Edit tour

Windows Analysis Report
G7T8lHJWWM.exe

Overview

General Information

Sample name:	G7T8lHJWWM.exe renamed because original name is a hash value
Original sample name:	3e7395ddfc7e38e08e6be54e3ba7c9de2d7ea1a73c9926ab607c76f3031394f6.exe
Analysis ID:	1590539
MD5:	9928e66ecbb91e45d7d48fafc8a3e21f
SHA1:	e5ef6accf90da7c944548ec9196c31a611da5628
SHA256:	3e7395ddfc7e38e08e6be54e3ba7c9de2d7ea1a73c9926ab607c76f3031394f6
Tags:	exeTHSUPPORTSERVICESLTDuser-JAMESWT_MHT
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

LummaC encrypted strings found

Sample uses string decryption to hide its real strings

Contains functionality to call native functions

Contains functionality to read the PEB

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

G7T8lHJWWM.exe (PID: 5052 cmdline: "C:\Users\user\Desktop\G7T8lHJWWM.exe" MD5: 9928E66ECBB91E45D7D48FAFC8A3E21F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["savorraiykj.lat", "washyceehsu.lat", "leggelatez.lat", "plodnittpw.lat", "bloodyswif.lat", "kickykiduz.lat", "finickypwk.lat", "miniatureyu.lat", "shoefeatthe.lat"], "Build id": "BbL7Kk--05S"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x50f80:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49 0x54516:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T08:55:23.640697+0100	2028371	3	Unknown Traffic	192.168.2.6	49755	104.102.49.254	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bloodyswif .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T08:55:22.853835+0100	2059189	1	Domain Observed Used for C2 Detected	192.168.2.6	51366	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (finickypwk .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T08:55:22.932749+0100	2059191	1	Domain Observed Used for C2 Detected	192.168.2.6	64570	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (kickykiduz .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T08:55:22.900201+0100	2059199	1	Domain Observed Used for C2 Detected	192.168.2.6	59756	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (leggelatez .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T08:55:22.877564+0100	2059201	1	Domain Observed Used for C2 Detected	192.168.2.6	53096	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (miniatureyu .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T08:55:22.888946+0100	2059203	1	Domain Observed Used for C2 Detected	192.168.2.6	59227	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (savorraiykj .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T08:55:22.910951+0100	2059207	1	Domain Observed Used for C2 Detected	192.168.2.6	59592	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (shoefeatthe .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T08:55:22.922550+0100	2059209	1	Domain Observed Used for C2 Detected	192.168.2.6	59454	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (washyceehsu .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T08:55:22.865132+0100	2059211	1	Domain Observed Used for C2 Detected	192.168.2.6	63875	1.1.1.1	53	UDP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T08:55:24.123032+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.6	49755	104.102.49.254	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: bloodyswif.lat	Avira URL Cloud: Label: malware
Source: miniatureyu.lat	Avira URL Cloud: Label: malware
Source: finickypwk.lat	Avira URL Cloud: Label: malware
Source: leggelatez.lat	Avira URL Cloud: Label: malware
Source: savorraiykj.lat	Avira URL Cloud: Label: malware
Source: kickykiduz.lat	Avira URL Cloud: Label: malware
Source: washyceehsu.lat	Avira URL Cloud: Label: malware
Source: plodnittpw.lat	Avira URL Cloud: Label: malware
Source: shoefeatthe.lat	Avira URL Cloud: Label: malware

Found malware configuration

Source: G7T8lHJWWM.exe.5052.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["savorraiykj.lat", "washyceehsu.lat", "leggelatez.lat", "plodnittpw.lat", "bloodyswif.lat", "kickykiduz.lat", "finickypwk.lat", "miniatureyu.lat", "shoefeatthe.lat"], "Build id": "BbL7Kk--05S"}

Multi AV Scanner detection for submitted file

Source: G7T8lHJWWM.exe	Virustotal: Detection: 9%			Perma Link
Source: G7T8lHJWWM.exe	ReversingLabs: Detection: 33%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 93.4% probability

