00000000005CD000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000002.2340351298.000000000056E000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337249348.00000000005B7000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337379417.00000000005DE000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339725599.00000000005CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aleksandr-block.com/
Source: XhlpAnBmIk.exe, 00000000.00000003.2339725599.00000000005CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aleksandr-block.com/api
Source: XhlpAnBmIk.exe, 00000000.00000003.2337249348.00000000005CD000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337379417.00000000005DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aleksandr-block.com/eF
Source: XhlpAnBmIk.exe, 00000000.00000003.2337249348.00000000005CD000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000002.2340587360.00000000005E0000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337379417.00000000005DE000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339836062.00000000005DE000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339725599.00000000005CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aleksandr-block.com/pi
Source: XhlpAnBmIk.exe, 00000000.00000002.2340351298.000000000056E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aleksandr-block.com/t
Source: XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: XhlpAnBmIk.exe, 00000000.00000003.2337249348.00000000005CD000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000002.2340621909.0000000000614000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337424519.0000000000613000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337379417.00000000005DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.f
Source: XhlpAnBmIk.exe, 00000000.00000003.2337249348.00000000005CD000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337424519.0000000000613000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337379417.00000000005DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.co
Source: XhlpAnBmIk.exe, 00000000.00000003.2337249348.000000000059C000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000616000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=SCXpgixTDzt4&a
Source: XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
Source: XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
Source: XhlpAnBmIk.exe, 00000000.00000003.2337249348.000000000059C000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000616000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: XhlpAnBmIk.exe, 00000000.00000003.2337249348.000000000059C000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000002.2340642872.0000000000627000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000616000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: XhlpAnBmIk.exe, 00000000.00000003.2337249348.000000000059C000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000616000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: XhlpAnBmIk.exe, 00000000.00000003.2337249348.000000000059C000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000616000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=M_FULq_A
Source: XhlpAnBmIk.exe, 00000000.00000003.2337249348.000000000059C000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000616000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=BFN_
Source: XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
Source: XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
Source: XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
Source: XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
Source: XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=iUcMsAN_acD6&l=e
Source: XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=Eq36AUaEgab8&l=en
Source: XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: XhlpAnBmIk.exe, 00000000.00000003.2337249348.000000000059C000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000002.2340642872.0000000000627000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000616000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: XhlpAnBmIk.exe, 00000000.00000003.2337249348.000000000059C000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000616000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: XhlpAnBmIk.exe, 00000000.00000003.2337249348.000000000059C000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000002.2340642872.0000000000627000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000616000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: XhlpAnBmIk.exe, 00000000.00000003.2337249348.000000000059C000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000002.2340642872.0000000000627000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000616000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: XhlpAnBmIk.exe, 00000000.00000003.2337249348.00000000005A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://truculengisau.biz/
Source: XhlpAnBmIk.exe	String found in binary or memory: https://www.certum.pl/CPS0
Source: XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback

Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49779 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown

Source: C:\Users\user\Desktop\XhlpAnBmIk.exe

Code function: 0_2_02265D00 NtCreateSection,NtMapViewOfSection,VirtualAlloc,NtMapViewOfSection,VirtualProtect,VirtualProtect,VirtualProtect,CreateThread,

0_2_02265D00

Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_00404DA8	0_2_00404DA8
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_0040584C	0_2_0040584C
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_00405858	0_2_00405858
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_0040582C	0_2_0040582C
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_0040515C	0_2_0040515C
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_004083E4	0_2_004083E4
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_0040538C	0_2_0040538C
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_00404C5C	0_2_00404C5C
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_00404C08	0_2_00404C08
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_00404CDC	0_2_00404CDC
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_00405CBC	0_2_00405CBC
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_0040457C	0_2_0040457C
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_00405D06	0_2_00405D06
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_00405674	0_2_00405674
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_0221044B	0_2_0221044B
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_02265D00	0_2_02265D00
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_02262200	0_2_02262200
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_022522D5	0_2_022522D5
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_0226130C	0_2_0226130C
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_02239318	0_2_02239318
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_0222E368	0_2_0222E368
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_02243350	0_2_02243350
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_02254358	0_2_02254358
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_0222D398	0_2_0222D398
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_02245398	0_2_02245398
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_022143E8	0_2_022143E8
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_022233E8	0_2_022233E8
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_022323D8	0_2_022323D8
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_02210000	0_2_02210000
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_0221A008	0_2_0221A008
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_0224B012	0_2_0224B012
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_0224D078	0_2_0224D078
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_022540A8	0_2_022540A8
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_0222E098	0_2_0222E098
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_022450D8	0_2_022450D8
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_02226178	0_2_02226178
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_0223F15B	0_2_0223F15B
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_022171A8	0_2_022171A8
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_022151E8	0_2_022151E8
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_0221C1D8	0_2_0221C1D8
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_02238638	0_2_02238638
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_02253648	0_2_02253648
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_022546A8	0_2_022546A8
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_02217688	0_2_02217688
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_0222C71E	0_2_0222C71E
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_0224C768	0_2_0224C768
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_02250748	0_2_02250748
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_0223F7AD	0_2_0223F7AD
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_022634A8	0_2_022634A8
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_022164C8	0_2_022164C8
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_0224C508	0_2_0224C508
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_0223E568	0_2_0223E568
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_0224B5A0	0_2_0224B5A0
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_022525A0	0_2_022525A0
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_02240598	0_2_02240598
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_022625D0	0_2_022625D0
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_022345DF	0_2_022345DF
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_02247A08	0_2_02247A08
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_02262A08	0_2_02262A08
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_02253A78	0_2_02253A78
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_02243A50	0_2_02243A50
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_02217A58	0_2_02217A58
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_02240A5D	0_2_02240A5D
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_02227AA7	0_2_02227AA7
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_02242AAE	0_2_02242AAE
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_0221AA88	0_2_0221AA88
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_0222CAC8	0_2_0222CAC8
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_0222FB18	0_2_0222FB18
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_02219B68	0_2_02219B68
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_02252B79	0_2_02252B79
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_02215B98	0_2_02215B98
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_02241918	0_2_02241918
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_02222940	0_2_02222940
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_0224A9F4	0_2_0224A9F4
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_0222BE3C	0_2_0222BE3C
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_0221AE68	0_2_0221AE68
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_02217EE8	0_2_02217EE8
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_02227EC5	0_2_02227EC5
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_0221EF58	0_2_0221EF58
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_02229F58	0_2_02229F58
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_0222AFD8	0_2_0222AFD8
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_02230FD8	0_2_02230FD8
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_0222DC38	0_2_0222DC38
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_02218CC8	0_2_02218CC8
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_0224DCD8	0_2_0224DCD8
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_02253D28	0_2_02253D28
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_0222AD38	0_2_0222AD38
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_02231D08	0_2_02231D08
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_02221D0E	0_2_02221D0E
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_0221FD78	0_2_0221FD78

Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: String function: 02219858 appears 69 times
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: String function: 02225708 appears 128 times

Source: XhlpAnBmIk.exe

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: XhlpAnBmIk.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@11/2

Source: C:\Users\user\Desktop\XhlpAnBmIk.exe

Code function: 0_2_00409420 AdjustTokenPrivileges,

0_2_00409420

Source: C:\Users\user\Desktop\XhlpAnBmIk.exe

Code function: 0_2_02210B5B CreateToolhelp32Snapshot,Thread32First,Wow64SuspendThread,CloseHandle,CloseHandle,

0_2_02210B5B

Source: C:\Users\user\Desktop\XhlpAnBmIk.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: XhlpAnBmIk.exe	ReversingLabs: Detection: 39%
Source: XhlpAnBmIk.exe	Virustotal: Detection: 12%

Source: C:\Users\user\Desktop\XhlpAnBmIk.exe

File read: C:\Users\user\Desktop\XhlpAnBmIk.exe

Jump to behavior

Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: XhlpAnBmIk.exe

Static PE information: certificate valid

Source: XhlpAnBmIk.exe

Static file information: File size 4556176 > 1048576

Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_3_005DAA30 push ebp; ret	0_3_005DAA31
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_3_005DAA30 push ebp; ret	0_3_005DAA31
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_3_005DCA28 push esi; iretd	0_3_005DCA29
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_3_005DCA28 push esi; iretd	0_3_005DCA29
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_3_005DAA30 push ebp; ret	0_3_005DAA31
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_3_005DAA30 push ebp; ret	0_3_005DAA31
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_3_005DCA28 push esi; iretd	0_3_005DCA29
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_3_005DCA28 push esi; iretd	0_3_005DCA29
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_3_005DAA30 push ebp; ret	0_3_005DAA31
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_3_005DAA30 push ebp; ret	0_3_005DAA31
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_3_005DCA28 push esi; iretd	0_3_005DCA29
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_3_005DCA28 push esi; iretd	0_3_005DCA29
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_3_005DAA30 push ebp; ret	0_3_005DAA31
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_3_005DAA30 push ebp; ret	0_3_005DAA31
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_3_005DCA28 push esi; iretd	0_3_005DCA29
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_3_005DCA28 push esi; iretd	0_3_005DCA29
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_004080DC push ecx; mov dword ptr [esp], eax	0_2_004080E1
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_004040B5 push eax; ret	0_2_004040F1
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_00406590 push 004065CDh; ret	0_2_004065C5
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_02253128 push eax; mov dword ptr [esp], 424D4C7Fh	0_2_0225312C
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_0221DE24 push ss; retf	0_2_0221DE25
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_0224BFBD push esi; retf	0_2_0224BFC6

Source: C:\Users\user\Desktop\XhlpAnBmIk.exe TID: 5280	Thread sleep time: -120000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe TID: 5280	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: XhlpAnBmIk.exe, 00000000.00000003.2337249348.00000000005CD000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000002.2340533160.00000000005CD000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339902073.00000000005CD000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339725599.00000000005CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%
Source: XhlpAnBmIk.exe, XhlpAnBmIk.exe, 00000000.00000003.2337249348.00000000005CD000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000002.2340533160.00000000005CD000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339902073.00000000005CD000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000002.2340351298.0000000000592000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339725599.00000000005CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\XhlpAnBmIk.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_0221044B mov edx, dword ptr fs:[00000030h]	0_2_0221044B
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_02210A0B mov eax, dword ptr fs:[00000030h]	0_2_02210A0B
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_0221105B mov eax, dword ptr fs:[00000030h]	0_2_0221105B
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_0221105A mov eax, dword ptr fs:[00000030h]	0_2_0221105A
Source: C:\Users\user\Desktop\XhlpAnBmIk.exe	Code function: 0_2_02210DBB mov eax, dword ptr fs:[00000030h]	0_2_02210DBB

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: XhlpAnBmIk.exe	String found in binary or memory: truculengisau.biz
Source: XhlpAnBmIk.exe	String found in binary or memory: spookycappy.biz
Source: XhlpAnBmIk.exe	String found in binary or memory: punishzement.biz
Source: XhlpAnBmIk.exe	String found in binary or memory: fraggielek.biz
Source: XhlpAnBmIk.exe	String found in binary or memory: whisperusz.biz
Source: XhlpAnBmIk.exe	String found in binary or memory: nuttyshopr.biz
Source: XhlpAnBmIk.exe	String found in binary or memory: marketlumpe.biz
Source: XhlpAnBmIk.exe	String found in binary or memory: littlenotii.biz
Source: XhlpAnBmIk.exe	String found in binary or memory: grandiouseziu.biz

Source: C:\Users\user\Desktop\XhlpAnBmIk.exe

Code function: 0_2_004026C4 GetSystemTime,

0_2_004026C4

Source: C:\Users\user\Desktop\XhlpAnBmIk.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 PowerShell	1 DLL Side-Loading	1 Access Token Manipulation	1 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Access Token Manipulation	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	3 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
XhlpAnBmIk.exe	39%	ReversingLabs	Win32.Spyware.Lummastealer
XhlpAnBmIk.exe	12%	Virustotal		Browse
XhlpAnBmIk.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
whisperusz.biz	100%	Avira URL Cloud	malware
https://truculengisau.biz/	100%	Avira URL Cloud	malware
https://aleksandr-block.com/t	0%	Avira URL Cloud	safe
https://aleksandr-block.com/eF	0%	Avira URL Cloud	safe
https://aleksandr-block.com/	0%	Avira URL Cloud	safe
https://aleksandr-block.com/pi	0%	Avira URL Cloud	safe
https://aleksandr-block.com/api	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
aleksandr-block.com	188.114.96.3	true	true	unknown
steamcommunity.com	104.102.49.254	true	false	high
littlenotii.biz	unknown	unknown	true	unknown
fraggielek.biz	unknown	unknown	true	unknown
nuttyshopr.biz	unknown	unknown	true	unknown
grandiouseziu.biz	unknown	unknown	true	unknown
marketlumpe.biz	unknown	unknown	true	unknown
whisperusz.biz	unknown	unknown	true	unknown
spookycappy.biz	unknown	unknown	true	unknown
truculengisau.biz	unknown	unknown	true	unknown
punishzement.biz	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
grandiouseziu.biz	false		high
https://aleksandr-block.com/api	true	Avira URL Cloud: safe	unknown
spookycappy.biz	false		high
truculengisau.biz	false		high
https://steamcommunity.com/profiles/76561199724331900	false		high
nuttyshopr.biz	false		high
marketlumpe.biz	false		high
littlenotii.biz	false		high
whisperusz.biz	true	Avira URL Cloud: malware	unknown
fraggielek.biz	false		high
punishzement.biz	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://steamcommunity.com/my/wishlist/	XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://repository.certum.pl/ctsca2021.cer0A	XhlpAnBmIk.exe	false		high
http://crl.certum.pl/ctsca2021.crl0o	XhlpAnBmIk.exe	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&	XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp	XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/?subsection=broadcasts	XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.steampowered.com/en/	XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/market/	XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/news/	XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.co	XhlpAnBmIk.exe, 00000000.00000003.2337249348.00000000005CD000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337424519.0000000000613000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337379417.00000000005DE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/subscriber_agreement/	XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/subscriber_agreement/	XhlpAnBmIk.exe, 00000000.00000003.2337249348.000000000059C000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000002.2340642872.0000000000627000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000616000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	XhlpAnBmIk.exe, 00000000.00000003.2337249348.000000000059C000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000002.2340642872.0000000000627000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000616000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://repository.certum.pl/cevcsca2021.cer0	XhlpAnBmIk.exe	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=Eq36AUaEgab8&l=en	XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.valvesoftware.com/legal.htm	XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/discussions/	XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.f	XhlpAnBmIk.exe, 00000000.00000003.2337249348.00000000005CD000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000002.2340621909.0000000000614000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337424519.0000000000613000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337379417.00000000005DE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/stats/	XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am	XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a	XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/steam_refunds/	XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://subca.ocsp-certum.com05	XhlpAnBmIk.exe	false		high
http://subca.ocsp-certum.com02	XhlpAnBmIk.exe	false		high
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://subca.ocsp-certum.com01	XhlpAnBmIk.exe	false		high
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	XhlpAnBmIk.exe, 00000000.00000003.2337249348.000000000059C000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000616000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.certum.pl/ctnca2.crl0l	XhlpAnBmIk.exe	false		high
http://repository.certum.pl/ctnca2.cer09	XhlpAnBmIk.exe	false		high
https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e	XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl	XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis	XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/workshop/	XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c	XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	XhlpAnBmIk.exe, 00000000.00000003.2337249348.000000000059C000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000002.2340642872.0000000000627000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000616000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&	XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/legal/	XhlpAnBmIk.exe, 00000000.00000003.2337249348.000000000059C000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000002.2340642872.0000000000627000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000616000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.certum.pl/CPS0	XhlpAnBmIk.exe	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en	XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cevcsca2021.ocsp-certum.com07	XhlpAnBmIk.exe	false		high
https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng	XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://repository.certum.pl/ctnca.cer09	XhlpAnBmIk.exe	false		high
https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en	XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=BFN_	XhlpAnBmIk.exe, 00000000.00000003.2337249348.000000000059C000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000616000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.certum.pl/ctnca.crl0k	XhlpAnBmIk.exe	false		high
https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a	XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl	XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/privacy_agreement/	XhlpAnBmIk.exe, 00000000.00000003.2337249348.000000000059C000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000002.2340642872.0000000000627000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000616000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://truculengisau.biz/	XhlpAnBmIk.exe, 00000000.00000003.2337249348.00000000005A3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://store.steampowered.com/points/shop/	XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aleksandr-block.com/	XhlpAnBmIk.exe, XhlpAnBmIk.exe, 00000000.00000003.2337249348.00000000005CD000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000002.2340533160.00000000005CD000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339902073.00000000005CD000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000002.2340351298.000000000056E000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337249348.00000000005B7000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337379417.00000000005DE000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339725599.00000000005CD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/	XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cevcsca2021.crl.certum.pl/cevcsca2021.crl0w	XhlpAnBmIk.exe	false		high
https://www.certum.pl/CPS0	XhlpAnBmIk.exe	false		high
https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a	XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png	XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199724331900/inventory/	XhlpAnBmIk.exe, 00000000.00000003.2337249348.000000000059C000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000002.2340642872.0000000000627000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000616000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/privacy_agreement/	XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng	XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	XhlpAnBmIk.exe, 00000000.00000003.2337249348.000000000059C000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000616000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=M_FULq_A	XhlpAnBmIk.exe, 00000000.00000003.2337249348.000000000059C000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000616000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aleksandr-block.com/t	XhlpAnBmIk.exe, 00000000.00000002.2340351298.000000000056E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ	XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp	XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aleksandr-block.com/eF	XhlpAnBmIk.exe, 00000000.00000003.2337249348.00000000005CD000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337379417.00000000005DE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://store.steampowered.com/account/cookiepreferences/	XhlpAnBmIk.exe, XhlpAnBmIk.exe, 00000000.00000003.2337249348.00000000005CD000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000002.2340621909.0000000000614000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000002.2340642872.0000000000627000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000002.2340351298.0000000000592000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337424519.0000000000613000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337379417.00000000005DE000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/mobile	XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/	XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aleksandr-block.com/pi	XhlpAnBmIk.exe, 00000000.00000003.2337249348.00000000005CD000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000002.2340587360.00000000005E0000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337379417.00000000005DE000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339836062.00000000005DE000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339725599.00000000005CD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=iUcMsAN_acD6&l=e	XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/about/	XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l	XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199724331900/badges	XhlpAnBmIk.exe, 00000000.00000003.2337249348.000000000059C000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000619000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2337155988.0000000000616000.00000004.00000020.00020000.00000000.sdmp, XhlpAnBmIk.exe, 00000000.00000003.2339674809.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.96.3	aleksandr-block.com	European Union		13335	CLOUDFLARENETUS	true
104.102.49.254	steamcommunity.com	United States		16625	AKAMAI-ASUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1590538
Start date and time:	2025-01-14 08:54:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	XhlpAnBmIk.exe renamed because original name is a hash value
Original Sample Name:	b6c22e7ae8a0058a9c51edd8941feac20f88a86a3db2038689161368bd802875.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@11/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 19 Number of non-executed functions: 125
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.253.45, 20.109.210.53
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:55:29	API Interceptor	6x Sleep call for process: XhlpAnBmIk.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.96.3	New Order#12125.exe	Get hash	malicious	FormBook	Browse	www.cifasnc.info/8rr3/
	CSZ inquiry for MH raw material.exe	Get hash	malicious	FormBook	Browse	www.cifasnc.info/8rr3/
	1001-13.exe	Get hash	malicious	FormBook	Browse	www.einpisalpace.shop/pgw3/
	trow.exe	Get hash	malicious	Unknown	Browse	www.tc17.com/
	HN1GiQ5tF7.exe	Get hash	malicious	FormBook	Browse	www.questmatch.pro/ipd6/
	AxKxwW9WGa.exe	Get hash	malicious	FormBook	Browse	www.zkdamdjj.shop/kf1m/
	XeFYBYYj0w.exe	Get hash	malicious	FormBook	Browse	www.einpisalpace.shop/8g74/?wtE0B=1LjxZz&9F=WJ/rFpSuW7SUTonvHlYgJHet70+40/nSG+S456FFT70GKpWTD+yYW7KPXc3l6inPZ41lXlQU44ttBNcSIyPO/Awb2QEZq+eieNEXwOjUfdTJHvICblirwfj54bAbpLWz76fPuJmn0JFO
	tfWjjV1LdT.exe	Get hash	malicious	FormBook	Browse	www.zkdamdjj.shop/kf1m/
	M7XS5C07kV.exe	Get hash	malicious	FormBook	Browse	www.zkdamdjj.shop/kf1m/
	https://cocteldedeas.mx/rx567#cmVjaWJhc2VAc2VhbWFyaXRpbWEuY29t	Get hash	malicious	HTMLPhisher	Browse	cocteldedeas.mx/rx567/
104.102.49.254	r4xiHKy8aM.exe	Get hash	malicious	Socks5Systemz	Browse	/ISteamUser/GetFriendList/v1/?key=AE2AE4DBF33A541E83BC08989DB1F397&steamid=76561198400860497
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
steamcommunity.com	k7h8uufe6Y.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	G7T8lHJWWM.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	92.255.57_2.112.ps1	Get hash	malicious	LummaC	Browse	104.102.49.254
	uo9m.exe	Get hash	malicious	LummaC	Browse	23.197.127.21
	uo9m.exe	Get hash	malicious	LummaC	Browse	23.50.98.133
	L7GNkeVm5e.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	NDWffRLk7z.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	g3toRYa6JE.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	lBb4XI4eGD.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	UWYXurYZ2x.exe	Get hash	malicious	LummaC, Amadey, Babadeda, DanaBot, KeyLogger, LummaC Stealer, Poverty Stealer	Browse	104.102.49.254
aleksandr-block.com	k7h8uufe6Y.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
aleksandr-block.com	92.255.57_2.112.ps1	Get hash	malicious	LummaC	Browse	188.114.96.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	k7h8uufe6Y.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	009.vbe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	possible SPAM## Msig Insurance Europe Complete via-Sign Monday January 2025.msg	Get hash	malicious	Unknown	Browse	104.18.69.40
	92.255.57_2.112.ps1	Get hash	malicious	LummaC	Browse	188.114.96.3
	phishing.eml	Get hash	malicious	Phisher	Browse	188.114.96.3
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	https://tinyurl.com/286oc4ly	Get hash	malicious	Unknown	Browse	104.17.112.233
	http://hotpepperliberia.com	Get hash	malicious	Unknown	Browse	172.67.130.110
	https://email.lc.haxconsulting.com/c/eJx0k0tv4zgQhH-NdBk4kKgHrQMPdhI5mck78djJRaDIlsSYD4WkpLF__cJOsLvAZq_FLnbhQzWrBCdJS6-fh9_RaK9H9Muk6c9yE3LCCkjrLORGUaGJZGcd_cOMdoP0QrdnzKivt8pMGqzrRF_5fQ-EtqDZvqLOiVYDD4HEOMnxvMB5EoKiQlYKnKMtHLdv5i83BT5n4-tb-75JAbPHy6-p02-Mqp6KVv9LO9pyPE9ZwVKaZjlkgBjkRVEjHIIehTVagfakt4YPzAujw45EeRrF0RziBvIoyeskRxgwwlma0ajAPBQERSiL4jg55o2Ss2YOOYWszps4a5o6CtLoWwySdN73LkgWASoDVE7T9N-pAJXcTFoaymeOSmr3s3YQHGYDhSApG2GdrzRVECQXdyBkgHJJ_5GuqNsJ7QKUnzgEyYUGIbsvNY0644_656a874w-uqIs-lGk6Q-UFjiUrPpkKLQHq6kka1Q6vvq928YBWm7z65vVxHE3FgEq59i-jvvVs0xEw7L6_MK2IhvbP_TKJn77qF7k3TSixbC_V5cBWuI33j_fivpGtZOAqN0Zxga7eJCXr-uXzfMHlIcjgANevhv8USfN_ZM-L_Dhoeu38GTXt4sALYfFzheHl3LNy1VZjw8iQOU6QOWmvb3vrqbc9Y17WtynH9OVVkrF8qdedwDgHtt4eTkPpTn1ebm6Sd7eV-rWxvS93979kt02VOA7wwntRWisaIUm9SB3sxOQsLdmFBwskUA5M1oD88aGlvwv49CZwTIgJ_9MuHE2GbsDG3pyTPFtBE-YUdW31-YJ-Orvpo8E_RUAAP__dHE7Qw	Get hash	malicious	Unknown	Browse	104.17.113.39
	http://bebizicon.com/Campususa/index.xml#?email=b2xpdmllci5kb3phdEBpbm5vY2FwLmNvbQ==	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	172.67.74.152
AKAMAI-ASUS	k7h8uufe6Y.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	G7T8lHJWWM.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	possible SPAM## Msig Insurance Europe Complete via-Sign Monday January 2025.msg	Get hash	malicious	Unknown	Browse	23.47.168.24
	92.255.57_2.112.ps1	Get hash	malicious	LummaC	Browse	104.102.49.254
	https://fsgospefx6g2.sg.larksuite.com/wiki/Y7ybwFESRiirQPkoARZlhCyVgFb?	Get hash	malicious	HTMLPhisher	Browse	2.19.126.80
	https://staemcomnunlty.com/glft/91832	Get hash	malicious	Unknown	Browse	2.19.126.91
	https://fsgospefx6g2.sg.larksuite.com/wiki/Y7ybwFESRiirQPkoARZlhCyVgFb?	Get hash	malicious	HTMLPhisher	Browse	2.19.126.83
	uo9m.exe	Get hash	malicious	LummaC	Browse	23.50.98.133
	https://timecusa-my.sharepoint.com/:f:/p/stephensw/Erq5TMDIJBVBvh6vbWmpurEB4UwHKTW8nzSkPE2Ckmvugg?e=SepTcT	Get hash	malicious	HTMLPhisher	Browse	2.19.126.84
	Handler.exe	Get hash	malicious	DanaBot, Vidar	Browse	23.40.179.46