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp	String decryptor: finickypwk.lat
Source: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp	String decryptor: shoefeatthe.lat
Source: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp	String decryptor: savorraiykj.lat
Source: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp	String decryptor: kickykiduz.lat
Source: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp	String decryptor: miniatureyu.lat
Source: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp	String decryptor: leggelatez.lat
Source: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp	String decryptor: washyceehsu.lat
Source: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp	String decryptor: bloodyswif.lat
Source: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp	String decryptor: plodnittpw.lat
Source: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp	String decryptor: BbL7Kk--05S

Source: G7T8lHJWWM.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: G7T8lHJWWM.exe

Static PE information: certificate valid

Source: unknown

HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:49755 version: TLS 1.2

Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then movzx ecx, byte ptr [ebx+eax]	0_2_00B890B6
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_00BA108C
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 53585096h	0_2_00B870FA
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_00BA00DF
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then cmp dword ptr [ebp+edi*8+00h], 0EF2A4EDh	0_2_00BB40D4
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then mov esi, edx	0_2_00B7A034
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then cmp word ptr [eax+ebx+02h], 0000h	0_2_00B9B014
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+48h]	0_2_00B91004
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-000000DEh]	0_2_00B91004
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then mov ecx, eax	0_2_00B9C104
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then jmp eax	0_2_00B9A160
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then jmp eax	0_2_00B9A2F8
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then push dword ptr [esp+28h]	0_2_00B982F4
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then movzx esi, byte ptr [edx]	0_2_00B74234
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx+0Eh]	0_2_00B7C204
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+2564CAB9h]	0_2_00BB03F4
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_00BAA3E4
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+edx+05CAF138h]	0_2_00B7D31D
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+32DBB3B0h]	0_2_00B99344
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then push 00000000h	0_2_00B7E438
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then mov ecx, eax	0_2_00B92404
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then add ebp, edi	0_2_00B7A5C4
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+edx]	0_2_00B8F534
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 53585096h	0_2_00B87519
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edi+06h]	0_2_00B96696
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then mov byte ptr [edx], cl	0_2_00B9F624
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then mov word ptr [edi], cx	0_2_00B98664
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_00B7A7A4
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	0_2_00B8F7A4
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 01FCE602h	0_2_00BB0704
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 53585096h	0_2_00B7F766
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then mov word ptr [ebx], cx	0_2_00B8C74A
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then mov word ptr [esi], cx	0_2_00B8C74A
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_00B9F8A3
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00B95892
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then mov byte ptr [ebx], cl	0_2_00B9F8F6
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then mov byte ptr [ebx], cl	0_2_00B9F8F6
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 13884179h	0_2_00B7F8DE
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+esi+63115D0Dh]	0_2_00B96AC0
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then lea eax, dword ptr [eax+eax*4]	0_2_00B79B94
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	0_2_00B78CF4
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	0_2_00B78CF4
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then lea eax, dword ptr [esp+50h]	0_2_00B98CA0
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then push eax	0_2_00BB1C04
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_00B9CD24
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_00B9ED14
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then cmp dword ptr [ebp+ebx*8+00h], 7E3E42A0h	0_2_00BADD04
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then push esi	0_2_00BADD04
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then movzx ecx, byte ptr [edi+eax]	0_2_00B9FEB6
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then movzx ebx, byte ptr [edi+edx+03D49333h]	0_2_00B99EAF
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then mov edx, ecx	0_2_00B7AE94
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then mov dword ptr [esi+04h], eax	0_2_00B87EF1
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+1Ch]	0_2_00B98EF4
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h	0_2_00B85D24
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 4x nop then movzx ecx, byte ptr [edx+eax]	0_2_00B86F3D

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2059201 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (leggelatez .lat) : 192.168.2.6:53096 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059199 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (kickykiduz .lat) : 192.168.2.6:59756 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059191 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (finickypwk .lat) : 192.168.2.6:64570 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059189 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bloodyswif .lat) : 192.168.2.6:51366 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059211 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (washyceehsu .lat) : 192.168.2.6:63875 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059203 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (miniatureyu .lat) : 192.168.2.6:59227 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059207 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (savorraiykj .lat) : 192.168.2.6:59592 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059209 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (shoefeatthe .lat) : 192.168.2.6:59454 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.6:49755 -> 104.102.49.254:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: savorraiykj.lat
Source: Malware configuration extractor	URLs: washyceehsu.lat
Source: Malware configuration extractor	URLs: leggelatez.lat
Source: Malware configuration extractor	URLs: plodnittpw.lat
Source: Malware configuration extractor	URLs: bloodyswif.lat
Source: Malware configuration extractor	URLs: kickykiduz.lat
Source: Malware configuration extractor	URLs: finickypwk.lat
Source: Malware configuration extractor	URLs: miniatureyu.lat
Source: Malware configuration extractor	URLs: shoefeatthe.lat

Source: Joe Sandbox View

IP Address: 104.102.49.254 104.102.49.254

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic

Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49755 -> 104.102.49.254:443

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

Source: G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=4ec73977b0c4dcb52d29135a; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type25665Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveTue, 14 Jan 2025 07:55:24 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: plodnittpw.lat
Source: global traffic	DNS traffic detected: DNS query: bloodyswif.lat
Source: global traffic	DNS traffic detected: DNS query: washyceehsu.lat
Source: global traffic	DNS traffic detected: DNS query: leggelatez.lat
Source: global traffic	DNS traffic detected: DNS query: miniatureyu.lat
Source: global traffic	DNS traffic detected: DNS query: kickykiduz.lat
Source: global traffic	DNS traffic detected: DNS query: savorraiykj.lat
Source: global traffic	DNS traffic detected: DNS query: shoefeatthe.lat
Source: global traffic	DNS traffic detected: DNS query: finickypwk.lat
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com

Source: G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: G7T8lHJWWM.exe	String found in binary or memory: http://cevcsca2021.crl.certum.pl/cevcsca2021.crl0w
Source: G7T8lHJWWM.exe	String found in binary or memory: http://cevcsca2021.ocsp-certum.com07
Source: G7T8lHJWWM.exe	String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: G7T8lHJWWM.exe	String found in binary or memory: http://crl.certum.pl/ctnca2.crl0l
Source: G7T8lHJWWM.exe	String found in binary or memory: http://crl.certum.pl/ctsca2021.crl0o
Source: G7T8lHJWWM.exe	String found in binary or memory: http://pwgen-win.sourceforge.nethttp://sourceforge.net/donate/index.php?group_id=57385http://pwgen-w
Source: G7T8lHJWWM.exe	String found in binary or memory: http://repository.certum.pl/cevcsca2021.cer0
Source: G7T8lHJWWM.exe	String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: G7T8lHJWWM.exe	String found in binary or memory: http://repository.certum.pl/ctnca2.cer09
Source: G7T8lHJWWM.exe	String found in binary or memory: http://repository.certum.pl/ctsca2021.cer0A
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2299376762.0000000000978000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2299376762.0000000000978000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2299376762.0000000000978000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: G7T8lHJWWM.exe	String found in binary or memory: http://subca.ocsp-certum.com01
Source: G7T8lHJWWM.exe	String found in binary or memory: http://subca.ocsp-certum.com02
Source: G7T8lHJWWM.exe	String found in binary or memory: http://subca.ocsp-certum.com05
Source: G7T8lHJWWM.exe	String found in binary or memory: http://www.certum.pl/CPS0
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2299376762.0000000000978000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=SCXpgixTDzt4&a
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/fatalerror.css?v=OFUqlcDNiD6y&l=engli
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2299376762.0000000000978000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2299376762.0000000000978000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2299376762.0000000000978000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=M_FULq_A
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2299376762.0000000000978000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=BFN_
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=Eq36AUaEgab8&l=en
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2299376762.0000000000978000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com
Source: G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2299376762.0000000000978000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A04000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/of
Source: G7T8lHJWWM.exe, 00000000.00000002.2299376762.000000000094E000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2299376762.0000000000978000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: G7T8lHJWWM.exe, 00000000.00000002.2299973443.00000000009CF000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: G7T8lHJWWM.exe, 00000000.00000002.2299973443.00000000009CF000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2299376762.0000000000978000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shopu
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: G7T8lHJWWM.exe	String found in binary or memory: https://www.certum.pl/CPS0
Source: G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.0000000000984000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443

Source: unknown

HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:49755 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown