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	k7h8uufe6Y.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 188.114.96.3
	G7T8lHJWWM.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 188.114.96.3
	92.255.57_2.112.ps1	Get hash	malicious	LummaC	Browse	104.102.49.254 188.114.96.3
	8e8JUOzOjR.exe	Get hash	malicious	DBatLoader	Browse	104.102.49.254 188.114.96.3
	UTstKgkJNY.exe	Get hash	malicious	DBatLoader	Browse	104.102.49.254 188.114.96.3
	On9ahUpI4R.exe	Get hash	malicious	DBatLoader	Browse	104.102.49.254 188.114.96.3
	JDQS879kiy.exe	Get hash	malicious	DBatLoader	Browse	104.102.49.254 188.114.96.3
	UAHIzSm2x2.exe	Get hash	malicious	DBatLoader	Browse	104.102.49.254 188.114.96.3
	LbZ88q4uPa.exe	Get hash	malicious	DBatLoader	Browse	104.102.49.254 188.114.96.3
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.102.49.254 188.114.96.3

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.993212085629062
TrID:	Win32 Executable (generic) a (10002005/4) 99.79% Win32 Executable Delphi generic (14689/80) 0.15% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	XhlpAnBmIk.exe
File size:	4'556'176 bytes
MD5:	cd085e87a78dfa2159e476479f538da8
SHA1:	0535f44a1f2cff10a3bda1984bd3a71a4db395ba
SHA256:	b6c22e7ae8a0058a9c51edd8941feac20f88a86a3db2038689161368bd802875
SHA512:	3a291e1d0aafc3e357a4d1bda1b73d1b3a7a7a9d79f56af4fc277adc28b253db325ec41f41cd4e1647fb292b0c2b400cc8b7e203b87e612ffcbbc2a8566b3a10
SSDEEP:	98304:YuUNuoFozfsJo9Q2LTCyoFozfsJo9Q2LJ:CNxOsJo9LTClOsJo9LJ
TLSH:	B8262381F4B580EFE161A1F2962644B1EA518D18934E47333E84FEECFA31553DA2E7B0
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	1c1b130e1f3f2f27

Static PE Info

General

Entrypoint:	0x409c18
Entrypoint Section:	CODE
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	1
OS Version Minor:	0
File Version Major:	1
File Version Minor:	0
Subsystem Version Major:	1
Subsystem Version Minor:	0
Import Hash:	884310b1928934402ea6fec1dbd3cf5e

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Certum Extended Validation Code Signing 2021 CA, O=Asseco Data Systems S.A., C=PL
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	26/11/2024 07:07:48 26/11/2025 07:07:47
Subject Chain	CN=T H SUPPORT SERVICES LTD, O=T H SUPPORT SERVICES LTD, STREET=Suites 10s And 11s Trafford House Chester Road, PostalCode=M32 0RS, L=Stretford, S=Greater Manchester, C=GB, SERIALNUMBER=07890919, OID.1.3.6.1.4.1.311.60.2.1.3=GB, OID.2.5.4.15=Private Organization
Version:	3
Thumbprint MD5:	99CC43DD50C8C235E6703FBFE86B0302
Thumbprint SHA-1:	21297766029D043DFBA740CD5203E45171FC8EAA
Thumbprint SHA-256:	0A2CAAF3A1E6490DE521CCCA8452705AF0BD9A4A91D7F02CD8D3588404BCF77C
Serial:	502F183B00B497DFC821D09DEB30526B

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFC4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-10h], eax
mov dword ptr [ebp-24h], eax
call 00007F8B04C7A9B3h
call 00007F8B04C7BBBAh
call 00007F8B04C7BE49h
call 00007F8B04C7DE58h
call 00007F8B04C7DE9Fh
call 00007F8B04C807CEh
call 00007F8B04C80935h
xor eax, eax
push ebp
push 0040A2D4h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 0040A29Dh
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [0040C014h]
call 00007F8B04C8139Bh
call 00007F8B04C80FCEh
lea edx, dword ptr [ebp-10h]
xor eax, eax
call 00007F8B04C7E488h
mov edx, dword ptr [ebp-10h]
mov eax, 0040CDE8h
call 00007F8B04C7AA5Fh
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [0040CDE8h]
mov dl, 01h
mov eax, 00407364h
call 00007F8B04C7ED17h
mov dword ptr [0040CDECh], eax
xor edx, edx
push ebp
push 0040A255h
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007F8B04C8140Bh
mov dword ptr [0040CDF4h], eax
mov eax, dword ptr [0040CDF4h]
cmp dword ptr [eax+0Ch], 01h
jne 00007F8B04C8154Ah
mov eax, dword ptr [0040CDF4h]
mov edx, 00000028h
call 00007F8B04C7F118h
mov edx, dword ptr [000000F4h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd000	0x950	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x11000	0x67e00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x455c40	0x2950
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x10000	0x0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xf000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x933c	0x9400	552907946194d55d22cf289c419a3cd4	False	0.6688661317567568	data	6.795486360268957	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0xb000	0x24c	0x400	fdfb9f186687342407d6f000cea90719	False	0.3134765625	data	2.7679914923058866	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0xc000	0xe4c	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xd000	0x950	0xa00	bb5485bf968b970e5ea81292af2acdba	False	0.414453125	data	4.430733069799036	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xe000	0x8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xf000	0x18	0x200	9ba824905bf9c7922b6fc87a38b74366	False	0.052734375	data	0.2044881574398449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0x10000	0x8b4	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x11000	0x67e00	0x67e00	b40e1f238f04634f3980c77190845f48	False	0.707877369133574	data	7.620038209995347	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x112f4	0xcdc7	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	1.0000379657928207
RT_ICON	0x1e0bc	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.420746887966805
RT_STRING	0x20664	0x2f2	data			0.35543766578249336
RT_STRING	0x20958	0x30c	data			0.3871794871794872
RT_STRING	0x20c64	0x2ce	data			0.42618384401114207
RT_STRING	0x20f34	0x68	data			0.75
RT_STRING	0x20f9c	0xb4	data			0.6277777777777778
RT_STRING	0x21050	0xae	data			0.5344827586206896
RT_RCDATA	0x21100	0x2c	data			1.2045454545454546
RT_GROUP_ICON	0x2112c	0x22	data	English	United States	0.9411764705882353
RT_VERSION	0x21150	0x4b8	COM executable for DOS	English	United States	0.31870860927152317
RT_MANIFEST	0x21608	0x560	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4251453488372093

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, WideCharToMultiByte, TlsSetValue, TlsGetValue, MultiByteToWideChar, GetModuleHandleA, GetLastError, GetCommandLineA, WriteFile, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetSystemTime, GetFileType, ExitProcess, CreateFileA, CloseHandle
user32.dll	MessageBoxA
oleaut32.dll	VariantChangeTypeEx, VariantCopyInd, VariantClear, SysStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey, OpenProcessToken, LookupPrivilegeValueA
kernel32.dll	WriteFile, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, Sleep, SizeofResource, SetLastError, SetFilePointer, SetErrorMode, SetEndOfFile, RemoveDirectoryA, ReadFile, LockResource, LoadResource, LoadLibraryA, IsDBCSLeadByte, GetWindowsDirectoryA, GetVersionExA, GetUserDefaultLangID, GetSystemInfo, GetSystemDefaultLCID, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetFullPathNameA, GetFileSize, GetFileAttributesA, GetExitCodeProcess, GetEnvironmentVariableA, GetCurrentProcess, GetCommandLineA, GetACP, InterlockedExchange, FormatMessageA, FindResourceA, DeleteFileA, CreateProcessA, CreateFileA, CreateDirectoryA, CloseHandle
user32.dll	TranslateMessage, SetWindowLongA, PeekMessageA, MsgWaitForMultipleObjects, MessageBoxA, LoadStringA, ExitWindowsEx, DispatchMessageA, DestroyWindow, CreateWindowExA, CallWindowProcA, CharPrevA
comctl32.dll	InitCommonControls
advapi32.dll	AdjustTokenPrivileges

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-14T08:55:29.979124+0100	2059133	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fraggielek .biz)	1	192.168.2.5	59904	1.1.1.1	53	UDP
2025-01-14T08:55:30.001215+0100	2059135	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grandiouseziu .biz)	1	192.168.2.5	54824	1.1.1.1	53	UDP
2025-01-14T08:55:30.018914+0100	2059137	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (littlenotii .biz)	1	192.168.2.5	54641	1.1.1.1	53	UDP
2025-01-14T08:55:30.038534+0100	2059141	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (marketlumpe .biz)	1	192.168.2.5	52867	1.1.1.1	53	UDP
2025-01-14T08:55:30.053249+0100	2059143	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (nuttyshopr .biz)	1	192.168.2.5	58129	1.1.1.1	53	UDP
2025-01-14T08:55:30.068046+0100	2059145	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (punishzement .biz)	1	192.168.2.5	59188	1.1.1.1	53	UDP
2025-01-14T08:55:30.106007+0100	2059151	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spookycappy .biz)	1	192.168.2.5	56127	1.1.1.1	53	UDP
2025-01-14T08:55:30.119673+0100	2059153	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (truculengisau .biz)	1	192.168.2.5	53864	1.1.1.1	53	UDP
2025-01-14T08:55:30.909117+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49762	104.102.49.254	443	TCP
2025-01-14T08:55:32.455076+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.5	49762	104.102.49.254	443	TCP
2025-01-14T08:55:33.066480+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49779	188.114.96.3	443	TCP
2025-01-14T08:55:33.489179+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49779	188.114.96.3	443	TCP
2025-01-14T08:55:33.489179+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49779	188.114.96.3	443	TCP
2025-01-14T08:55:33.742092+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49785	188.114.96.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 08:55:30.255470037 CET	49762	443	192.168.2.5	104.102.49.254
Jan 14, 2025 08:55:30.255503893 CET	443	49762	104.102.49.254	192.168.2.5
Jan 14, 2025 08:55:30.256186008 CET	49762	443	192.168.2.5	104.102.49.254
Jan 14, 2025 08:55:30.274328947 CET	49762	443	192.168.2.5	104.102.49.254
Jan 14, 2025 08:55:30.274363995 CET	443	49762	104.102.49.254	192.168.2.5
Jan 14, 2025 08:55:30.908512115 CET	443	49762	104.102.49.254	192.168.2.5
Jan 14, 2025 08:55:30.909116983 CET	49762	443	192.168.2.5	104.102.49.254
Jan 14, 2025 08:55:30.911772966 CET	49762	443	192.168.2.5	104.102.49.254
Jan 14, 2025 08:55:30.911778927 CET	443	49762	104.102.49.254	192.168.2.5
Jan 14, 2025 08:55:30.912122965 CET	443	49762	104.102.49.254	192.168.2.5
Jan 14, 2025 08:55:30.961185932 CET	49762	443	192.168.2.5	104.102.49.254
Jan 14, 2025 08:55:32.051625967 CET	49762	443	192.168.2.5	104.102.49.254
Jan 14, 2025 08:55:32.095352888 CET	443	49762	104.102.49.254	192.168.2.5
Jan 14, 2025 08:55:32.455086946 CET	443	49762	104.102.49.254	192.168.2.5
Jan 14, 2025 08:55:32.455115080 CET	443	49762	104.102.49.254	192.168.2.5
Jan 14, 2025 08:55:32.455125093 CET	443	49762	104.102.49.254	192.168.2.5
Jan 14, 2025 08:55:32.455148935 CET	443	49762	104.102.49.254	192.168.2.5
Jan 14, 2025 08:55:32.455157995 CET	443	49762	104.102.49.254	192.168.2.5
Jan 14, 2025 08:55:32.455231905 CET	49762	443	192.168.2.5	104.102.49.254
Jan 14, 2025 08:55:32.455231905 CET	49762	443	192.168.2.5	104.102.49.254
Jan 14, 2025 08:55:32.455245972 CET	443	49762	104.102.49.254	192.168.2.5
Jan 14, 2025 08:55:32.455338001 CET	49762	443	192.168.2.5	104.102.49.254
Jan 14, 2025 08:55:32.559534073 CET	443	49762	104.102.49.254	192.168.2.5
Jan 14, 2025 08:55:32.559576035 CET	443	49762	104.102.49.254	192.168.2.5
Jan 14, 2025 08:55:32.559668064 CET	49762	443	192.168.2.5	104.102.49.254
Jan 14, 2025 08:55:32.559668064 CET	49762	443	192.168.2.5	104.102.49.254
Jan 14, 2025 08:55:32.559679985 CET	443	49762	104.102.49.254	192.168.2.5
Jan 14, 2025 08:55:32.559719086 CET	49762	443	192.168.2.5	104.102.49.254
Jan 14, 2025 08:55:32.564802885 CET	443	49762	104.102.49.254	192.168.2.5
Jan 14, 2025 08:55:32.564954042 CET	49762	443	192.168.2.5	104.102.49.254
Jan 14, 2025 08:55:32.564955950 CET	443	49762	104.102.49.254	192.168.2.5
Jan 14, 2025 08:55:32.565220118 CET	49762	443	192.168.2.5	104.102.49.254
Jan 14, 2025 08:55:32.579236031 CET	49762	443	192.168.2.5	104.102.49.254
Jan 14, 2025 08:55:32.579236031 CET	49762	443	192.168.2.5	104.102.49.254
Jan 14, 2025 08:55:32.579253912 CET	443	49762	104.102.49.254	192.168.2.5
Jan 14, 2025 08:55:32.579262018 CET	443	49762	104.102.49.254	192.168.2.5
Jan 14, 2025 08:55:32.603548050 CET	49779	443	192.168.2.5	188.114.96.3
Jan 14, 2025 08:55:32.603598118 CET	443	49779	188.114.96.3	192.168.2.5
Jan 14, 2025 08:55:32.603657961 CET	49779	443	192.168.2.5	188.114.96.3
Jan 14, 2025 08:55:32.604051113 CET	49779	443	192.168.2.5	188.114.96.3
Jan 14, 2025 08:55:32.604064941 CET	443	49779	188.114.96.3	192.168.2.5
Jan 14, 2025 08:55:33.066402912 CET	443	49779	188.114.96.3	192.168.2.5
Jan 14, 2025 08:55:33.066479921 CET	49779	443	192.168.2.5	188.114.96.3
Jan 14, 2025 08:55:33.069785118 CET	49779	443	192.168.2.5	188.114.96.3
Jan 14, 2025 08:55:33.069798946 CET	443	49779	188.114.96.3	192.168.2.5
Jan 14, 2025 08:55:33.070210934 CET	443	49779	188.114.96.3	192.168.2.5
Jan 14, 2025 08:55:33.071283102 CET	49779	443	192.168.2.5	188.114.96.3
Jan 14, 2025 08:55:33.071301937 CET	49779	443	192.168.2.5	188.114.96.3
Jan 14, 2025 08:55:33.071384907 CET	443	49779	188.114.96.3	192.168.2.5
Jan 14, 2025 08:55:33.489181995 CET	443	49779	188.114.96.3	192.168.2.5
Jan 14, 2025 08:55:33.489296913 CET	443	49779	188.114.96.3	192.168.2.5
Jan 14, 2025 08:55:33.489371061 CET	49779	443	192.168.2.5	188.114.96.3
Jan 14, 2025 08:55:33.497530937 CET	49779	443	192.168.2.5	188.114.96.3
Jan 14, 2025 08:55:33.497560978 CET	443	49779	188.114.96.3	192.168.2.5
Jan 14, 2025 08:55:33.497590065 CET	49779	443	192.168.2.5	188.114.96.3
Jan 14, 2025 08:55:33.497596979 CET	443	49779	188.114.96.3	192.168.2.5
Jan 14, 2025 08:55:33.566443920 CET	49785	443	192.168.2.5	188.114.96.3
Jan 14, 2025 08:55:33.566498995 CET	443	49785	188.114.96.3	192.168.2.5
Jan 14, 2025 08:55:33.567164898 CET	49785	443	192.168.2.5	188.114.96.3
Jan 14, 2025 08:55:33.567435026 CET	49785	443	192.168.2.5	188.114.96.3
Jan 14, 2025 08:55:33.567446947 CET	443	49785	188.114.96.3	192.168.2.5
Jan 14, 2025 08:55:33.742091894 CET	49785	443	192.168.2.5	188.114.96.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 08:55:29.961564064 CET	49654	53	192.168.2.5	1.1.1.1
Jan 14, 2025 08:55:29.970282078 CET	53	49654	1.1.1.1	192.168.2.5
Jan 14, 2025 08:55:29.979124069 CET	59904	53	192.168.2.5	1.1.1.1
Jan 14, 2025 08:55:29.987806082 CET	53	59904	1.1.1.1	192.168.2.5
Jan 14, 2025 08:55:30.001214981 CET	54824	53	192.168.2.5	1.1.1.1
Jan 14, 2025 08:55:30.010097027 CET	53	54824	1.1.1.1	192.168.2.5
Jan 14, 2025 08:55:30.018913984 CET	54641	53	192.168.2.5	1.1.1.1
Jan 14, 2025 08:55:30.028214931 CET	53	54641	1.1.1.1	192.168.2.5
Jan 14, 2025 08:55:30.038533926 CET	52867	53	192.168.2.5	1.1.1.1
Jan 14, 2025 08:55:30.047065973 CET	53	52867	1.1.1.1	192.168.2.5
Jan 14, 2025 08:55:30.053248882 CET	58129	53	192.168.2.5	1.1.1.1
Jan 14, 2025 08:55:30.062227964 CET	53	58129	1.1.1.1	192.168.2.5
Jan 14, 2025 08:55:30.068046093 CET	59188	53	192.168.2.5	1.1.1.1
Jan 14, 2025 08:55:30.076314926 CET	53	59188	1.1.1.1	192.168.2.5
Jan 14, 2025 08:55:30.106007099 CET	56127	53	192.168.2.5	1.1.1.1
Jan 14, 2025 08:55:30.115644932 CET	53	56127	1.1.1.1	192.168.2.5
Jan 14, 2025 08:55:30.119673014 CET	53864	53	192.168.2.5	1.1.1.1
Jan 14, 2025 08:55:30.128890038 CET	53	53864	1.1.1.1	192.168.2.5
Jan 14, 2025 08:55:30.134057999 CET	63607	53	192.168.2.5	1.1.1.1
Jan 14, 2025 08:55:30.140786886 CET	53	63607	1.1.1.1	192.168.2.5
Jan 14, 2025 08:55:32.591206074 CET	50212	53	192.168.2.5	1.1.1.1
Jan 14, 2025 08:55:32.602421999 CET	53	50212	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 14, 2025 08:55:29.961564064 CET	192.168.2.5	1.1.1.1	0x1894	Standard query (0)	whisperusz.biz	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:55:29.979124069 CET	192.168.2.5	1.1.1.1	0xf1f7	Standard query (0)	fraggielek.biz	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:55:30.001214981 CET	192.168.2.5	1.1.1.1	0xc804	Standard query (0)	grandiouseziu.biz	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:55:30.018913984 CET	192.168.2.5	1.1.1.1	0xc92a	Standard query (0)	littlenotii.biz	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:55:30.038533926 CET	192.168.2.5	1.1.1.1	0x2ac0	Standard query (0)	marketlumpe.biz	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:55:30.053248882 CET	192.168.2.5	1.1.1.1	0x1956	Standard query (0)	nuttyshopr.biz	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:55:30.068046093 CET	192.168.2.5	1.1.1.1	0x964d	Standard query (0)	punishzement.biz	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:55:30.106007099 CET	192.168.2.5	1.1.1.1	0xd009	Standard query (0)	spookycappy.biz	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:55:30.119673014 CET	192.168.2.5	1.1.1.1	0xef5a	Standard query (0)	truculengisau.biz	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:55:30.134057999 CET	192.168.2.5	1.1.1.1	0x716c	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:55:32.591206074 CET	192.168.2.5	1.1.1.1	0x5648	Standard query (0)	aleksandr-block.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 14, 2025 08:55:29.970282078 CET	1.1.1.1	192.168.2.5	0x1894	Name error (3)	whisperusz.biz	none	none	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:55:29.987806082 CET	1.1.1.1	192.168.2.5	0xf1f7	Name error (3)	fraggielek.biz	none	none	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:55:30.010097027 CET	1.1.1.1	192.168.2.5	0xc804	Name error (3)	grandiouseziu.biz	none	none	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:55:30.028214931 CET	1.1.1.1	192.168.2.5	0xc92a	Name error (3)	littlenotii.biz	none	none	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:55:30.047065973 CET	1.1.1.1	192.168.2.5	0x2ac0	Name error (3)	marketlumpe.biz	none	none	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:55:30.062227964 CET	1.1.1.1	192.168.2.5	0x1956	Name error (3)	nuttyshopr.biz	none	none	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:55:30.076314926 CET	1.1.1.1	192.168.2.5	0x964d	Name error (3)	punishzement.biz	none	none	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:55:30.115644932 CET	1.1.1.1	192.168.2.5	0xd009	Name error (3)	spookycappy.biz	none	none	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:55:30.128890038 CET	1.1.1.1	192.168.2.5	0xef5a	Name error (3)	truculengisau.biz	none	none	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:55:30.140786886 CET	1.1.1.1	192.168.2.5	0x716c	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:55:32.602421999 CET	1.1.1.1	192.168.2.5	0x5648	No error (0)	aleksandr-block.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:55:32.602421999 CET	1.1.1.1	192.168.2.5	0x5648	No error (0)	aleksandr-block.com		188.114.97.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

aleksandr-block.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49762	104.102.49.254	443	2508	C:\Users\user\Desktop\XhlpAnBmIk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:55:32 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2025-01-14 07:55:32 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Tue, 14 Jan 2025 07:55:32 GMT Content-Length: 35141 Connection: close Set-Cookie: sessionid=efcca47d3311a9304a29a4c1; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2025-01-14 07:55:32 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2025-01-14 07:55:32 UTC	16384	IN	Data Raw: 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 3f 73 75 62 73 65 63 74 69 6f 6e 3d 62 72 6f 61 64 63 61 73 74 73 22 3e 0a 09 09 09 09 09 09 42 72 6f 61 64 63 61 73 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 62 6f 75 74 2f 22 3e 0a 09 09 09 09 41 62 6f 75 74 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 65 6c 70 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 65 6e 2f 22 3e 0a Data Ascii: eamcommunity.com/?subsection=broadcasts">Broadcasts</a></div><a class="menuitem " href="https://store.steampowered.com/about/">About</a><a class="menuitem " href="https://help.steampowered.com/en/">
2025-01-14 07:55:32 UTC	3768	IN	Data Raw: 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 61 63 74 69 6f 6e 73 22 3e 0a 09 09 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 73 75 6d 6d 61 72 79 22 3e 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 65 72 73 6f 6e 61 5f 6e 61 6d 65 20 70 65 72 73 6f 6e 61 5f 6e 61 6d 65 5f 73 70 61 63 65 72 22 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 34 70 78 3b 22 3e 0a 09 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 Data Ascii: </a></div><div class="profile_header_actions"></div></div><div class="profile_header_summary"><div class="persona_name persona_name_spacer" style="font-size: 24px;"><span class="
2025-01-14 07:55:32 UTC	510	IN	Data Raw: 61 6e 6b 22 3e 53 74 65 61 6d 20 53 75 62 73 63 72 69 62 65 72 20 41 67 72 65 65 6d 65 6e 74 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 26 6e 62 73 70 3b 7c 20 26 6e 62 73 70 3b 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 63 63 6f 75 6e 74 2f 63 6f 6f 6b 69 65 70 72 65 66 65 72 65 6e 63 65 73 2f 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 43 6f 6f 6b 69 65 73 3c 2f 61 3e 0a 09 09 09 09 09 09 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 09 09 09 09 3c 2f 73 70 61 6e 3e 0a 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 65 73 70 6f 6e 73 69 76 65 5f 6f 70 74 69 6e 5f 6c 69 6e 6b 22 Data Ascii: ank">Steam Subscriber Agreement</a>  \|  <a href="http://store.steampowered.com/account/cookiepreferences/" target="_blank">Cookies</a></span></span></div><div class="responsive_optin_link"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49779	188.114.96.3	443	2508	C:\Users\user\Desktop\XhlpAnBmIk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:55:33 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: aleksandr-block.com
2025-01-14 07:55:33 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2025-01-14 07:55:33 UTC	1131	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:55:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=77rpbmfi20ac5hh63b5067l1lo; expires=Sat, 10 May 2025 01:42:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8YsEMEMc3yPhEOD9xd%2FZiStqeupav44m5u3V4Pn4Yg%2FTut2TrlcvAo6B239RC%2FiYRQe8EodOV9af%2B9KgilhHCA%2F6diWAhDp5BqX1iefAm371jrvzECmSxgXkcUsXVO0zE%2FqUIzFo"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 901c107c1d0c428f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1710&min_rtt=1692&rtt_var=647&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2845&recv_bytes=910&delivery_rate=1725768&cwnd=100&unsent_bytes=0&cid=1143b42d141f001e&ts=436&x=0"
2025-01-14 07:55:33 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2025-01-14 07:55:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	02:55:12
Start date:	14/01/2025
Path:	C:\Users\user\Desktop\XhlpAnBmIk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\XhlpAnBmIk.exe"
Imagebase:	0x400000
File size:	4'556'176 bytes
MD5 hash:	CD085E87A78DFA2159E476479F538DA8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.5%
Dynamic/Decrypted Code Coverage:	90.8%
Signature Coverage:	40%
Total number of Nodes:	130
Total number of Limit Nodes:	14

Executed Functions

Function 02265D00 Relevance: 12.7, APIs: 8, Instructions: 730memorynativethreadCOMMON

Download Yara Rule

APIs

NtCreateSection.NTDLL(?,000F001F,00000000,?,00000040,08000000,00000000,00000000), ref: 02265D99
NtMapViewOfSection.NTDLL(?,00000000), ref: 02265E41
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 022661B5
NtMapViewOfSection.NTDLL(?,00000000,?,?,?,?,?,?), ref: 0226626A
VirtualProtect.KERNELBASE(?,?,00000008,?,?,?,?,?,?,?), ref: 02266287
VirtualProtect.KERNELBASE(?,?,?,00000000), ref: 0226632A
VirtualProtect.KERNELBASE(?,?,00000002,?,?,?,?,?,?,?), ref: 0226635D
CreateThread.KERNELBASE(00000000,00000000,?,00000000,00000000,00000000,?,?,?,?,?,?), ref: 022664CE

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID: Virtual$ProtectSection$CreateView$AllocThread
String ID:
API String ID: 1248616170-0
Opcode ID: ff471fed8362e1f6680916959444b0539dd2ef4160a15e649cb06b76fd5f0269
Instruction ID: 1baad6fb8698b1f5f1f057cae33380e45dcc82fc2422f077c53d1932c94f50e6
Opcode Fuzzy Hash: ff471fed8362e1f6680916959444b0539dd2ef4160a15e649cb06b76fd5f0269
Instruction Fuzzy Hash: 68428972618342AFDB24CF94C848B7BBBE9EF88704F04492CF9859B255D775E880CB91

Function 00404C08 Relevance: 11.7, APIs: 2, Strings: 4, Instructions: 1233librarymemoryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000), ref: 004053EF
VirtualAlloc.KERNELBASE(?,00057086,6D7CF73F,-9BDD9E89,?,?,?,-F17F1F68), ref: 00405B49

Strings

h<Jr, xrefs: 00405AD3
l[L, xrefs: 00405923
kern, xrefs: 00404CF4
kern, xrefs: 00405495

Memory Dump Source

Source File: 00000000.00000002.2340148518.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2340128450.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340169182.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340169182.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340208145.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XhlpAnBmIk.jbxd

Similarity

API ID: AddressAllocProcVirtual
String ID: h<Jr$kern$kern$l[L
API String ID: 2770133467-2283849176
Opcode ID: 25eed247fb3f7ef6cde5459f39bc4c546cd3fc917ef745bdbcf17e0ec91b1b31
Instruction ID: 3eb0e2f8cb5cefc95c1ecfc25e9266b9300d5600b25801c424963f42c7ed2735
Opcode Fuzzy Hash: 25eed247fb3f7ef6cde5459f39bc4c546cd3fc917ef745bdbcf17e0ec91b1b31
Instruction Fuzzy Hash: 03920577D143208FD748EF7AEE8656A3762FBC0308346863ED542B75A6DB3855028ACD

Function 00404CDC Relevance: 11.7, APIs: 2, Strings: 4, Instructions: 1190librarymemoryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000), ref: 004053EF
VirtualAlloc.KERNELBASE(?,00057086,6D7CF73F,-9BDD9E89,?,?,?,-F17F1F68), ref: 00405B49

Strings

h<Jr, xrefs: 00405AD3
l[L, xrefs: 00405923
kern, xrefs: 00404CF4
kern, xrefs: 00405495

Memory Dump Source

Source File: 00000000.00000002.2340148518.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2340128450.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340169182.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340169182.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340208145.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XhlpAnBmIk.jbxd

Similarity

API ID: AddressAllocProcVirtual
String ID: h<Jr$kern$kern$l[L
API String ID: 2770133467-2283849176
Opcode ID: 6545d0115b53b9c457484ec690fbc3ebb0e0aa4f83da98dc3ad0cd2ff6c109e6
Instruction ID: 404ec8b35b70e8c203ab6cc5b1f6def57176ab1b76c2f298e696afa35d17db55
Opcode Fuzzy Hash: 6545d0115b53b9c457484ec690fbc3ebb0e0aa4f83da98dc3ad0cd2ff6c109e6
Instruction Fuzzy Hash: 57920577D143208FD748EF7AEE8656A3762FBC0308346863ED442B75A6DB3855428ACD

Function 00404DA8 Relevance: 9.8, APIs: 2, Strings: 3, Instructions: 1076
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(00000000), ref: 004053EF
VirtualAlloc.KERNELBASE(?,00057086,6D7CF73F,-9BDD9E89,?,?,?,-F17F1F68), ref: 00405B49

Strings

h<Jr, xrefs: 00405AD3
l[L, xrefs: 00405923
kern, xrefs: 00405495

Memory Dump Source

Source File: 00000000.00000002.2340148518.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2340128450.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340169182.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340169182.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340208145.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XhlpAnBmIk.jbxd

Similarity

API ID: AddressAllocProcVirtual
String ID: h<Jr$kern$l[L
API String ID: 2770133467-2354311986
Opcode ID: b76471f0074a37f5b1e493b37faac1f0bb6e9acc32955c7d4691a02a55d2118f
Instruction ID: 6cb7e7ac4be72f1174ce591e69d43403eaf499de57eda62f151c1be8579c3f79
Opcode Fuzzy Hash: b76471f0074a37f5b1e493b37faac1f0bb6e9acc32955c7d4691a02a55d2118f
Instruction Fuzzy Hash: ED82E4779143208FD748EF7AEE8656A3762FBC0308342863ED542B75B6DB3855428ACD

Function 0040515C Relevance: 9.6, APIs: 2, Strings: 3, Instructions: 863
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(00000000), ref: 004053EF
VirtualAlloc.KERNELBASE(?,00057086,6D7CF73F,-9BDD9E89,?,?,?,-F17F1F68), ref: 00405B49

Strings

h<Jr, xrefs: 00405AD3
l[L, xrefs: 00405923
kern, xrefs: 00405495

Memory Dump Source

Source File: 00000000.00000002.2340148518.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2340128450.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340169182.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340169182.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340208145.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XhlpAnBmIk.jbxd

Similarity

API ID: AddressAllocProcVirtual
String ID: h<Jr$kern$l[L
API String ID: 2770133467-2354311986
Opcode ID: c41749fd934c039349f25c087806cd63ccef6f60902dba02022537d77be8cdf7
Instruction ID: 3cdb68374fee5ee5d5409ff5475b08420c62d789f8a45530e3e62012e70114b5
Opcode Fuzzy Hash: c41749fd934c039349f25c087806cd63ccef6f60902dba02022537d77be8cdf7
Instruction Fuzzy Hash: 92521677D147208FD748EF7AEE8616A3762FB90308341863ED442B75B6DB3855428ACE

Function 0040538C Relevance: 9.5, APIs: 2, Strings: 3, Instructions: 724
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(00000000), ref: 004053EF
VirtualAlloc.KERNELBASE(?,00057086,6D7CF73F,-9BDD9E89,?,?,?,-F17F1F68), ref: 00405B49

Strings

h<Jr, xrefs: 00405AD3
l[L, xrefs: 00405923
kern, xrefs: 00405495

Memory Dump Source

Source File: 00000000.00000002.2340148518.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2340128450.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340169182.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340169182.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340208145.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XhlpAnBmIk.jbxd

Similarity

API ID: AddressAllocProcVirtual
String ID: h<Jr$kern$l[L
API String ID: 2770133467-2354311986
Opcode ID: f2715acc70f1b86810ddfa0ebe1cc3b6215ea43804c949647926774f91f29be8
Instruction ID: 31c83e771fb83f0a674132367daea32c7de425483ae6a23024f09e261b307759
Opcode Fuzzy Hash: f2715acc70f1b86810ddfa0ebe1cc3b6215ea43804c949647926774f91f29be8
Instruction Fuzzy Hash: 3E320576D147208FD348EF76EE8656A3762FB90308341863FE442B75B6DB3855428ACE

Function 02210B5B Relevance: 7.6, APIs: 5, Instructions: 100
threadprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000004,00000000,?,?,?,?,?,022106A1,?,00000001,?,81EC8B55,000000FF), ref: 02210B99
Thread32First.KERNEL32(00000000,0000001C), ref: 02210BC5
Wow64SuspendThread.KERNEL32(00000000), ref: 02210C18
CloseHandle.KERNELBASE(00000000), ref: 02210C42
CloseHandle.KERNELBASE(00000000), ref: 02210C76

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateFirstSnapshotSuspendThreadThread32Toolhelp32Wow64
String ID:
API String ID: 2720937676-0
Opcode ID: ed4f7e93d5c748d87e273fbd072de27cfcb41b6612c19f34ce8dd7f2a24eca5e
Instruction ID: c7bdf7d04b61a4950d9af6f4550bf4a2b58600e4f4a441e53bfbe81ad587a6f1
Opcode Fuzzy Hash: ed4f7e93d5c748d87e273fbd072de27cfcb41b6612c19f34ce8dd7f2a24eca5e
Instruction Fuzzy Hash: 1D41EC75A00109AFDB18DF98C490FADB7F6EF88300F108168EA159B794DB74AE85CB94

Function 0221044B Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 399
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,?,00000000,00000000,00000000,?,00000001,?,81EC8B55,000000FF), ref: 022106EE

Strings

1QsZ, xrefs: 02210511
v>M,, xrefs: 0221052F

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID: 1QsZ$v>M,
API String ID: 2422867632-364196341
Opcode ID: 7c5042c15555025186f8f4b371d6131fa5bebea6202e21343a4d9ebaf1a0ac89
Instruction ID: 1ece8e4652efd6e16d074b664fc4968f60bbe5324ff645241bfb0e594a286e9a
Opcode Fuzzy Hash: 7c5042c15555025186f8f4b371d6131fa5bebea6202e21343a4d9ebaf1a0ac89
Instruction Fuzzy Hash: A112C4B1E10219DFDB14CF98C990BADBBB2FF88304F2481A9D915AB385C7756A81CF54

Function 00405674 Relevance: 5.0, APIs: 1, Strings: 2, Instructions: 498
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(?,00057086,6D7CF73F,-9BDD9E89,?,?,?,-F17F1F68), ref: 00405B49

Strings

h<Jr, xrefs: 00405AD3
l[L, xrefs: 00405923

Memory Dump Source

Source File: 00000000.00000002.2340148518.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2340128450.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340169182.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340169182.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340208145.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XhlpAnBmIk.jbxd

Similarity

API ID: AllocVirtual
String ID: h<Jr$l[L
API String ID: 4275171209-4167080569
Opcode ID: 4d71679e81d68ea94d580c2c28f6d4f95ced1786831337771a1c3566e1fc3e21
Instruction ID: 11281ecbfac5b2410b60535fcc411d9845a1cdbdf9979ba050117f0b7c28c1e7
Opcode Fuzzy Hash: 4d71679e81d68ea94d580c2c28f6d4f95ced1786831337771a1c3566e1fc3e21
Instruction Fuzzy Hash: 5102E276D147208FC348EF76EE8656A37A1FB80308341963EE542B75B6DB3855428BCE

Function 0040582C Relevance: 4.9, APIs: 1, Strings: 2, Instructions: 428
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(?,00057086,6D7CF73F,-9BDD9E89,?,?,?,-F17F1F68), ref: 00405B49

Strings

h<Jr, xrefs: 00405AD3
l[L, xrefs: 00405923

Memory Dump Source

Source File: 00000000.00000002.2340148518.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2340128450.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340169182.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340169182.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340208145.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XhlpAnBmIk.jbxd

Similarity

API ID: AllocVirtual
String ID: h<Jr$l[L
API String ID: 4275171209-4167080569
Opcode ID: cd5e2aff48c1c9e0685b61abf137ed87a4b4c7ee7d0f6b51ae3133aa8cde163a
Instruction ID: 78a00a00ecca35b0ac8f7d6ecc26b7bb4f07ea46ed5fa02dccdf78e37254e7c4
Opcode Fuzzy Hash: cd5e2aff48c1c9e0685b61abf137ed87a4b4c7ee7d0f6b51ae3133aa8cde163a
Instruction Fuzzy Hash: C2E11676D147208FC748EF7AEE8656A3761FB80308345863FE542B75A6CF3855428ACE

Function 0040584C Relevance: 4.9, APIs: 1, Strings: 2, Instructions: 417
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(?,00057086,6D7CF73F,-9BDD9E89,?,?,?,-F17F1F68), ref: 00405B49

Strings

h<Jr, xrefs: 00405AD3
l[L, xrefs: 00405923

Memory Dump Source

Source File: 00000000.00000002.2340148518.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2340128450.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340169182.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340169182.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340208145.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XhlpAnBmIk.jbxd

Similarity

API ID: AllocVirtual
String ID: h<Jr$l[L
API String ID: 4275171209-4167080569
Opcode ID: dff8730f423edfe6d28a421a7e3f90de9524c6b31ea746ad798f05c31a1c27b7
Instruction ID: bd8a37d5150741af204f6df8654e976f2f68fb976ca2a886c2bfae32c7d1c1a1
Opcode Fuzzy Hash: dff8730f423edfe6d28a421a7e3f90de9524c6b31ea746ad798f05c31a1c27b7
Instruction Fuzzy Hash: 26E11676D147208BC748EF76EE8656A3761FB80308345C63FE442B75B6CB3855428ACE

Function 00405858 Relevance: 4.9, APIs: 1, Strings: 2, Instructions: 415
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(?,00057086,6D7CF73F,-9BDD9E89,?,?,?,-F17F1F68), ref: 00405B49

Strings

h<Jr, xrefs: 00405AD3
l[L, xrefs: 00405923

Memory Dump Source

Source File: 00000000.00000002.2340148518.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2340128450.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340169182.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340169182.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340208145.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XhlpAnBmIk.jbxd

Similarity

API ID: AllocVirtual
String ID: h<Jr$l[L
API String ID: 4275171209-4167080569
Opcode ID: d29e1e52d757c16be0bb315db031b7813fd16e9c97e7e3fe27fa2f66bb6927bd
Instruction ID: 195002edf35196ada433f4be5b762761fd2c5ec00ce90d9a9c3dc79e80fbcd23
Opcode Fuzzy Hash: d29e1e52d757c16be0bb315db031b7813fd16e9c97e7e3fe27fa2f66bb6927bd
Instruction Fuzzy Hash: A7E12676D147208FC748EF7AEE8656A3761FB80308345C63EE542B75B6CB3855428ACE

Function 02210A0B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 103
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,?,00000000,00000000,00000000), ref: 02210AD7

Strings

,, xrefs: 02210B23

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID: ,
API String ID: 2422867632-3772416878
Opcode ID: fc60953fbf7661c618888493d7684cefa6d88d8934743e077e5b29c3addb46ae
Instruction ID: e0cbb340299cc24b694f82a8977363f3bc1e85505bceaf5d101af1358625dd62
Opcode Fuzzy Hash: fc60953fbf7661c618888493d7684cefa6d88d8934743e077e5b29c3addb46ae
Instruction Fuzzy Hash: D541B474A00209EFDB04CF98C994FAEB7B1BF88314F208198D915AB385D775AF81CB94

Function 00405CBC Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340148518.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2340128450.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340169182.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340169182.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340208145.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XhlpAnBmIk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 327df1266800ed4c6713a66de68832dbf8f77d4282c75e20ab86b0a3e8402df6
Instruction ID: 0417741db71cc3050021cd64fc86e0ca35b3a897dd9fe81618f88897877a74cb
Opcode Fuzzy Hash: 327df1266800ed4c6713a66de68832dbf8f77d4282c75e20ab86b0a3e8402df6
Instruction Fuzzy Hash: 834159329107148BCB19EF76DE8A56A3792FBD0304385C63ED441B75EACB3855429ECE

Function 00405D06 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340148518.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2340128450.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340169182.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340169182.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340208145.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XhlpAnBmIk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d6f87ca67206c4824a33f3a2b19e000831fe5d74202a541b0ed4d867b73ffc0
Instruction ID: df8fa16e142c6661ff33d5b9a0297374d79887ae12186e12b7c115015e5d1c6f
Opcode Fuzzy Hash: 9d6f87ca67206c4824a33f3a2b19e000831fe5d74202a541b0ed4d867b73ffc0
Instruction Fuzzy Hash: 9B3128329107148BDB18EB76DE8656A3B52EBD0304385C63ED441B75EACB3859439ECF

Function 02264760 Relevance: 6.1, APIs: 4, Instructions: 99
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0226697E: LoadLibraryA.KERNELBASE(00000000,?,?), ref: 02266A10

VirtualProtect.KERNELBASE(00000000,0000000C,00000040,?), ref: 022647BB
VirtualProtect.KERNELBASE(00000000,0000000C,?,?), ref: 022647EE
VirtualProtect.KERNELBASE(00000000,0040145E,00000040,?), ref: 02264821
VirtualProtect.KERNELBASE(00000000,0040145E,?,?), ref: 0226484B

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: 2e97600cb857c96b3e27a7ca78dc6b50189988e4741ea1636e9ebab3cfc04358
Instruction ID: 50cc30b6956b2dea92c3c51928a38a2fcecb20e68b1e1dc3eb7d348211cd4681
Opcode Fuzzy Hash: 2e97600cb857c96b3e27a7ca78dc6b50189988e4741ea1636e9ebab3cfc04358
Instruction Fuzzy Hash: 6821F9731143853EE324BAE08C48FB77AADDB45304F44443EBB56D1459EB69A984C771

Function 022655D0 Relevance: 4.8, APIs: 3, Instructions: 325
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0226564A
VirtualFree.KERNELBASE(00000000,00000000,0000C000), ref: 0226598E
RtlExitUserProcess.NTDLL(00000000), ref: 02265997

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID: Virtual$AllocExitFreeProcessUser
String ID:
API String ID: 1828502597-0
Opcode ID: 913584bddb567b179a3f9b4e0e6654d789e61ea3d5744fe4b2293047c08ef92d
Instruction ID: 3e655dafbd40e737ad2630b9b5114aabdb39332ba742fd2416a23570ec038002
Opcode Fuzzy Hash: 913584bddb567b179a3f9b4e0e6654d789e61ea3d5744fe4b2293047c08ef92d
Instruction Fuzzy Hash: D0B1CF33521703EBDB319EE08C88BB7B7E9FF05314F940529E58996158E731E5A0CBA1

Function 0226697E Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(00000000,?,?), ref: 02266A10

Strings

.dll, xrefs: 022669B5

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: .dll
API String ID: 1029625771-2738580789
Opcode ID: f6f06f52cd4a024ca790678b75224790e8b38e6a55f670a1ffdfea5ea75d1fe1
Instruction ID: 129cc4497c9300d3bd245b1e917cc6048523c44d74682797e63d2994a86c96c0
Opcode Fuzzy Hash: f6f06f52cd4a024ca790678b75224790e8b38e6a55f670a1ffdfea5ea75d1fe1
Instruction Fuzzy Hash: 2721D2336252869FDB25CFE8D848B7ABBA8AF05224F18416DD8419BA45D739EC85C740

Function 0226485B Relevance: 3.0, APIs: 2, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0226697E: LoadLibraryA.KERNELBASE(00000000,?,?), ref: 02266A10

VirtualProtect.KERNELBASE(00000000,00000004,00000040,?), ref: 02264893
VirtualProtect.KERNELBASE(00000000,00000004,?,?), ref: 022648B6

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: 31a2c6fb5a155253d75781cd9ceba9c7cc267d2f06376007566f6440306b8afe
Instruction ID: 072e0c286f2d74822e991df58b532f188201c20a1a69741690b4b9f15c4ba0f2
Opcode Fuzzy Hash: 31a2c6fb5a155253d75781cd9ceba9c7cc267d2f06376007566f6440306b8afe
Instruction Fuzzy Hash: 38F0D1B31202447EE220AAE0CC05FFB37ECDF45600F400428FB46D6080EB65E680C7A1

Non-executed Functions

Function 022233E8 Relevance: 103.2, Strings: 81, Instructions: 1908COMMON

Download Yara Rule

Strings

L, xrefs: 02224166
;, xrefs: 022249F3
g, xrefs: 02224CE4
z, xrefs: 022244DF
D, xrefs: 02224E8B
m, xrefs: 022236BC
0, xrefs: 02224697
A, xrefs: 02224C44
<, xrefs: 022246A7
X, xrefs: 02224C64
W, xrefs: 02224A73
[, xrefs: 022246FF
h, xrefs: 02224CB4
#, xrefs: 02224296
}, xrefs: 022238B3
}, xrefs: 02223964
D, xrefs: 022250F3
q, xrefs: 022237C8
J, xrefs: 02224156
8, xrefs: 02224677
j, xrefs: 022246E7
>, xrefs: 022249C3
3, xrefs: 02223DCA
", xrefs: 02224278
w, xrefs: 02224D74
d, xrefs: 022240AB
6, xrefs: 02224A23
W, xrefs: 02224C74
S, xrefs: 02223AF0
h, xrefs: 0222408B
d, xrefs: 0222486D
], xrefs: 022246CF
", xrefs: 022249A3
@, xrefs: 02224146
", xrefs: 02224A33
^, xrefs: 02224C84
(, xrefs: 022246C7
`, xrefs: 022243C6
a, xrefs: 02223626
t, xrefs: 02223449
`, xrefs: 022236C1
e, xrefs: 02224872
9, xrefs: 02223E4E
Y, xrefs: 022246EF
3, xrefs: 02224943
:, xrefs: 02223E53
U, xrefs: 02224C54
], xrefs: 02224C94
E, xrefs: 0222468F
G, xrefs: 0222469F
u, xrefs: 02224D84
m, xrefs: 022246D7
n, xrefs: 02224282
!, xrefs: 02224A13
A, xrefs: 022244DA
8, xrefs: 02224903
B, xrefs: 02224C24
1, xrefs: 02224973
>, xrefs: 022249D3
\, xrefs: 02224A43
[, xrefs: 02224C34
i, xrefs: 02223536
K, xrefs: 0222467F
;, xrefs: 02223E58
,, xrefs: 02224953
|, xrefs: 02224CF4
Z, xrefs: 02224877
C, xrefs: 022246BF
x, xrefs: 02224D54
g, xrefs: 02224D44
=, xrefs: 0222407B
c, xrefs: 0222428C
3, xrefs: 02224963
Z, xrefs: 022246F7
z, xrefs: 02223531
A, xrefs: 022246AF
k, xrefs: 02224D04
_, xrefs: 022246DF
, xrefs: 02223743
6, xrefs: 022246B7
V, xrefs: 02224CA4

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: $!$"$"$"$#$($,$0$1$3$3$3$6$6$8$8$9$:$;$;$<$=$>$>$@$A$A$A$B$C$D$D$E$G$J$K$L$S$U$V$W$W$X$Y$Z$Z$[$[$\$]$]$^$_$`$`$a$c$d$d$e$g$g$h$h$i$j$k$m$m$n$q$t$u$w$x$z$z$|$}$}
API String ID: 0-4160516955
Opcode ID: 5cb2b2cafd6755493b88c3331a7c43df45eb58a6300e302f2a16af4dbd397ce7
Instruction ID: d91b917a0ca36d1bf279d09b3897c0f80997ca7719f8392d36646cad0913fe74
Opcode Fuzzy Hash: 5cb2b2cafd6755493b88c3331a7c43df45eb58a6300e302f2a16af4dbd397ce7
Instruction Fuzzy Hash: D403CE3152C7D19AD334DB78884439FBBE1AB96324F088A6DE4E9873D5C7B98449CB43

Function 0222E368 Relevance: 83.7, Strings: 66, Instructions: 1193COMMON

Download Yara Rule

Strings

b, xrefs: 0222E5DB
0, xrefs: 0222EF12
., xrefs: 0222EA03
%, xrefs: 0222E5B8
:, xrefs: 0222E873
b, xrefs: 0222E8FB
&, xrefs: 0222E5C2
], xrefs: 0222E97B
X, xrefs: 0222E993
?, xrefs: 0222EF0D
b, xrefs: 0222E75B
$, xrefs: 0222E5C7
0, xrefs: 0222E8B3
>, xrefs: 0222EF08
A, xrefs: 0222E95B
:, xrefs: 0222E5EA
n, xrefs: 0222E943
R, xrefs: 0222E923
R, xrefs: 0222E700
f, xrefs: 0222E8D3
Y, xrefs: 0222E728
Q, xrefs: 0222E883
P, xrefs: 0222E893
D, xrefs: 0222E85B
H, xrefs: 0222E8CB
\, xrefs: 0222E9B3
S, xrefs: 0222E91B
_, xrefs: 0222E8BB
G, xrefs: 0222F3DB
q, xrefs: 0222E84B
f, xrefs: 0222E8DB
E, xrefs: 0222E9CB
P, xrefs: 0222E9C3
c, xrefs: 0222E5E5
A, xrefs: 0222E93B
s, xrefs: 0222E903
H, xrefs: 0222E9DB
., xrefs: 0222EA0B
N, xrefs: 0222E9AB
G, xrefs: 0222E8EB
[, xrefs: 0222E8F3
J, xrefs: 0222E9D3
R, xrefs: 0222E963
\, xrefs: 0222E88B
[, xrefs: 0222E8A3
_, xrefs: 0222E98B
O, xrefs: 0222E94B
H, xrefs: 0222E90B
7, xrefs: 0222EA23
}, xrefs: 0222E833
&, xrefs: 0222E5BD
a, xrefs: 0222E5E0
J, xrefs: 0222E96B
P, xrefs: 0222E9BB
z, xrefs: 0222E973
V, xrefs: 0222E8E3
/, xrefs: 0222E863
P, xrefs: 0222E87B
8, xrefs: 0222E5D6
H, xrefs: 0222E983
d, xrefs: 0222E89B
-, xrefs: 0222EF03
T, xrefs: 0222E8AB
,, xrefs: 0222EA1B
u, xrefs: 0222E9E3
, xrefs: 0222EA13

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: $$$%$&$&$,$-$.$.$/$0$0$7$8$:$:$>$?$A$A$D$E$G$G$H$H$H$H$J$J$N$O$P$P$P$P$Q$R$R$R$S$T$V$X$Y$[$[$\$\$]$_$_$a$b$b$b$c$d$f$f$n$q$s$u$z$}
API String ID: 0-3743354863
Opcode ID: 4b6c9f38657fedcb7e7c6a6a2fc1027f769ddcf3984a63c958d800a384496369
Instruction ID: 96a7647a0070ed4dd04537939c8a54e5aea462e7ad06c720322c115c09a5fefe
Opcode Fuzzy Hash: 4b6c9f38657fedcb7e7c6a6a2fc1027f769ddcf3984a63c958d800a384496369
Instruction Fuzzy Hash: CFB2EE3161C7D18BC3358A7C884039EBBE2ABD6224F094B6DE4E98B3D5D7B59809C753

Function 022345DF Relevance: 69.1, Strings: 55, Instructions: 394COMMON

Download Yara Rule

Strings

;, xrefs: 02234718
+, xrefs: 02234710
{, xrefs: 022345F2
#, xrefs: 02234738
m, xrefs: 022346BC
O, xrefs: 02234A61
W, xrefs: 022346E4
y, xrefs: 0223468C
I, xrefs: 02234A53
w, xrefs: 02234600
#, xrefs: 02234728
M, xrefs: 02234A6F
Q, xrefs: 02234AB5
:, xrefs: 02234720
8, xrefs: 02234A1B
,, xrefs: 022349B9
`, xrefs: 02234615
m, xrefs: 02234714
", xrefs: 02234730
", xrefs: 02234708
1, xrefs: 0223473C
O, xrefs: 02234A99
v, xrefs: 02234638
, xrefs: 0223472C
,, xrefs: 0223499D
(, xrefs: 02234607
7, xrefs: 0223470C
~, xrefs: 02234631
c, xrefs: 02234B25
., xrefs: 022346FC
., xrefs: 022349AB
P, xrefs: 02234ADF
^, xrefs: 022346F8
X, xrefs: 02234AED
I, xrefs: 022346E0
`, xrefs: 022345F9
!, xrefs: 02234700
^, xrefs: 02234B09
t, xrefs: 0223462A
~, xrefs: 0223463F
H, xrefs: 02234AA7
#, xrefs: 0223480A
t, xrefs: 02234654
g, xrefs: 02234623
r, xrefs: 0223465B
1, xrefs: 02234740
<, xrefs: 022349F1
+, xrefs: 022345EB
I, xrefs: 02234C20
, xrefs: 02234734
?, xrefs: 02234724
N, xrefs: 022346DC
2, xrefs: 02234A37
;, xrefs: 02234A0D
], xrefs: 02234AD1

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: $ $!$"$"$#$#$#$($+$+$,$,$.$.$1$1$2$7$8$:$;$;$<$?$H$I$I$I$M$N$O$O$P$Q$W$X$]$^$^$`$`$c$g$m$m$r$t$t$v$w$y${$~$~
API String ID: 0-2443450857
Opcode ID: d38c60a90824ad46133972e7c4cbed06e95cef7b7f0db34d98dc1f8cdee652d2
Instruction ID: ddf71bd55ff2a7ae3bd5ea40f0736db20f802104d5b1ba53b5f5dcef80e49478
Opcode Fuzzy Hash: d38c60a90824ad46133972e7c4cbed06e95cef7b7f0db34d98dc1f8cdee652d2
Instruction Fuzzy Hash: 8922FC1191C7EAC9DB32C67C9C487CDBFA11B23224F0847D9D4E86B2D6D7750A86CB62

Function 02236A94 Relevance: 35.4, Strings: 28, Instructions: 433COMMON

Download Yara Rule

Strings

`g, xrefs: 02236E6F
$, xrefs: 02236A95
(X6^, xrefs: 022372DF
|,X2, xrefs: 02237266
-tz, xrefs: 02237188
2{<u, xrefs: 02236C02
rp, xrefs: 02236CF9
U\, xrefs: 02236E64
T8e>, xrefs: 02237287
4~|, xrefs: 02236FBC
.H>N, xrefs: 022372B3
8>, xrefs: 02237547
x~, xrefs: 02237497
7w, xrefs: 02236C0D
K4l:, xrefs: 022370D8
o<KB, xrefs: 02237292
tj, xrefs: 022374B8
G0]6, xrefs: 02237271
!h#n, xrefs: 0223730B
.D)J, xrefs: 022372A8
T`Zf, xrefs: 022372F5
)p*v, xrefs: 0223717D
&P%V, xrefs: 022372C9
;T&Z, xrefs: 022372D4
BpFv, xrefs: 02237321
{x, xrefs: 02237193
Rd"j, xrefs: 02237300
_lYr, xrefs: 02237316

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: !h#n$$$&P%V$(X6^$)p*v$-tz$.D)J$.H>N$2{<u$4~|$7w$;T&Z$BpFv$G0]6$K4l:$Rd"j$T8e>$T`Zf$U\$_lYr$`g$o<KB${x$|,X2$8>$rp$tj$x~
API String ID: 0-2721255210
Opcode ID: 1b2c9cd0342a9e47e3d44aab4ca0d67673ff476f0f2922c19ef01971a6907c39
Instruction ID: 68b0d3cdebd51f46e14626e621508d655322169f5725a024fb2be590b2f47f1b
Opcode Fuzzy Hash: 1b2c9cd0342a9e47e3d44aab4ca0d67673ff476f0f2922c19ef01971a6907c39
Instruction Fuzzy Hash: C532F9B160D3D48AD334CF54C442BDFBAF2EB92304F00892CC5D96B256D7B6564A8B9B

Function 0224C768 Relevance: 22.9, Strings: 18, Instructions: 366COMMON

Download Yara Rule

Strings

J, xrefs: 0224CA2D
_, xrefs: 0224CA32
!, xrefs: 0224CA37
Y, xrefs: 0224C843
8, xrefs: 0224C9DE
X, xrefs: 0224C77C
[, xrefs: 0224C839
*, xrefs: 0224C9E8
6cxU, xrefs: 0224C7C0
6cxU, xrefs: 0224C882
c, xrefs: 0224CAFB
X, xrefs: 0224C83E
Y, xrefs: 0224C781
6cxU, xrefs: 0224C889
6cxU, xrefs: 0224C7C7
6, xrefs: 0224C9E3
[, xrefs: 0224C777
kyeE, xrefs: 0224C97A

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: !$*$6$6cxU$6cxU$6cxU$6cxU$8$J$X$X$Y$Y$[$[$_$c$kyeE
API String ID: 0-79597815
Opcode ID: fbbbd6998d66d1ff913caef885f0d1f43bf92717102f9addf7045befe193c24d
Instruction ID: 8e6589694956e96f4713d72a9fa3928135f7a9b317d67b22a8cf7b9e7ceba5d1
Opcode Fuzzy Hash: fbbbd6998d66d1ff913caef885f0d1f43bf92717102f9addf7045befe193c24d
Instruction Fuzzy Hash: 64C15A3362DB914BD31988BC8C9425BEEC307E6134F1D877DD8F5973C6D9A989068392

Function 02235866 Relevance: 10.2, Strings: 8, Instructions: 241COMMON

Download Yara Rule

Strings

<QrS, xrefs: 02235BD3
H%Z', xrefs: 02235BBB
O-O/, xrefs: 02235BCB
4Y>[, xrefs: 02235BE3
Y1\3, xrefs: 02235B93
d)E+, xrefs: 02235BC3
P5Y7, xrefs: 02235B9B
A!K#, xrefs: 02235BB3

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: 4Y>[$<QrS$A!K#$H%Z'$O-O/$P5Y7$Y1\3$d)E+
API String ID: 0-1137044552
Opcode ID: db664d97611cd2b0ea31a962eb31bb62c560aebccfa291759c0dfe4ae8306fa6
Instruction ID: 119f62e08de1ebaa8c5006e8424a93c4ec48d33f0f40d4eeea703bf875d2acd9
Opcode Fuzzy Hash: db664d97611cd2b0ea31a962eb31bb62c560aebccfa291759c0dfe4ae8306fa6
Instruction Fuzzy Hash: DC71CCB0518351DBC724CF94D88126BFBF1EF9A354F848A2DE8E95B354E3789905CB82

Function 02250748 Relevance: 8.1, Strings: 6, Instructions: 616COMMON

Download Yara Rule

Strings

6G01, xrefs: 0225084E, 02250890
6G01, xrefs: 022507C8
f, xrefs: 022509F2
[XX^, xrefs: 0225093F, 022509AF
S"(w, xrefs: 02250868
S"(w, xrefs: 02250ABB

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: 6G01$6G01$S"(w$S"(w$[XX^$f
API String ID: 0-3115683409
Opcode ID: 348f023ca78b2a33b92335d9a1234e2a1b6113961118bb4496a79888e6f44e23
Instruction ID: 2dd79d61247438e87766f6c9739261f83ccdd05ddc35f5b5941bee6363d4e4b3
Opcode Fuzzy Hash: 348f023ca78b2a33b92335d9a1234e2a1b6113961118bb4496a79888e6f44e23
Instruction Fuzzy Hash: 302215716283528FC324CF58C880B6EBBE2EBC9314F15C62CE8A557395D771DA46CB92

Function 02231D08 Relevance: 6.7, Strings: 5, Instructions: 435COMMON

Download Yara Rule

Strings

y, xrefs: 02232216
~, xrefs: 02232220
}, xrefs: 0223221B
,, xrefs: 02232186
!@, xrefs: 02231D3B

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: !@$,$y$}$~
API String ID: 0-3044378546
Opcode ID: 24f79ce7ec7ede984511a7683478084d7a1d94fa8b0057a537d58610d9033e05
Instruction ID: 7b690885d949be0b5178f7d1f281874d34bc5f9adb8635deec67bd2d903d69db
Opcode Fuzzy Hash: 24f79ce7ec7ede984511a7683478084d7a1d94fa8b0057a537d58610d9033e05
Instruction Fuzzy Hash: 5A028DB052C741CFD3258FA8C85036EBBE1AB85314F548A2DE9E9873D9D7B58845CB42

Function 0221C1D8 Relevance: 6.7, Strings: 5, Instructions: 422COMMON

Download Yara Rule

Strings

C|, xrefs: 0221C2C8
WR, xrefs: 0221C40A
<, xrefs: 0221C2C0
~Bzx, xrefs: 0221C1EA
~|, xrefs: 0221C2D0

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: <$C|$WR$~Bzx$~|
API String ID: 0-1711356705
Opcode ID: 42a10b6da1222523d84042899d75f0fbff551e0a26b14e01256eb7c536352f42
Instruction ID: 00a1083970138f03ee66ed5cecc19287997b578bc937c222dc973d67bf6476a4
Opcode Fuzzy Hash: 42a10b6da1222523d84042899d75f0fbff551e0a26b14e01256eb7c536352f42
Instruction Fuzzy Hash: 95D19B7A69C3514BD318CF69885167FBBE3ABD2204F18892DE4D59B348C775C90AC783

Function 0221AA88 Relevance: 6.6, Strings: 5, Instructions: 382COMMON

Download Yara Rule

Strings

R, xrefs: 0221AD8E
}UW^, xrefs: 0221AB38
C]E[, xrefs: 0221AE36
IIMC, xrefs: 0221ABCB
uP, xrefs: 0221ABEB

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: C]E[$IIMC$R$uP$}UW^
API String ID: 0-892063760
Opcode ID: 205ed248482d7a065e056c637e6f518a5e6eb8ae255233571312f867963e7cbf
Instruction ID: ecb5682e6117f0bd48868cadd53f687039ce42fa2141e131a53511297ed283d5
Opcode Fuzzy Hash: 205ed248482d7a065e056c637e6f518a5e6eb8ae255233571312f867963e7cbf
Instruction Fuzzy Hash: 5BB1067164D3928BC3268F6984A0B6FFFE09FD3654F484A6CE4D51B386C335850AC796

Function 0040457C Relevance: 5.8, APIs: 1, Strings: 2, Instructions: 524COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,-99787499,1E07590D,4329389B,00000000,0040438A,?,?,?,?,?,00409C33), ref: 00404AC2

Strings

kern, xrefs: 00404AB1
kern, xrefs: 00404CF4

Memory Dump Source

Source File: 00000000.00000002.2340148518.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2340128450.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340169182.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340169182.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340208145.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XhlpAnBmIk.jbxd

Similarity

API ID: HandleModule
String ID: kern$kern
API String ID: 4139908857-3359943942
Opcode ID: 2343751324510ea23b8c8072873af1769c23cfc3b1e5a9e07ffe1f8a192e5e8a
Instruction ID: 1f685506abdaa817ab97e40362920b16cc3ec0ba4b057b289ae36d9b3e896674
Opcode Fuzzy Hash: 2343751324510ea23b8c8072873af1769c23cfc3b1e5a9e07ffe1f8a192e5e8a
Instruction Fuzzy Hash: 0602E373D143248FD708EF76EE9656933A2FB80308346853EE542B76A6DB3855418ACE

Function 022323D8 Relevance: 5.5, Strings: 4, Instructions: 470COMMON

Download Yara Rule

Strings

2$76, xrefs: 0223249D
_\], xrefs: 0223259E
745:2$76, xrefs: 022324CC
p@, xrefs: 022327EE

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: 2$76$745:2$76$_\]$p@
API String ID: 0-2055486527
Opcode ID: 8b739f0aadc3fc91c1b2ac1539c3a718c0ad65865adbdb4aedbddadf997ebabb
Instruction ID: 0468d50916a76afaf476115a96a3853d0573e62cb15af9ec9b448fb31204faeb
Opcode Fuzzy Hash: 8b739f0aadc3fc91c1b2ac1539c3a718c0ad65865adbdb4aedbddadf997ebabb
Instruction Fuzzy Hash: FFD1ADB16283418FD714CFA4C8A1BABBBE1FF85314F04892CE99597381E7B5E845CB52

Function 02241060 Relevance: 5.4, Strings: 4, Instructions: 394COMMON

Download Yara Rule

Strings

$&?3, xrefs: 02241297
99C?, xrefs: 022413CF
;(?>, xrefs: 022413C8
0-/?, xrefs: 0224129E

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: $&?3$0-/?$99C?$;(?>
API String ID: 0-2409071036
Opcode ID: c3d1be89028db4a1f2c2333a608d2b5e78d7535835fec0e3064d115d6cb41594
Instruction ID: 30eba05ae3df6d2ed7a299a031451b4196d6d42df9042f81c547f42f26e79694
Opcode Fuzzy Hash: c3d1be89028db4a1f2c2333a608d2b5e78d7535835fec0e3064d115d6cb41594
Instruction Fuzzy Hash: B6D15CB48007419FD724EF39C586756BFF0EB02300F544A9ED8EA4B78AD734A45ACB92

Function 0221EF58 Relevance: 5.3, Strings: 4, Instructions: 329COMMON

Download Yara Rule

Strings

TC03, xrefs: 0221F025
;d, xrefs: 0221F179
^_/C, xrefs: 0221F01E
SD, xrefs: 0221F180

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: ;d$SD$TC03$^_/C
API String ID: 0-3729532250
Opcode ID: 2812e617d036c375e3da603f544641752ab874253ccd01004949b5816314b26e
Instruction ID: 907daa095f48a617d9c6430c03d10e95264f8239cf63fc8c5dbc60b24e4424a3
Opcode Fuzzy Hash: 2812e617d036c375e3da603f544641752ab874253ccd01004949b5816314b26e
Instruction Fuzzy Hash: 89A13AB52047928FD729CF35C5A0665BFE1FFA3314B28819CC0E64BB4AC739A406CB95

Function 0221A778 Relevance: 5.3, Strings: 4, Instructions: 299COMMON

Download Yara Rule

Strings

MP, xrefs: 0221A7DA
", xrefs: 0221A890
`]0o, xrefs: 0221A868
mooj, xrefs: 0221A858

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: "$MP$`]0o$mooj
API String ID: 0-750224902
Opcode ID: b1852bd034d5f07e6c7418944058fbcc2db243f872094cebdf7b16bddf70df29
Instruction ID: 62d52aae2aac7671ad73af82b7981bd6ba854506c40767fa29c3d6cc70a2a765
Opcode Fuzzy Hash: b1852bd034d5f07e6c7418944058fbcc2db243f872094cebdf7b16bddf70df29
Instruction Fuzzy Hash: A17139215093928AD712CF29C49077BFFE19FA3344F1889AED4D59B38BC739854AC762

Function 0222C71E Relevance: 4.1, Strings: 3, Instructions: 312COMMON

Download Yara Rule

Strings

YF, xrefs: 0222C993
>j%h, xrefs: 0222C9AD
]Z, xrefs: 0222C7C4

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: >j%h$YF$]Z
API String ID: 0-4187760579
Opcode ID: 2b05d0f14d0d6e5591c68a104f4f511412e46e2e0091bcfa594d04fdcead0a9b
Instruction ID: 530c715c3140aadd900deccefbbdfacb3ab4811646f7107146175a496a7792bb
Opcode Fuzzy Hash: 2b05d0f14d0d6e5591c68a104f4f511412e46e2e0091bcfa594d04fdcead0a9b
Instruction Fuzzy Hash: ED8144B0A183119BC7149F68C8A136FB3F1EF81314F49C91DE8D69B385E3B98505C74A

Function 02227AA7 Relevance: 4.1, Strings: 3, Instructions: 310COMMON

Download Yara Rule

Strings

[T, xrefs: 02227C7C
PS, xrefs: 02227C83
LH, xrefs: 02227C75

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: LH$PS$[T
API String ID: 0-1629221622
Opcode ID: a3e1f9736eed060c3fa966c10d1dea8dc1f709a6b253d1cf9a7cd6a57d747b48
Instruction ID: a4e3617e4af9a7fc1cf838b5bb6fdb0176e349064d4d4583d01f93e7088ebdbd
Opcode Fuzzy Hash: a3e1f9736eed060c3fa966c10d1dea8dc1f709a6b253d1cf9a7cd6a57d747b48
Instruction Fuzzy Hash: EB9135716147128BD324CF25C992363B7B2FF85314F2994ADC8864F7A5D73AA807CB50

Function 0222AFD8 Relevance: 4.0, Strings: 3, Instructions: 239COMMON

Download Yara Rule

Strings

qp, xrefs: 0222B0BE
Nw, xrefs: 0222B0B6
4, xrefs: 0222B0C6

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: 4$Nw$qp
API String ID: 0-4265586298
Opcode ID: 07ee0dda83b10c6babdba6f7f560729ff036302cd3f30b88450a197e3d0d674c
Instruction ID: 3bb007569cdcb3749723121b9f58c0ae887dfa15a36428bead096b5cd4ffcbfc
Opcode Fuzzy Hash: 07ee0dda83b10c6babdba6f7f560729ff036302cd3f30b88450a197e3d0d674c
Instruction Fuzzy Hash: 2E614A729183618BC72CCF29C8513BBB7E1EFC6314F094A6DE9D69B294D7798805C782

Function 0222AD38 Relevance: 4.0, Strings: 3, Instructions: 230COMMON

Download Yara Rule

Strings

}, xrefs: 0222ADB3
0, xrefs: 0222AD8A
~, xrefs: 0222ADB8

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: 0$}$~
API String ID: 0-1378824556
Opcode ID: 884f6f9cf58a5a59d449aea1ec521a8ac50cc9cc68e7f295d775d02287a41394
Instruction ID: 027a2275d0c7a85335f7a08934bf3b31a8f6cd990c195465b18f451d1abfa039
Opcode Fuzzy Hash: 884f6f9cf58a5a59d449aea1ec521a8ac50cc9cc68e7f295d775d02287a41394
Instruction Fuzzy Hash: 85715F33B2DAA45BC718C9BC4C112A97A534BD7230F1CC3BDD9B5973D9D9AA4C098381

Function 0223FE8A Relevance: 3.9, Strings: 3, Instructions: 189COMMON

Download Yara Rule

Strings

khvr, xrefs: 0223FFDE
)2^, xrefs: 0223FF88
|lx1, xrefs: 0223FFE5

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: )2^$khvr$|lx1
API String ID: 0-2191243274
Opcode ID: e0043f7c070bd71afc432f3349eebb0a5253881f2526b2449ca6c403794a358b
Instruction ID: 4de9cfb4cce851d724b6e42ab37f35ff2fd3b0ffee911300455c8b31c6c6a39d
Opcode Fuzzy Hash: e0043f7c070bd71afc432f3349eebb0a5253881f2526b2449ca6c403794a358b
Instruction Fuzzy Hash: AB414774515782CBD71A8F7AC5A0771BBA2AF5B304F1885ACC4C3DB39ACB39A446CB14

Function 02239E83 Relevance: 3.9, Strings: 3, Instructions: 107COMMON

Download Yara Rule

Strings

.D)z, xrefs: 02239F50
7@7F, xrefs: 02239F49
6L:B, xrefs: 02239F42

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: .D)z$6L:B$7@7F
API String ID: 0-1054234650
Opcode ID: 1acc238c7ea912079cd8e851d5e9fdcf69ca3467f2d8d33a48e05f11496af54d
Instruction ID: e02811f8b36d152ee891170bf99caf34944ddd4f0223bef91449e3e1b84cecef
Opcode Fuzzy Hash: 1acc238c7ea912079cd8e851d5e9fdcf69ca3467f2d8d33a48e05f11496af54d
Instruction Fuzzy Hash: D941A9F4E10756ABC710CFAACA85199BF70FF06310B64922DD4546BB08D33AA062CFD5

Function 00409420 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000,00000000,SeShutdownPrivilege), ref: 00409475

Strings

SeShutdownPrivilege, xrefs: 00409447

Memory Dump Source

Source File: 00000000.00000002.2340148518.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2340128450.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340169182.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340169182.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340208145.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XhlpAnBmIk.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID: SeShutdownPrivilege
API String ID: 2874748243-3733053543
Opcode ID: f3cc37a1b4d9e5a2598b2c7913c69b94567c892d5ed28c5b10f7773e08e168bb
Instruction ID: 1fc3554a8dc1f29b0292fabda2083ca89024c973c65bb30774c19f74add59f7f
Opcode Fuzzy Hash: f3cc37a1b4d9e5a2598b2c7913c69b94567c892d5ed28c5b10f7773e08e168bb
Instruction Fuzzy Hash: 9CF012B068830275E620EAB58C07F6B62985BC4B58F50493EBA55FA1C3D7BCD805466F

Function 02229F58 Relevance: 3.4, Strings: 2, Instructions: 893COMMON

Download Yara Rule

Strings

fg$, xrefs: 02229FDD
^_, xrefs: 0222A27A

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: ^_$fg$
API String ID: 0-722828377
Opcode ID: d85e9e83ea640c257f6531e8fb9b0d5529058831f55591611b60998b19f6d1d8
Instruction ID: 10d423fb6d560c178adab40b388cf9a1897401b64a0777c4ca8ec8f7a225ff1c
Opcode Fuzzy Hash: d85e9e83ea640c257f6531e8fb9b0d5529058831f55591611b60998b19f6d1d8
Instruction Fuzzy Hash: 6C623670628352AFD724CF69CC4076BB7E2EFC5314F148A2CE595576A8E372D849CB82

Function 0224D078 Relevance: 3.4, Strings: 2, Instructions: 851COMMON

Download Yara Rule

Strings

qn, xrefs: 0224D598
./, xrefs: 0224D68E

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: ./$qn
API String ID: 0-3823645636
Opcode ID: 668406d8b88442255c7392c9cd83faa7d6d5703eb8d5a977212719c6739b98c7
Instruction ID: 8e7d9e81653e154098e842c7431fe1a37303227777368cec4f3cfe70464abf6f
Opcode Fuzzy Hash: 668406d8b88442255c7392c9cd83faa7d6d5703eb8d5a977212719c6739b98c7
Instruction Fuzzy Hash: 9E520072A183518FD728CF68C8507ABBBE2EFC6714F14892DE5C59B394DB749805CB82

Function 022164C8 Relevance: 3.3, Strings: 2, Instructions: 792COMMON

Download Yara Rule

Strings

0, xrefs: 02216DE3
8, xrefs: 02216DDB

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 6c0d5d3be257b6a3fd1de638671c8b12e5484a8c530135887e69e884293760cf
Instruction ID: b42ac6024aa354a712a0e01c81edce250da03542fbb80f5191a2210562b005a2
Opcode Fuzzy Hash: 6c0d5d3be257b6a3fd1de638671c8b12e5484a8c530135887e69e884293760cf
Instruction Fuzzy Hash: D47253715183419FD720CF58C880BAEBBE5AF98318F44892DF9898B395C375D958CF92

Function 02230FD8 Relevance: 3.0, Strings: 2, Instructions: 527COMMON

Download Yara Rule

Strings

LMB, xrefs: 022310B7
pv, xrefs: 0223105F

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: LMB$pv
API String ID: 0-122907696
Opcode ID: 600361d03a19618f7b8b94130096601f70c9cb3cba6cb4618556b265baeca412
Instruction ID: f20fa1dc03ebe740d00b87b4a567eeec106990d85d0e9cc78bab895cdf92f837
Opcode Fuzzy Hash: 600361d03a19618f7b8b94130096601f70c9cb3cba6cb4618556b265baeca412
Instruction Fuzzy Hash: C3E145B15283118BD728DF69C85236BB7F1FFC2314F09891CE5869B394E7799805CB46

Function 0223E568 Relevance: 3.0, Strings: 2, Instructions: 512COMMON

Download Yara Rule

Strings

", xrefs: 0223E9A6
", xrefs: 0223EA18

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: "$"
API String ID: 0-3758156766
Opcode ID: b07952227d8657c70647f12afd6039f58e3d334232c99a160f9b339d411ffc2b
Instruction ID: 7eed7730034c66963197a90ca88002750145db0bb08ca2e65a6df24590e155b3
Opcode Fuzzy Hash: b07952227d8657c70647f12afd6039f58e3d334232c99a160f9b339d411ffc2b
Instruction Fuzzy Hash: C3F14CF2A283118FD716CEA4C48079BB7D6AFC4314F0A896DE89587395D774D80CCB82

Function 0222CAC8 Relevance: 2.9, Strings: 2, Instructions: 440COMMON

Download Yara Rule

Strings

45, xrefs: 0222CE2A
uw, xrefs: 0222CB6F

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: 45$uw
API String ID: 0-851133776
Opcode ID: ab637dcdc1d75d2e8c1a6476f08b4d58cc792c803b02a06a08f3a248bcfca3ae
Instruction ID: ef5fe2e2aa2cb795f21cac1b3aa6b5077c7d8ded7472cb6298ee00cec2eb3de6
Opcode Fuzzy Hash: ab637dcdc1d75d2e8c1a6476f08b4d58cc792c803b02a06a08f3a248bcfca3ae
Instruction Fuzzy Hash: FAC121B15283118BC718CF28C85276FB3F1EF86310F0A892DE8968B390E779D909C752

Function 0223F7AD Relevance: 2.9, Strings: 2, Instructions: 437COMMON

Download Yara Rule

Strings

'5%s, xrefs: 022406E7
$qk, xrefs: 02240600

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: $qk$'5%s
API String ID: 0-1674721824
Opcode ID: 756eda49438ed6f715e4a2a56022fc783d197dac7b59b75270c18a3458952d0e
Instruction ID: 4cc9b4aa6da542346d9b506450fef634619567fc6efc131b9446fdfa2ac2441e
Opcode Fuzzy Hash: 756eda49438ed6f715e4a2a56022fc783d197dac7b59b75270c18a3458952d0e
Instruction Fuzzy Hash: F7D103716147428FD72DCF29C490762FBE2EF96200B2CC5ADC4DA8B756DB79A442CB50

Function 0221AE68 Relevance: 2.9, Strings: 2, Instructions: 375COMMON

Download Yara Rule

Strings

JO}, xrefs: 0221B048
no, xrefs: 0221B180

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: JO}$no
API String ID: 0-1394444436
Opcode ID: 2dfd4d0383cadca2cae1fbc9fcdd2193fbb587bea3ba498617e60247ac0bf5c6
Instruction ID: 8afed65702c4e178eadb4aef5ef5a8e829ce441ae33ef8f2ef29d26adea0898d
Opcode Fuzzy Hash: 2dfd4d0383cadca2cae1fbc9fcdd2193fbb587bea3ba498617e60247ac0bf5c6
Instruction Fuzzy Hash: 89C115B16183408BD718DF74D890AAFBBE6EFD2304F144A2DE5D28B291DB74C50ACB56

Function 02240598 Relevance: 2.9, Strings: 2, Instructions: 370COMMON

Download Yara Rule

Strings

'5%s, xrefs: 022406E7
$qk, xrefs: 02240600

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: $qk$'5%s
API String ID: 0-1674721824
Opcode ID: 4c7b881c96a4be9f1b9c585b43e2c14d7cd1363174d38c4307d0490ceea73aa2
Instruction ID: 92c7397394259eeb8ec275e875246e2342cfb8293ad9f15e2411449bcfd94b8d
Opcode Fuzzy Hash: 4c7b881c96a4be9f1b9c585b43e2c14d7cd1363174d38c4307d0490ceea73aa2
Instruction Fuzzy Hash: 0DB101B16147828FD71DCF29C450762FBE2AF96200F1CC5ADC4DA8B746DB39A546CB50

Function 0224DCD8 Relevance: 2.8, Strings: 2, Instructions: 349COMMON

Download Yara Rule

Strings

mij, xrefs: 0224DF69
NP,?, xrefs: 0224DEE8

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: NP,?$mij
API String ID: 0-1436015776
Opcode ID: 32edd598096961b7a1e9cd21a5037e7bfbbfcb0cb5fe29abcc1e634ef87fb66e
Instruction ID: 0f8dadcd4a2a009c41f5efef0a118721d6ea57071228fe160cdfd69f51164fef
Opcode Fuzzy Hash: 32edd598096961b7a1e9cd21a5037e7bfbbfcb0cb5fe29abcc1e634ef87fb66e
Instruction Fuzzy Hash: 5EA16B726143119BD728CF95888073FB7A2FF86714F55872CE9A52B298DB71E802CBD1

Function 02210000 Relevance: 2.8, Strings: 2, Instructions: 348COMMON

Download Yara Rule

Strings

1QsZ, xrefs: 02210511
v>M,, xrefs: 0221052F

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: 1QsZ$v>M,
API String ID: 0-364196341
Opcode ID: 4e610403cb1623ed475c861ab5063b438a0689f62ef82f69ba63fb4e3ab9fce0
Instruction ID: 035ad28efbc6678f23a3a2a6dabbd152097a1590a749808b144b5b0aa39c30ec
Opcode Fuzzy Hash: 4e610403cb1623ed475c861ab5063b438a0689f62ef82f69ba63fb4e3ab9fce0
Instruction Fuzzy Hash: DDE18C769003248FDB18CF76EE9569A7BB2FB80304F02826DC956BB665CB3416458FCD

Function 02215B98 Relevance: 2.8, Strings: 2, Instructions: 329COMMON

Download Yara Rule

Strings

IEND, xrefs: 02215F89
), xrefs: 02215C13

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: )$IEND
API String ID: 0-707183367
Opcode ID: dc7d0d6d934237c850a5b44cf0ffb38fdb6b1a249ae30cb4f64657c66714754e
Instruction ID: 87f2f740cbf875bbf1aa3ddda7ce71b2a5c07fa35044a483972ddd5666d662af
Opcode Fuzzy Hash: dc7d0d6d934237c850a5b44cf0ffb38fdb6b1a249ae30cb4f64657c66714754e
Instruction Fuzzy Hash: 87D1DFB15183449FDB20CF54C880B9BBBE5EBA4304F50492DF9999B385D3B5D918CB82

Function 02219B68 Relevance: 2.8, Strings: 2, Instructions: 288COMMON

Download Yara Rule

Strings

%=>?, xrefs: 02219CA8
(RD, xrefs: 02219E10

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: %=>?$(RD
API String ID: 0-3761482541
Opcode ID: e07febe003d47278271e69a6a0aefd5b767d6bdb8c9269540a4227fbb6a47e9b
Instruction ID: 51b86a1455d112a164c4f9e587fb58463e3af1ac07b7a35fff3f2df550c0b960
Opcode Fuzzy Hash: e07febe003d47278271e69a6a0aefd5b767d6bdb8c9269540a4227fbb6a47e9b
Instruction Fuzzy Hash: 1F919E32F183164BC310CE6CC99069AB7E2ABD5714F198A39E8D4D739DE238DD858BC1

Function 0222DC38 Relevance: 2.8, Strings: 2, Instructions: 273COMMON

Download Yara Rule

Strings

~, xrefs: 0222DCE2
}, xrefs: 0222DCDD

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: }$~
API String ID: 0-3846021004
Opcode ID: 1372fe1faa3213356ea37d011b0fe6f96b5a543017ec8f08801fdd0d73131f8c
Instruction ID: abe617ecb3a0a40653355a585739151e3fcc619a784a5eb105d94a719c18ba6f
Opcode Fuzzy Hash: 1372fe1faa3213356ea37d011b0fe6f96b5a543017ec8f08801fdd0d73131f8c
Instruction Fuzzy Hash: 1791473272EAA15BC718897C4C113AABE934BD3230F1DC37DE4F58B3DAD96988098351

Function 02227EC5 Relevance: 2.7, Strings: 2, Instructions: 244COMMON

Download Yara Rule

Strings

AtP, xrefs: 02227F02
GpFv, xrefs: 02227EFB

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: AtP$GpFv
API String ID: 0-4236438475
Opcode ID: 8aa9151458862fb57c123df3b33a7af73a6272534d29202287a33acae2e1af0f
Instruction ID: 5c97587c34b5e13fd4b780eaf6f77749d0140a517709139cee628a46f6497620
Opcode Fuzzy Hash: 8aa9151458862fb57c123df3b33a7af73a6272534d29202287a33acae2e1af0f
Instruction Fuzzy Hash: 9E810F752107128BCB28CF29C8A1767B3B2FF45324B19895DD8838BBA9E375F445CB45

Function 022450D8 Relevance: 2.7, Strings: 2, Instructions: 239COMMON

Download Yara Rule

Strings

~, xrefs: 0224517E
}, xrefs: 02245179

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: }$~
API String ID: 0-3846021004
Opcode ID: 9c651afb8884db2b8ed531508840d92c93680f60ef013fdbb885d5c65550ea95
Instruction ID: c76a285d49fe77a04f4e5f4e6bb7c9b97b09ed012544dd68c1a3347b5d785acb
Opcode Fuzzy Hash: 9c651afb8884db2b8ed531508840d92c93680f60ef013fdbb885d5c65550ea95
Instruction Fuzzy Hash: B871282662DAD14BD32D867C4C113AABE920FE3134F5CC76EE8F58B3E6D9D988018351

Function 02247A08 Relevance: 2.7, Strings: 2, Instructions: 234COMMON

Download Yara Rule

Strings

}, xrefs: 02247A91
~, xrefs: 02247A96

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: }$~
API String ID: 0-3846021004
Opcode ID: b89aeb8f7c5bc573797a562e5b9ad2442b0305510d530974ee3cfcaf6155a88d
Instruction ID: 708e5e261436ba6fc2e341a81f0120042b224132225104395be9be8033dd695e
Opcode Fuzzy Hash: b89aeb8f7c5bc573797a562e5b9ad2442b0305510d530974ee3cfcaf6155a88d
Instruction Fuzzy Hash: 4A712922729A904BD72C4D7C8C513AAFA834BC3234F1DC76EE5F58B3E5DAA989058341

Function 0223F877 Relevance: 2.6, Strings: 2, Instructions: 124COMMON

Download Yara Rule

Strings

fI.K, xrefs: 0224013B
M"O, xrefs: 02240142

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: M"O$fI.K
API String ID: 0-3473069917
Opcode ID: 80b5e25900e62fa5b7f868b9038989c12ce663ab15b6782b2becc0f24b60a991
Instruction ID: ba67d72d844c36710ed3a11ad89a0cc165590b203b301c2260ae633f88f6cf4d
Opcode Fuzzy Hash: 80b5e25900e62fa5b7f868b9038989c12ce663ab15b6782b2becc0f24b60a991
Instruction Fuzzy Hash: 493105751147828BE7198F698450332FBE2EFA3300F28959DC1D6AB396CB79A943CB54

Function 022400B3 Relevance: 2.6, Strings: 2, Instructions: 108COMMON

Download Yara Rule

Strings

fI.K, xrefs: 0224013B
M"O, xrefs: 02240142

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: M"O$fI.K
API String ID: 0-3473069917
Opcode ID: a50f177498f9f56b16f7faf9ec1f3eef4274cbe2d8e1a906e5367dc70dca7c59
Instruction ID: 0d77e40a4a8ff8c0466e152dba3db87f8dd5f2e3d3f7026d56c10fa9b378c7a1
Opcode Fuzzy Hash: a50f177498f9f56b16f7faf9ec1f3eef4274cbe2d8e1a906e5367dc70dca7c59
Instruction Fuzzy Hash: A431E0752047418BE719CF69C850732FBE2EF92310F29969CC596AF392CB79A8438B54

Function 02262A08 Relevance: 2.3, Strings: 1, Instructions: 1066COMMON

Download Yara Rule

Strings

@, xrefs: 02262B07

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 7d58ce99e14cd4456ae23e5809613514da7f6838dea5dcaaa26db1aac14b0b8b
Instruction ID: be2494af884899d37292cd2cf7abac4ea99263310c5b8b74d077c88cdab131b3
Opcode Fuzzy Hash: 7d58ce99e14cd4456ae23e5809613514da7f6838dea5dcaaa26db1aac14b0b8b
Instruction Fuzzy Hash: C372D531628B498FCB29DF68C8897B973E5FB98704F14466DD88AC7245DF34E582CB81

Function 02239318 Relevance: 1.7, Strings: 1, Instructions: 403COMMON

Download Yara Rule

Strings

klm", xrefs: 022393F9

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: klm"
API String ID: 0-2308819284
Opcode ID: 5ecadd6f7ec23193bce9450410173a0c4ee4496c18b207c1d03c5920547ecbaa
Instruction ID: 8e93c78e2bb623939b1f34e832692060390d72d3e032e126c5e46c87c24e2de0
Opcode Fuzzy Hash: 5ecadd6f7ec23193bce9450410173a0c4ee4496c18b207c1d03c5920547ecbaa
Instruction Fuzzy Hash: C6B19EF26243428FE7298FA8C85177BB7A1EF87310F15862CD84697389E3B4D885C791

Function 0222BE3C Relevance: 1.6, Strings: 1, Instructions: 324COMMON

Download Yara Rule

Strings

KtBD, xrefs: 0222C18D

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: KtBD
API String ID: 0-2371315874
Opcode ID: 6d1fb5ce0045cb9f34235038d5880c04dc3b93b51e3ba4dcd46ce03b2af1d0cd
Instruction ID: 4308bd891c2c466e9c46444eb8781b1109cecb87dae101d0f11b3e63786fbf73
Opcode Fuzzy Hash: 6d1fb5ce0045cb9f34235038d5880c04dc3b93b51e3ba4dcd46ce03b2af1d0cd
Instruction Fuzzy Hash: 99A179715583614FD718CF78C8507AFBBE2ABD6304F188A6CF1D29B289DB758509CB82

Function 0223F15B Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

FL~O, xrefs: 0223F29B

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: FL~O
API String ID: 0-2976162848
Opcode ID: 18649a1a29131128d5b4adce49bc42d5c1c1f33e7a2e72b95aa3a9eea7d687c0
Instruction ID: bab191da6669337631869d0a9cd7b118b8df83d79d689bc7c7a70f1accee5485
Opcode Fuzzy Hash: 18649a1a29131128d5b4adce49bc42d5c1c1f33e7a2e72b95aa3a9eea7d687c0
Instruction Fuzzy Hash: 3B7115B5604782CFD726CF79D590762FBE2AFA7204B18858DC4D68B75AC738A806CB50

Function 02217688 Relevance: 1.5, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

,, xrefs: 022177FB

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: ecebe23ec0881f7020f4b901c59648ec2a6586f088ba65e78406499129a36248
Instruction ID: cd3fbaa9793e5a9e427a9ed07e1a277cde9fd974e1129df17d522542d9bcb1b4
Opcode Fuzzy Hash: ecebe23ec0881f7020f4b901c59648ec2a6586f088ba65e78406499129a36248
Instruction Fuzzy Hash: C9B139701083819FD324CF58C880A5BFBE1AFA9604F448A2DF5D997382D771E618CB97

Function 004026C4 Relevance: 1.5, APIs: 1, Instructions: 20timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 004026CE

Memory Dump Source

Source File: 00000000.00000002.2340148518.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2340128450.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340169182.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340169182.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340208145.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XhlpAnBmIk.jbxd

Similarity

API ID: SystemTime
String ID:
API String ID: 2656138-0
Opcode ID: 1c1586f040ad907c453502297459692aa8199981632c93951a31d41848eff65d
Instruction ID: 69442b1fa125f02c17f5f00667ba5619268a94e84ed87230136e9e38920861ba
Opcode Fuzzy Hash: 1c1586f040ad907c453502297459692aa8199981632c93951a31d41848eff65d
Instruction Fuzzy Hash: 14E04F21E0010A82C704ABA5CD435EDF7AEAB95600B044272A418E92E0F631C251C748

Function 02226178 Relevance: 1.5, Strings: 1, Instructions: 263COMMON

Download Yara Rule

Strings

gfff, xrefs: 0222639F

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: gfff
API String ID: 0-1553575800
Opcode ID: da9dc378ba23d74061a16eeb81585a4670e68b3d59944b4248796e150ca8c016
Instruction ID: 79401f4c8b5115d43d73ec1798789a1e3d8b9412a95dd9dd6c33e435a5c413da
Opcode Fuzzy Hash: da9dc378ba23d74061a16eeb81585a4670e68b3d59944b4248796e150ca8c016
Instruction Fuzzy Hash: 3F912576620A114FE728CB78C8917A677E3FB85314F18822DD4568B7D9DB79E406CB40

Function 0221A008 Relevance: 1.5, Strings: 1, Instructions: 234COMMON

Download Yara Rule

Strings

b/7, xrefs: 0221A05C

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: b/7
API String ID: 0-2085417233
Opcode ID: 6e982e3cfaf07f258f3effdd4bbc4fdd32167dcef8fa8f803002f04f24a2a174
Instruction ID: be09e3f003ad7e8c560afceabed19ad363bd13b12991ad2b333365571e57075d
Opcode Fuzzy Hash: 6e982e3cfaf07f258f3effdd4bbc4fdd32167dcef8fa8f803002f04f24a2a174
Instruction Fuzzy Hash: A2712C73A143114FC318EFB8CC8576AF6D6ABC5320F0AC63DA898D7395EB7498048B81

Function 02240A5D Relevance: 1.4, Strings: 1, Instructions: 190COMMON

Download Yara Rule

Strings

h~BL, xrefs: 02240BD6

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: h~BL
API String ID: 0-1016882582
Opcode ID: 2353f16c686568adc0586de7d1e93e01bd2d2aed02e5eac9b0619ca2789dfc7a
Instruction ID: 0ad49a569d29dded0529e51dead78300f8ae2a9c2c7b82adeb2eb58bd91d7546
Opcode Fuzzy Hash: 2353f16c686568adc0586de7d1e93e01bd2d2aed02e5eac9b0619ca2789dfc7a
Instruction Fuzzy Hash: 5051BC312697438BD71C8F78C4D0362BB92EF96224F1C876DC6918B3CADB389646C715

Function 0223F5F8 Relevance: 1.4, Strings: 1, Instructions: 167COMMON

Download Yara Rule

Strings

3Z{, xrefs: 0223F668

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: 3Z{
API String ID: 0-2331068373
Opcode ID: 23b383c78454ef6be3be3edf7f88053188138058e6849870bafb74795745ec60
Instruction ID: af7f04ca19d998478f4de767ead61e9a8b6336623ba2678edbc66c85ce7215f3
Opcode Fuzzy Hash: 23b383c78454ef6be3be3edf7f88053188138058e6849870bafb74795745ec60
Instruction Fuzzy Hash: F84138B05043829FE7268F74D990B62BFE1EF57304F28448CE4E64F79AD7269806CB21

Function 0223F8CA Relevance: 1.4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

Strings

79.', xrefs: 0223F8DD

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: 79.'
API String ID: 0-3373235548
Opcode ID: 3052bdd5b9f525bfd9188c849dd4df91fdd9a95299ae7d6644acfbbe7ea22ffb
Instruction ID: bfc6269d522ba2cc546b8c5867664dd5aa893a645be4fa2cc24936e7a2678430
Opcode Fuzzy Hash: 3052bdd5b9f525bfd9188c849dd4df91fdd9a95299ae7d6644acfbbe7ea22ffb
Instruction Fuzzy Hash: DD41F5A4904391AFE7374F2899A0732BFE1AF27309F6855CCD4D21F799D325A406CB15

Function 00404C5C Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

kern, xrefs: 00404CF4

Memory Dump Source

Source File: 00000000.00000002.2340148518.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2340128450.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340169182.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340169182.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340208145.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XhlpAnBmIk.jbxd

Similarity

API ID:
String ID: kern
API String ID: 0-880603646
Opcode ID: 1fc5c5b09ed6c3dd3a29d37152087ebf09b31b781696405f17277d4cc6f2179a
Instruction ID: 736a6848919dec06b082da1af2e24d9457c62395971a5221e8ea77676d13d0e9
Opcode Fuzzy Hash: 1fc5c5b09ed6c3dd3a29d37152087ebf09b31b781696405f17277d4cc6f2179a
Instruction Fuzzy Hash: 7621E4329547204BD348EF76EE966693352FB84309349863EA442B76A6CF3D10418ACF

Function 0223C0D8 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

~, xrefs: 0223C0FA

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: ~
API String ID: 0-2894255414
Opcode ID: b65a2b0f6834741de1f91dc40b806d39aebe2b80ec226c2fcdce17e422ad554e
Instruction ID: 71b3c24ae341e78f220c674ed988ea998a811e9c842f26c3d0b5ec6995d0f5f4
Opcode Fuzzy Hash: b65a2b0f6834741de1f91dc40b806d39aebe2b80ec226c2fcdce17e422ad554e
Instruction Fuzzy Hash: 4431BAB56493458FE350DF259890A1FFBF6EBD2740F10A82CE5C09B295C7B0D406CB42

Function 0221D2F1 Relevance: 1.3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

WT, xrefs: 0221D350

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID: WT
API String ID: 0-3626323073
Opcode ID: c98c440a951f3e80385427973262f6473fe4faebb6d8defc51fc15df456e7494
Instruction ID: 676f25291c6b46c94b28bab42ec9645751bded67816b96343e598a1627ea315a
Opcode Fuzzy Hash: c98c440a951f3e80385427973262f6473fe4faebb6d8defc51fc15df456e7494
Instruction Fuzzy Hash: 92216A765083408FC3288F24C880A6BF7E2EFC6308F19891DD68617685CB75A802CF86

Function 02221D0E Relevance: .9, Instructions: 941COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1474361b0d2a4b0e8945a45e811d4af63ccafd11140a6d488a7330ea5c481797
Instruction ID: 5c5e3f720cc3382eaa0dde1ec34cecb46d5486502b6c135f7ac3bd1bb41bbcff
Opcode Fuzzy Hash: 1474361b0d2a4b0e8945a45e811d4af63ccafd11140a6d488a7330ea5c481797
Instruction Fuzzy Hash: 09824AB1614B408FD724DF78C895356BBE2AF95320F098B2CD8EA873D5D676E409CB02

Function 02241918 Relevance: .9, Instructions: 875COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 407d260e2984e500bc938a2af9084afc88076a4a5a4afd9904190e82843a23c4
Instruction ID: a757c9a6213b51595e0e78180fab78ab5e4f2f768fddba1382edde5046c7d4eb
Opcode Fuzzy Hash: 407d260e2984e500bc938a2af9084afc88076a4a5a4afd9904190e82843a23c4
Instruction Fuzzy Hash: B492A6B0615B809FD3A5CF3DC841793BBE8AB1A301F04496EE1EED7342D774A9408B69

Function 02245398 Relevance: .8, Instructions: 767COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14e624bee96e47c6332c5ade784e2d0ceaf0cdec4d8aca0be867267f1b83f6b7
Instruction ID: 4146d2942d77ce54ebc10a7f357114eaf022f24277b506d2a577c948aec9b38e
Opcode Fuzzy Hash: 14e624bee96e47c6332c5ade784e2d0ceaf0cdec4d8aca0be867267f1b83f6b7
Instruction Fuzzy Hash: D97238B1614B819FD365CF39C805793BFE9AB9A310F18892ED0EAC3752C778A901CB55

Function 0222FB18 Relevance: .7, Instructions: 677COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f17ea89f4d1b368da92741cca1a27be89d7296a3ee0b739eace175103a64188a
Instruction ID: b46e5bedb3608f236ae381bb5b8536816c0bd40d94a0bb33373829cf3ceb9669
Opcode Fuzzy Hash: f17ea89f4d1b368da92741cca1a27be89d7296a3ee0b739eace175103a64188a
Instruction Fuzzy Hash: 59629FB0219B818ED335CF3C8815797BFD5AB5A324F088A5DE0FA873D2C77561068B66

Function 02217EE8 Relevance: .7, Instructions: 665COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6622422d7539ce0b52b06fdf36dba662481708c3368aacd43c76f1fee5f17e3d
Instruction ID: 8070a05b4e824c0942b2609e1b126164249c9b742f8c805bf3c9c25a0d7439b0
Opcode Fuzzy Hash: 6622422d7539ce0b52b06fdf36dba662481708c3368aacd43c76f1fee5f17e3d
Instruction Fuzzy Hash: 4F52F2B0928B858FF735CB64C4C8BA7BBE1EF51314F14892DC5E60668AC3B9A585C707

Function 02218CC8 Relevance: .6, Instructions: 625COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c7625dc8a02050d2483af0f75c91bb5bc7877375563f0b19dd77e196208affe
Instruction ID: 52eecb0d2199bc1fc817a1ff411997bcb91f7b212cbf32bde7b4856c0528824d
Opcode Fuzzy Hash: 0c7625dc8a02050d2483af0f75c91bb5bc7877375563f0b19dd77e196208affe
Instruction Fuzzy Hash: FB220631A183128BD734DF58D890ABBB3E2FFD4319F19892DD9C697289D734A491CB42

Function 022151E8 Relevance: .6, Instructions: 600COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be30a2da7f887a4e4f80172f92d1401173ff8208445a594a074021b1418aa212
Instruction ID: ba5ae5b12869e97bf2fb243c6cf7cdc83bdc3eacb33dd9d4b3ea3b3fe8687938
Opcode Fuzzy Hash: be30a2da7f887a4e4f80172f92d1401173ff8208445a594a074021b1418aa212
Instruction Fuzzy Hash: 073245B0925B118FC338CFA9C58092ABBF1BFA5310B904A6ED59787E94D776F451CB10

Function 02222940 Relevance: .6, Instructions: 560COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae7b3f51c9effa284a301cfccf5d1c2fc080d0954d373b0cf9aaca151b60bb47
Instruction ID: 3a15f5a83289b201d82a710d4364f69b1f61c63f476169edc333f5435c3abd0a
Opcode Fuzzy Hash: ae7b3f51c9effa284a301cfccf5d1c2fc080d0954d373b0cf9aaca151b60bb47
Instruction Fuzzy Hash: 492235B1624B40CFC724DF78C48436ABBE2AF95310F058A6DD8EB87395D776A509CB02

Function 004083E4 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340148518.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2340128450.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340169182.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340169182.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340208145.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XhlpAnBmIk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cb438cf7f0ff76753a1d16800e3023f3e313fbbfbb21f985cf38b771b24bb28
Instruction ID: dd5bcfe43659cf13d339026f7ad3ea52b8e70fb20ee6bb96b4ba17e57606c0dd
Opcode Fuzzy Hash: 7cb438cf7f0ff76753a1d16800e3023f3e313fbbfbb21f985cf38b771b24bb28
Instruction Fuzzy Hash: 8532F875E00219DFCB14CF99CA80AADB7B2BF88314F24816AD855B7385DB34AE42CF55

Function 0221FD78 Relevance: .4, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 287fe9960c1a609efd5c0c66f2ac5d44ad56dc0fe5693a4a92eca0da343a75c5
Instruction ID: 794a1e438763e24f7978cd43d0ca2e968f78e03598339f594db8ccc75e588b1f
Opcode Fuzzy Hash: 287fe9960c1a609efd5c0c66f2ac5d44ad56dc0fe5693a4a92eca0da343a75c5
Instruction Fuzzy Hash: 9C02F4F1911B00BFC3A1CF39C942B97BEEDEB4A260F14491EF1AEC7254D67165058BA2

Function 0226130C Relevance: .4, Instructions: 429COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f25aa825a39bec38ad6b6d36dd1a7b58a115f37f7b46c95bc86c5f4f7415b87
Instruction ID: 0670fd8424b84b82e21dccc7c79df9a8b88a458f3802f8d1ea6ffed6e999975b
Opcode Fuzzy Hash: 3f25aa825a39bec38ad6b6d36dd1a7b58a115f37f7b46c95bc86c5f4f7415b87
Instruction Fuzzy Hash: 94D17331718B498BDB69DF6898896FEB7E5FB98705F00422EE84EC3244DF30E5518B81

Function 022171A8 Relevance: .4, Instructions: 413COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1f1e7085290bf942a3f1d451a847f46da938290f2730fd2d0b09b2c529a42b5
Instruction ID: 023c9667e5890b33d1b69978a02214ad959c416adb3921dbb83dc4a121f9f6ee
Opcode Fuzzy Hash: b1f1e7085290bf942a3f1d451a847f46da938290f2730fd2d0b09b2c529a42b5
Instruction Fuzzy Hash: 3AE18C712083419FC724CF69C880A6BFBE6EFE8204F48882DE5DA87751D775E948CB52

Function 022625D0 Relevance: .4, Instructions: 409COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e74d2aa687a79bc353c1e30e2761018af6d861ea5a8c8f1c92844b65f1d9ba9
Instruction ID: 9200bebf4088a64d2321dcbc315f8e6689a5ee8013fa51f396a0abd770e9ee66
Opcode Fuzzy Hash: 3e74d2aa687a79bc353c1e30e2761018af6d861ea5a8c8f1c92844b65f1d9ba9
Instruction Fuzzy Hash: 57D17131518B488FDB59EF28C899AEA77E1FF98300F14466DE84AC7155DF30E585CB82

Function 0224B012 Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e221bef2291457b3eeae710c9d360d698535e8fada81a59d1dc249c91ca4b13b
Instruction ID: 462799d18638ffa984833aa1865de28a843ed1daa7374c181e8a0fdc473e6a7c
Opcode Fuzzy Hash: e221bef2291457b3eeae710c9d360d698535e8fada81a59d1dc249c91ca4b13b
Instruction Fuzzy Hash: 57125720918BD58ED326CB7C8848B497F916B67228F0E83D9D4F45F3F3D6A58506C7A2

Function 02262200 Relevance: .4, Instructions: 380COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e45004cfa00b96cc07e21d80348e0ecc464919f4c4bc6f170ace2c42d415ba2b
Instruction ID: 7ef08989f816393b17686fe5202e375a7e89da1000e371e983d33775758b5a10
Opcode Fuzzy Hash: e45004cfa00b96cc07e21d80348e0ecc464919f4c4bc6f170ace2c42d415ba2b
Instruction Fuzzy Hash: 07B17831324E0A9BCB6DEE68D4997B5B3D2FB88304F144369C84AC7159DB35E496CB81

Function 02253D28 Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80768ea15acc26a1c01c9e33948a476274676e0131c1a2678f72f8bc7e0d6ba4
Instruction ID: dd8bcd063a4c189504deb076abdabf5636831b1dc4473669d167401e37945720
Opcode Fuzzy Hash: 80768ea15acc26a1c01c9e33948a476274676e0131c1a2678f72f8bc7e0d6ba4
Instruction Fuzzy Hash: 6FA156326183229BC314DF68C89066FB7E2EFC5720F19C66CEC9597294DB35D845CB92

Function 02217A58 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05437df602dc57edd95d2a5d4231048cbcefe00e6ea43abd62f39208546a0616
Instruction ID: 770162a2334ada05eacd5b16956085165c48cdbf70457d788b5df06d226fda89
Opcode Fuzzy Hash: 05437df602dc57edd95d2a5d4231048cbcefe00e6ea43abd62f39208546a0616
Instruction Fuzzy Hash: 4FC159B2A587418FC370CF68CC96BABB7E1BF85318F08492DD1D9C6242E778A155CB46

Function 0224B5A0 Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aebfea78292e90f22496fe1e3b2e789f277366479e7ad366d1224988f739e111
Instruction ID: 2194d5e1e49705e2661b11535e2750154084a316756c41b0e7478757ea037e10
Opcode Fuzzy Hash: aebfea78292e90f22496fe1e3b2e789f277366479e7ad366d1224988f739e111
Instruction Fuzzy Hash: 2DD1B331518BD18EC326CB3C884874ABFE16F17228F49879DD0EA5B7E2C765E906C791

Function 022546A8 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e2bb4869fa71b171da7062b259e1c56349b948f9aff5454853da40c7c8ac9c8
Instruction ID: 89933a61698ab6cf9c3eb0c0891dd9c47d19bb6a1b78586203170f8a4b6c06e4
Opcode Fuzzy Hash: 4e2bb4869fa71b171da7062b259e1c56349b948f9aff5454853da40c7c8ac9c8
Instruction Fuzzy Hash: EC814D316283614BD7289F28CC8197AB7A2EBC5324F19C63CED9657399DB70DC86C781

Function 0224A9F4 Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ec4b32ad510046600747c2ad7e746814a4556868eeb270525aca74a288b5846
Instruction ID: 4c7d9b4aaec9f48470325fb64e6a3edba73747045509fe8bfb13e0076af917c3
Opcode Fuzzy Hash: 2ec4b32ad510046600747c2ad7e746814a4556868eeb270525aca74a288b5846
Instruction Fuzzy Hash: 74D1B321508BC1CED326CB7C884874ABFE26B57224F0D879CD0E65B7E2C775A506C762

Function 0222D398 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72ede770be2ae462dea2a9dd93b537463ac65c81dc379a0d06bada6212b2b16b
Instruction ID: 5687e9eb917971d212f2a909b1fb9ae8ab8c445d36ac372a9729f7385a4fb8a1
Opcode Fuzzy Hash: 72ede770be2ae462dea2a9dd93b537463ac65c81dc379a0d06bada6212b2b16b
Instruction Fuzzy Hash: BE9146726182215FC7158E68984179EBBD2ABC5220F18C63DE8E88B3C5D779D80AC7D1

Function 02254358 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecc63a2072383da7df41fad46595759b9d4fca71c53878d26cb3a42d08f0d3f2
Instruction ID: 38ecc5f036357a0abfd1003e590e788aad7bbf309dc5455122f5778c0843a157
Opcode Fuzzy Hash: ecc63a2072383da7df41fad46595759b9d4fca71c53878d26cb3a42d08f0d3f2
Instruction Fuzzy Hash: F591F8726243269BC728DF98D88066AF3E2EF88314F15C62CED555B3A8D770EC45CB81

Function 022634A8 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2e903f92329977da97ab707699d6460e74b4fcfb6d1b984767a57618237eb95
Instruction ID: 6ad33f234c676989758b156e0771c833767a2f3bc51e2d9bd4f476ff04481109
Opcode Fuzzy Hash: e2e903f92329977da97ab707699d6460e74b4fcfb6d1b984767a57618237eb95
Instruction Fuzzy Hash: 81A14E71508A4C8FDB55EF68C889BEAB7F5FB58315F10466EE84AC7160EB30E644CB81

Function 02238638 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5515b50c9ee47dc2f8c36c8cce0e7028ab4af9639b4148825816c497b9ac7762
Instruction ID: 932bde7ebc88820a6dd9fb67ecb1c1afcc191f6c4074a953cf729039e4e89ec4
Opcode Fuzzy Hash: 5515b50c9ee47dc2f8c36c8cce0e7028ab4af9639b4148825816c497b9ac7762
Instruction Fuzzy Hash: A68124B29193118BD718DF64C85066BBBE2EFD2314F198A2DF4C59B398E7748505CB83

Function 02243A50 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 168d4cee08773db59f2c79459135757ac00f7aebb2ce96548f69e8bf57a9f324
Instruction ID: f8b3e01798e15274327ef053978596f2427d17cd46d2cc9c9e9cc6d9ad2f6c7a
Opcode Fuzzy Hash: 168d4cee08773db59f2c79459135757ac00f7aebb2ce96548f69e8bf57a9f324
Instruction Fuzzy Hash: DEC19472609B808FD3259B38C8543A7BFD25F96314F1DCA6DC4EE87786DA74A405CB12

Function 02242AAE Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80a5d58a3208a3eb61af739105256fa8bec8b08d3f8ae1ffcf71027051207583
Instruction ID: 1a7d0aa053fb913ea913735578fec189c93a26e3e614b48527417bb3dc0635e9
Opcode Fuzzy Hash: 80a5d58a3208a3eb61af739105256fa8bec8b08d3f8ae1ffcf71027051207583
Instruction Fuzzy Hash: 26B10671609F808BD3298B38C4A13A7BFE25F96310F08CA7CD5EB87782E574A409C752

Function 02243350 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea2e314d6c797e7380a4729dce3a043da3c6b9074752915ea08d70c4aaab4540
Instruction ID: be0f29a3a5c74c3a4c4a94b321f07dc8e7a4ea799f34b90ff8537c535c32b5c1
Opcode Fuzzy Hash: ea2e314d6c797e7380a4729dce3a043da3c6b9074752915ea08d70c4aaab4540
Instruction Fuzzy Hash: 37B1F761608F808BD3299B3CC4A5397BFE25F96314F1C8A6CC5EB87782E974A509C752

Function 0223AFE8 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efb83c220a63a8557cd1619c2e1cd551980cd5c94d2b991c8a0d9f5023c9805e
Instruction ID: 614ceb5d5f9eb8ba392febece3695fc3a9a8ac3f0bc8d3b5ea2cd8ed82925425
Opcode Fuzzy Hash: efb83c220a63a8557cd1619c2e1cd551980cd5c94d2b991c8a0d9f5023c9805e
Instruction Fuzzy Hash: 9F7140B1E10316CBCB15CF98C8926BAB371FF56318B19824DC8916F7A8E375AD41CB94

Function 0222E098 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fb8983ddb80d549abcaca12ea37e6bb225b10b3ed429340747722f435c066c2
Instruction ID: 6b4224b1f66e0573088386d1e343ae8cdcd3de87388b97fb0434aaf36fed0172
Opcode Fuzzy Hash: 6fb8983ddb80d549abcaca12ea37e6bb225b10b3ed429340747722f435c066c2
Instruction Fuzzy Hash: BD815F32B299A15BC7188DBC8C512BDBE535BD7230B2EC37DD5B18B3D9C5A658098360

Function 022540A8 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 405b15d91be31db6790b6c9e05e5eb7c1f838f3a3464d3462c435711021f930a
Instruction ID: d68e65532abae8f0e5ad6887be23d44a09efae3a5dad91047da13ec46bdb8040
Opcode Fuzzy Hash: 405b15d91be31db6790b6c9e05e5eb7c1f838f3a3464d3462c435711021f930a
Instruction Fuzzy Hash: DC81A2346143229BC714EF58D880A6AB3F2EF99714F15C66CED949B2A8EB31EC51CB41

Function 022522D5 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 620a92d7b8cb787c03d1ce8c562cc66d8847493fdb5bd5087683695be5fbde3f
Instruction ID: 54679f2d63af927cd6f7bc2d35171c8a427286eda0286441c0e5fda67d4f0d20
Opcode Fuzzy Hash: 620a92d7b8cb787c03d1ce8c562cc66d8847493fdb5bd5087683695be5fbde3f
Instruction Fuzzy Hash: C761EA71A10221CBDB18CFA4C89177EB7B2FF5A314F0AC25DD946AB3A8E7759801C794

Function 0222F508 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cf96c1f918d61b0610e1e59964adfdb0061d02bd348bd41cdccd9df3b9e21b1
Instruction ID: 26bb098d8cea0e5d6f974dd55ae789356b65cdde524ea8df3d6bd044588db46b
Opcode Fuzzy Hash: 8cf96c1f918d61b0610e1e59964adfdb0061d02bd348bd41cdccd9df3b9e21b1
Instruction Fuzzy Hash: E6618F316083616FD7258F78C89092E7BF1EF95214F4882BDE8E44B792D776D809CB92

Function 0224C508 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bfe9ffa8413bde6872df37f013aed2b62b6051166d4a6f8bde0560446e4846b
Instruction ID: fecb4f99839b08b628ee03cc73e5c2a95e7502d0701816557fec4cc7bbb7d4f4
Opcode Fuzzy Hash: 8bfe9ffa8413bde6872df37f013aed2b62b6051166d4a6f8bde0560446e4846b
Instruction Fuzzy Hash: 6D5148B16097548FE318DF69C49435BBBE1BB88314F054A2EE4E987350E779D6088F82

Function 02253A78 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e639b92aa0330a83a9c8eabd28dc9be480c53553e2f66d9bbb52e8a64dcdd39
Instruction ID: 0ed78b1b7ca420a5961f0483c997634df28f9d479ef2112c8828f56812175cf0
Opcode Fuzzy Hash: 8e639b92aa0330a83a9c8eabd28dc9be480c53553e2f66d9bbb52e8a64dcdd39
Instruction Fuzzy Hash: 88411273B683204FD319DEB8CC8131ABBD2ABC5364F1AC67DE9D4D7245D2B889048792

Function 02214208 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94ca20dc4f76e8c3e8d02b75f9c402b180f2256a0ed4e9f610f16215ed658aa6
Instruction ID: ce90ff1a514236a1c0ba9bb8bc443af40b587df87442d3d0c02933be26f5c6a9
Opcode Fuzzy Hash: 94ca20dc4f76e8c3e8d02b75f9c402b180f2256a0ed4e9f610f16215ed658aa6
Instruction Fuzzy Hash: 57412832B1C2654BC718AA6D8C5467ABAD68FC5208F1EC67DE8DD8B78AE5748810C7C0

Function 02252B79 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fa374590dffa9170f901e677aeca6d256a19dc4d7adeacb217e02be019ebc1f
Instruction ID: 8e922b7cd6f67362ddf6bf4a8884f31bdc8b94353c6d6232a2b406585e6905ec
Opcode Fuzzy Hash: 4fa374590dffa9170f901e677aeca6d256a19dc4d7adeacb217e02be019ebc1f
Instruction Fuzzy Hash: 92411633B187214BC318CE7C8D9126BFBD6ABCA614F1A966DC889E7265D670DC0087C5

Function 02253648 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2389c2aa22a80157ecc906328f111fcc8f688184627fafe56874ccb06f0814c5
Instruction ID: 0f596f11b422238866918dd17b3cca32b1abb2307172223449300a3031fca8c8
Opcode Fuzzy Hash: 2389c2aa22a80157ecc906328f111fcc8f688184627fafe56874ccb06f0814c5
Instruction Fuzzy Hash: 72316D336287604BD719CE3888E617FFBCB9BCB254B5EE57DC8D687299D93094048304

Function 0221A598 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f822273db6c68e011de364cdba3ced214ba853329870a82143a1b3826a5d9c10
Instruction ID: 4a5602e861d7b70e6697f26e1a03fb5c352d560cd91c0d492e275269014c2acc
Opcode Fuzzy Hash: f822273db6c68e011de364cdba3ced214ba853329870a82143a1b3826a5d9c10
Instruction Fuzzy Hash: B931AB225AB3934FDB25CD688891AB6FBD5EB722A0F08473DC452077C9E314E519D3E1

Function 0221F8B2 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 550955050dfdcde3c904be6984569726dad2dcd699ae92ba3bf8c7e90d3e8808
Instruction ID: b1bff78048964c4219d3e65b6d610e0019909cad3673d2a9ed017863e0535843
Opcode Fuzzy Hash: 550955050dfdcde3c904be6984569726dad2dcd699ae92ba3bf8c7e90d3e8808
Instruction Fuzzy Hash: 9431E574620702EFC729DF68CA90A3677E2FB973107648658D4665BB9DD730F812CB40

Function 0223ECE8 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20eb69036d69807debfbd8ef52ec59536dd4d5321856e452b3146c9f2ae76fca
Instruction ID: 6d715b0a2d045d2bef34460c461238a3d54fa52933f26cd6cb20af8ae94e85fa
Opcode Fuzzy Hash: 20eb69036d69807debfbd8ef52ec59536dd4d5321856e452b3146c9f2ae76fca
Instruction Fuzzy Hash: 6831E6B96506428BE72A8F29C850371FBA3EFD7310B2D825CE1D1577EAD774E846C640

Function 0221F73A Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 398ed19c1b5591b7a93386f97a201355981c08b3bbe4d8edfbabb66191edd784
Instruction ID: 26a3e58bc4ec28550b64626a9691683bee65d99b4129a6be11dc77d430aef67b
Opcode Fuzzy Hash: 398ed19c1b5591b7a93386f97a201355981c08b3bbe4d8edfbabb66191edd784
Instruction Fuzzy Hash: E831B578720603DBD314CF59DD40E7173E7FB96315BA58624D43197AA8E770E823CA94

Function 0221105B Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b09967ac5482500bc099009dc95111bd7cc7545dcabcf40ba633cd1a509d9f95
Instruction ID: 1d41aefaea4360f6b144b99b0572e843782cb0c3e5e3df74b432910da3f49cc3
Opcode Fuzzy Hash: b09967ac5482500bc099009dc95111bd7cc7545dcabcf40ba633cd1a509d9f95
Instruction Fuzzy Hash: 19516074E10209DFCB08CF88C590AAEF7B2FF98314F208199D915AB355D731AE91CB94

Function 02226F11 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e840308f10c17a667c19588e25512fd9af3edd54cbb022b12e8be8527047f3a
Instruction ID: 40bd88441df9982e9084d40d2402fcaf207be11e9a933a15388249d33c93995f
Opcode Fuzzy Hash: 4e840308f10c17a667c19588e25512fd9af3edd54cbb022b12e8be8527047f3a
Instruction Fuzzy Hash: 7D31DF301147828EDB29CF29C860B75FBE1AF53310F09869CC0D3CB2E6CB29A149CB54

Function 022503C8 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2278262ddf3a3083b0dcafd05991e17689cd6f1b05302bf6df86fa708b8ff67
Instruction ID: c14b617bc3552c31dc0a705b4d0e4648750c7ebe8bd1358d0837d2c727122ba0
Opcode Fuzzy Hash: d2278262ddf3a3083b0dcafd05991e17689cd6f1b05302bf6df86fa708b8ff67
Instruction Fuzzy Hash: 49215A71A142218BE718CF59C84677BB7A2EBC9324F19D93CDCD457284D378C8418B91

Function 0223666A Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 912accffe033f0f82063d52dd10dad5a5a635153b51dfb6b5b4154f60fd1b491
Instruction ID: f911e72f7cc7f995776933728a00e4a92b5ed3e227b8c2d81e85fe97c2af010b
Opcode Fuzzy Hash: 912accffe033f0f82063d52dd10dad5a5a635153b51dfb6b5b4154f60fd1b491
Instruction Fuzzy Hash: 3F21B5B6B187019BC718CF99C8512BFF3E6ABD0204F8A883CD59AD7644EB34D905C785

Function 022274ED Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa270377212e71c5cc8816314e8c4dbc58a3caa0ef93d2f0f9f2b7a593cf6fff
Instruction ID: 307f0163b5147819ed20948a2330edd83719d58374a984bc0c4d979a20afdb8e
Opcode Fuzzy Hash: aa270377212e71c5cc8816314e8c4dbc58a3caa0ef93d2f0f9f2b7a593cf6fff
Instruction Fuzzy Hash: F32104B56247129FD725CF29C800922B7B3FF82310B1685A8D0991BB78D731F866CF80

Function 022143E8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfaf8d0e94f5c6e15ea278469f7b2b102a292380ec2eac3b30e0d01d28b7b789
Instruction ID: 6c636de2cc6e4596e03b5e3c303c193aa3faa56b00f777ae9b6a9c8d80abcb69
Opcode Fuzzy Hash: bfaf8d0e94f5c6e15ea278469f7b2b102a292380ec2eac3b30e0d01d28b7b789
Instruction Fuzzy Hash: AC11E93BB642220BF768DF91D8F6A3AA392E7D631471A013EDA8B57381CF20F505C250

Function 022525A0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5026a4c9932bb01eb1cfa22389ce0795d21ac30bdbbfe162f59341988a769c1d
Instruction ID: b350d624cc8a8c23d19bd4f23ca409063e390e2ad82c87854dc4e98c8ff2e1f3
Opcode Fuzzy Hash: 5026a4c9932bb01eb1cfa22389ce0795d21ac30bdbbfe162f59341988a769c1d
Instruction Fuzzy Hash: 1611C47BA658328BD30CCB35C46557567D3ABA620434EC1BECC12E729CDF3498158785

Function 0221105A Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e64317625e06953a0030493f718403388be9115d8c6a0e5777c3d8d6dbedd3d
Instruction ID: 10919d2260f26857e712be5c37c6f41c4bd72bca03e4aecc1d8483471174dac1
Opcode Fuzzy Hash: 4e64317625e06953a0030493f718403388be9115d8c6a0e5777c3d8d6dbedd3d
Instruction Fuzzy Hash: 08319F74E10209DFCB08CF98C590AAEFBB1FF48314F208599D815AB355D371AA92CF90

Function 0224A3B8 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: b3b55745cd844551ddea9ac7049ed52159c7d5f17aa1cae9c334c6b095c876ec
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 1F11EC337A51D50DC3198D7C84105697FD30A93534F994399F4B59B2DADA228D8B8350

Function 0223CCF8 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89b2a4774bc0a00a24eedf7c1c3b08a8b7ef9a7eeaa125e52bef8acd1da686d4
Instruction ID: f2238a218f6caaf8645139f3adc675b1a5ce06aa4d6aa52c03779fea76058919
Opcode Fuzzy Hash: 89b2a4774bc0a00a24eedf7c1c3b08a8b7ef9a7eeaa125e52bef8acd1da686d4
Instruction Fuzzy Hash: 7101D8F262030647EB219ED484D0B2BB6EAAF95704F09042EF81877208DBB1E819CB91

Function 0222908A Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0300f0208cd1114f316579f692d9aa852186acc26e1ebcd63d6f935a3c75c8a1
Instruction ID: cc4740f0f8dc9f6698e1a3115a8c2fe8d4505c426f735be65541053e4f501ea1
Opcode Fuzzy Hash: 0300f0208cd1114f316579f692d9aa852186acc26e1ebcd63d6f935a3c75c8a1
Instruction Fuzzy Hash: 62115E31310511EFD715CF79CC84BB533B3E7C6310F254618D6566B2E9DB32A8468758

Function 02225CF8 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3aa60f6da63562edd3c50ec9b788223f3d88ec9aa917c1ea63b3a2a7d7e655f7
Instruction ID: 0aee19abf5b4bd49b10ae265579a3975b0631da27fcc2dcb5a691bf413e00a6f
Opcode Fuzzy Hash: 3aa60f6da63562edd3c50ec9b788223f3d88ec9aa917c1ea63b3a2a7d7e655f7
Instruction Fuzzy Hash: 6C01F731638222EBC71C8F68989053573A1EB4A325FD1992CE462A706CD371D8398684

Function 022270CE Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa0e802b754d52696746d0ec6f29ee9885b52feeac64a38fab2286ea8b451241
Instruction ID: d5ebd548a10e82fea25af2ef598cb3d6df30d7feb530313f73ac8003e2eb01a4
Opcode Fuzzy Hash: fa0e802b754d52696746d0ec6f29ee9885b52feeac64a38fab2286ea8b451241
Instruction Fuzzy Hash: 7D018474629523FBD7184F68CC51638B322FF43316F945224E516270BCE771686A8B88

Function 022506D8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42cce553a47ad90661cc7164f6e5ecea50e894812c37f950bddd42d6e1c5427e
Instruction ID: bad49a42f516bbed6830bbdef397c22f83b94619a2fab7ec17802155122f5809
Opcode Fuzzy Hash: 42cce553a47ad90661cc7164f6e5ecea50e894812c37f950bddd42d6e1c5427e
Instruction Fuzzy Hash: CEF0F975520329ABD1104B899C40EB773ADE78E728F104318E955221A4E372EF11CBE1

Function 02238EC8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12b5d8c97496696fa31f1fedca32606638faf7e08484992eb7175822c92a4753
Instruction ID: 72cfbe4e23e1de049d17bd46b6a1e3efd5eb3004e55e39ef40bc503bf6b4a46e
Opcode Fuzzy Hash: 12b5d8c97496696fa31f1fedca32606638faf7e08484992eb7175822c92a4753
Instruction Fuzzy Hash: A501BCB614C3018FD728CF91C84165BFBE1EB91314F288A2DE48167205EB78CA0A8F5B

Function 02238C74 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0862e9f9da5d255eed0c602cc41b99171966797ed930e98455049133e38aa8b9
Instruction ID: 7ad4298795e13211fbc2818dd4875bc0fa7bff50b9f17cf7a6ea4ea3a3a7d48b
Opcode Fuzzy Hash: 0862e9f9da5d255eed0c602cc41b99171966797ed930e98455049133e38aa8b9
Instruction Fuzzy Hash: B2F024F5A31302DBD6198F94C89057AB3A6FB83316F44082CF4826B268E3B1F8588746

Function 02210DBB Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f432f6d4d57ddd5edf10f0a55197208a6667e030cc273150dee4b63bd6a15e3
Instruction ID: a916e55b2996d63bceec448aef1978c6b19ee7622df6cc812751a813a128ee1f
Opcode Fuzzy Hash: 2f432f6d4d57ddd5edf10f0a55197208a6667e030cc273150dee4b63bd6a15e3
Instruction Fuzzy Hash: 2F01E834A20108EFCB18DF98C194E9DB7F2FB55310F208599E8015B384C331AF92DB80

Function 0221E40C Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8656cd1a9d74df869ad8f22be8c3fd88ccb0ea15f397b936d6b69d150d3e7ac9
Instruction ID: ff61b9231b5af6c48cb1d82934a630ea8aeeaa7d7eb1477661cb3efef4af383c
Opcode Fuzzy Hash: 8656cd1a9d74df869ad8f22be8c3fd88ccb0ea15f397b936d6b69d150d3e7ac9
Instruction Fuzzy Hash: 72E0BD383C83007BF6398B08AC97F247221A743F22F301214B3623E2E58AE07140451D

Function 0222F778 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction ID: 614f154d52abd91ca52ac2d47a2d6e2680bad66d3892612cfe464c479fce5a81
Opcode Fuzzy Hash: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction Fuzzy Hash: 04D0A7715487B21E67588D7404A08BBFBF8EA4B512F58149EE4D1E310DD321D8065798

Function 02251BD8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b7598ff860c6c584cc28cc9e2ee4f827b81178b3db001d57e5e8ec4a7167bec
Instruction ID: 776a1f7dd0c074e79f55533e911544892ec85f46c384d1e8a4e462c15b4e92e9
Opcode Fuzzy Hash: 9b7598ff860c6c584cc28cc9e2ee4f827b81178b3db001d57e5e8ec4a7167bec
Instruction Fuzzy Hash: 97D022B86481003B0248CB09CC4AE33B77CC387200F002034BE05C3350C610EC2182EE

Function 022382C8 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc2fa07c7324d2ac47afe96fa2dbd29daf0775af644ca9f8a24f442f38778e2a
Instruction ID: 212a4cc5447851ec4cae905730a4eab0bc231c10fbc5af4f1d8257e239792c86
Opcode Fuzzy Hash: bc2fa07c7324d2ac47afe96fa2dbd29daf0775af644ca9f8a24f442f38778e2a
Instruction Fuzzy Hash: 88C08CF2C24200CBEA002F009C0085AB9B3AB23200F0A2039940921130E662C6A9990B

Function 0223A134 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d569c0e63b70640a0c233463593cb507a1bd4a74803e9e53c29ccff6e4ea7a7
Instruction ID: c331a084108b982fff62373f868def3abba78c3f3837d826021d586fb34811db
Opcode Fuzzy Hash: 4d569c0e63b70640a0c233463593cb507a1bd4a74803e9e53c29ccff6e4ea7a7
Instruction Fuzzy Hash: BEB012F0C14140CBDF00AF80DC418BDF676A717200F023034C008B3120DA11D4588A4E

Function 0223A2CC Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2340774376.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_XhlpAnBmIk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94cc0ccff712f6699580b0c52e39565fc483e3c5a352d2c9fb7cd4ff89b60668
Instruction ID: 69b8fc133355450a05f26199caa08c561b473884a00a94b966d4f1e8e9591281
Opcode Fuzzy Hash: 94cc0ccff712f6699580b0c52e39565fc483e3c5a352d2c9fb7cd4ff89b60668
Instruction Fuzzy Hash: DFA00139D892048B86449F44D4814B8F779A74F621F293414D409B3216CA20E8818A6C

Function 00403A97 Relevance: 15.1, APIs: 10, Instructions: 121fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B1E
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B42
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B5E
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00403B7F
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00403BA8
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00403BB2
GetStdHandle.KERNEL32(000000F5), ref: 00403BD2
GetFileType.KERNEL32(?,000000F5), ref: 00403BE9

Memory Dump Source

Source File: 00000000.00000002.2340148518.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2340128450.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340169182.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340169182.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340208145.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XhlpAnBmIk.jbxd

Similarity

API ID: File$Pointer$CreateHandleReadSizeType
String ID:
API String ID: 741532818-0
Opcode ID: 403414a86dc723bb3cef7f5a1f4ed97203eaa8ae0b3646c9adec8fd6a7129518
Instruction ID: 024604f3a216e7c6dd34324d53ddcba0102d8b0acb9e3802b94c63e6c99f6cb4
Opcode Fuzzy Hash: 403414a86dc723bb3cef7f5a1f4ed97203eaa8ae0b3646c9adec8fd6a7129518
Instruction Fuzzy Hash: D64194302042009EF7305F258805B237DEDEB4571AF208A3FA1D6BA6E1E77DAE419B5D

Function 004019DC Relevance: 9.1, APIs: 6, Instructions: 59COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0040C41C), ref: 00401A09
LocalFree.KERNEL32(?,00000000,00401AB4), ref: 00401A1B
VirtualFree.KERNEL32(?,00000000,00008000,?,00000000,00401AB4), ref: 00401A3A
LocalFree.KERNEL32(?,?,00000000,00008000,?,00000000,00401AB4), ref: 00401A79
RtlLeaveCriticalSection.KERNEL32(0040C41C), ref: 00401AA4
RtlDeleteCriticalSection.KERNEL32 ref: 00401AAE

Memory Dump Source

Source File: 00000000.00000002.2340148518.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2340128450.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340169182.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340169182.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340208145.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XhlpAnBmIk.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: 968c6ade76c7b2a75fe1028d9f4e0e8289ce355ea137b2e174b443c8b7832b12
Instruction ID: 5447b05044442752c1d56c7733342563ab4b4f61826a3093f511f794066d9233
Opcode Fuzzy Hash: 968c6ade76c7b2a75fe1028d9f4e0e8289ce355ea137b2e174b443c8b7832b12
Instruction Fuzzy Hash: 91116330341280DAD711ABA59EE2F623668B785748F44437EF444B62F2C67C9840CA9D

Function 004036B8 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400,?,?,?,00000000,004038A0,?,?,004038FC), ref: 004036F2
SysAllocStringLen.OLEAUT32(?,00000000), ref: 004036FD
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,?,?,?,00000000,004038A0,?,?,004038FC), ref: 00403710
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 0040371A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,?,?,00000000), ref: 00403729

Memory Dump Source

Source File: 00000000.00000002.2340148518.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2340128450.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340169182.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340169182.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340208145.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XhlpAnBmIk.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: 9e4b55f6324fa1b44127db8cefb59a4f35ac4e4a1ebfb86be96d352400e65ddf
Instruction ID: 1285967c487f36a4f1f77a8b8e1f1fe351824cacfdb80e5859a13ebcd08b75b2
Opcode Fuzzy Hash: 9e4b55f6324fa1b44127db8cefb59a4f35ac4e4a1ebfb86be96d352400e65ddf
Instruction Fuzzy Hash: 17F068A13442543AF56075A75C43FAB198CCB45BAEF10457FF704FA2C2D8B89D0492BD

Function 00403D02 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00403D9D
ExitProcess.KERNEL32 ref: 00403DE5

Strings

Error, xrefs: 00403D91
Runtime error at 00000000, xrefs: 00403D96, 00403DA9

Memory Dump Source

Source File: 00000000.00000002.2340148518.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2340128450.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340169182.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340169182.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340208145.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XhlpAnBmIk.jbxd

Similarity

API ID: ExitMessageProcess
String ID: Error$Runtime error at 00000000
API String ID: 1220098344-2970929446
Opcode ID: 0b7abc0913d0e9b6482778e2bb40dc1e8adb9ed549d30d0444a38b969016e341
Instruction ID: db3008c0e6bc5d60e05df0545d3e9f81ce91e923819fa2a9fb93000da4b6b716
Opcode Fuzzy Hash: 0b7abc0913d0e9b6482778e2bb40dc1e8adb9ed549d30d0444a38b969016e341
Instruction Fuzzy Hash: B521F830A04341CAE714EFA59AD17153E98AB49349F04837BD500B73E3C77C8A45C76E

Function 00401918 Relevance: 6.0, APIs: 4, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.KERNEL32(0040C41C), ref: 0040192E
RtlEnterCriticalSection.KERNEL32(0040C41C), ref: 00401941
LocalAlloc.KERNEL32(00000000,00000FF8,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040196B
RtlLeaveCriticalSection.KERNEL32(0040C41C), ref: 004019C8

Memory Dump Source

Source File: 00000000.00000002.2340148518.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2340128450.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340169182.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340169182.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340208145.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XhlpAnBmIk.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: aabd9570e7a52811c13604d6a46282fe49281d95e81aad3d3e53893a1864dea1
Instruction ID: 093a8b970c40f4dda7bd37408b901a2e20e4e29fb74a5496b56404d4d89a3717
Opcode Fuzzy Hash: aabd9570e7a52811c13604d6a46282fe49281d95e81aad3d3e53893a1864dea1
Instruction Fuzzy Hash: CC0161B0684240DEE715ABA999E6B353AA4E786744F10427FF080F62F2C67C4450CB9D

Function 004030DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00409C2E), ref: 004030E3
GetCommandLineA.KERNEL32(00000000,00409C2E), ref: 004030EE

Strings

U1hd.@, xrefs: 00403103

Memory Dump Source

Source File: 00000000.00000002.2340148518.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2340128450.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340169182.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340169182.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2340208145.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XhlpAnBmIk.jbxd

Similarity

API ID: CommandHandleLineModule
String ID: U1hd.@
API String ID: 2123368496-2904493091
Opcode ID: ab44cebb113f23cc453db0582047ce3f33ed2b100303cb8959b7892e21e32e4b
Instruction ID: 0f926add87520dc699e98d27074396f9fab16295c11a520b4b5863bd90c7cb52
Opcode Fuzzy Hash: ab44cebb113f23cc453db0582047ce3f33ed2b100303cb8959b7892e21e32e4b
Instruction Fuzzy Hash: 03C01274541300CAD328AFF69E8A304B990A385349F40823FA608BA2F1CA7C4201EBDD

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report XhlpAnBmIk.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
XhlpAnBmIk.exe

Function 00404DA8 Relevance: 9.8, APIs: 2, Strings: 3, Instructions: 1076
librarymemoryloaderCOMMON

Function 0040515C Relevance: 9.6, APIs: 2, Strings: 3, Instructions: 863
librarymemoryloaderCOMMON

Function 0040538C Relevance: 9.5, APIs: 2, Strings: 3, Instructions: 724
librarymemoryloaderCOMMON

Function 02210B5B Relevance: 7.6, APIs: 5, Instructions: 100
threadprocessCOMMON

Function 0221044B Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 399
threadCOMMON

Function 00405674 Relevance: 5.0, APIs: 1, Strings: 2, Instructions: 498
memoryCOMMON

Function 0040582C Relevance: 4.9, APIs: 1, Strings: 2, Instructions: 428
memoryCOMMON

Function 0040584C Relevance: 4.9, APIs: 1, Strings: 2, Instructions: 417
memoryCOMMON

Function 00405858 Relevance: 4.9, APIs: 1, Strings: 2, Instructions: 415
memoryCOMMON

Function 02210A0B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 103
threadCOMMON

Function 02264760 Relevance: 6.1, APIs: 4, Instructions: 99
memoryCOMMON

Function 022655D0 Relevance: 4.8, APIs: 3, Instructions: 325
memoryCOMMON

Function 0226697E Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
libraryCOMMON

Function 0226485B Relevance: 3.0, APIs: 2, Instructions: 48
memoryCOMMON