Source: C:\Users\user\Desktop\G7T8lHJWWM.exe

Code function: 0_2_00BC5D2C NtCreateSection,NtMapViewOfSection,VirtualAlloc,NtMapViewOfSection,VirtualProtect,VirtualProtect,VirtualProtect,CreateThread,

0_2_00BC5D2C

Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B70477	0_2_00B70477
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00BC5D2C	0_2_00BC5D2C
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00BAD0A4	0_2_00BAD0A4
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00BB40D4	0_2_00BB40D4
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B8E0C4	0_2_00B8E0C4
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B7A034	0_2_00B7A034
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00BAB03E	0_2_00BAB03E
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B70000	0_2_00B70000
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B8B004	0_2_00B8B004
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B91004	0_2_00B91004
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B861A4	0_2_00B861A4
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B9F187	0_2_00B9F187
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B771D4	0_2_00B771D4
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00BA5104	0_2_00BA5104
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00BC222C	0_2_00BC222C
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B75214	0_2_00B75214
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B7C204	0_2_00B7C204
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B8E394	0_2_00B8E394
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00BB4384	0_2_00BB4384
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B8D3C4	0_2_00B8D3C4
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00BA53C4	0_2_00BA53C4
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00BC1338	0_2_00BC1338
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00BB2301	0_2_00BB2301
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00BA337C	0_2_00BA337C
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B99344	0_2_00B99344
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B764F4	0_2_00B764F4
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00BC34D4	0_2_00BC34D4
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B74414	0_2_00B74414
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B83414	0_2_00B83414
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B92404	0_2_00B92404
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B9E594	0_2_00B9E594
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00BC25FC	0_2_00BC25FC
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00BAB5CC	0_2_00BAB5CC
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00BB25CC	0_2_00BB25CC
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00BA05C4	0_2_00BA05C4
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00BAC534	0_2_00BAC534
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B776B4	0_2_00B776B4
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00BB46D4	0_2_00BB46D4
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B9460B	0_2_00B9460B
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00BB3674	0_2_00BB3674
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B98664	0_2_00B98664
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00BAC794	0_2_00BAC794
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B9F7D9	0_2_00B9F7D9
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00BB0774	0_2_00BB0774
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B8C74A	0_2_00B8C74A
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B8296C	0_2_00B8296C
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00BA1944	0_2_00BA1944
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B7AAB4	0_2_00B7AAB4
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00BB3AA4	0_2_00BB3AA4
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B77A84	0_2_00B77A84
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00BA0A89	0_2_00BA0A89
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B8CAF4	0_2_00B8CAF4
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00BA2ADA	0_2_00BA2ADA
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B87AD3	0_2_00B87AD3
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00BC2A34	0_2_00BC2A34
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00BA7A34	0_2_00BA7A34
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00BAAA20	0_2_00BAAA20
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00BA3A7C	0_2_00BA3A7C
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00BB2BA5	0_2_00BB2BA5
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B79B94	0_2_00B79B94
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B75BC4	0_2_00B75BC4
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B8FB44	0_2_00B8FB44
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B78CF4	0_2_00B78CF4
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B8DC64	0_2_00B8DC64
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B7FDA4	0_2_00B7FDA4
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B81D3A	0_2_00B81D3A
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B91D34	0_2_00B91D34
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00BADD04	0_2_00BADD04
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B8AD64	0_2_00B8AD64
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00BB3D54	0_2_00BB3D54
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B7AE94	0_2_00B7AE94
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B87EF1	0_2_00B87EF1
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B8BE68	0_2_00B8BE68
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B7EF84	0_2_00B7EF84
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B89F84	0_2_00B89F84
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B77F14	0_2_00B77F14

Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: String function: 00B85734 appears 128 times
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: String function: 00B79884 appears 69 times

Source: G7T8lHJWWM.exe, 00000000.00000000.2172640850.000000000061E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename, vs G7T8lHJWWM.exe
Source: G7T8lHJWWM.exe, 00000000.00000003.2282271778.0000000002C27000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename, vs G7T8lHJWWM.exe
Source: G7T8lHJWWM.exe	Binary or memory string: OriginalFilename, vs G7T8lHJWWM.exe

Source: G7T8lHJWWM.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@10/1

Source: C:\Users\user\Desktop\G7T8lHJWWM.exe

Code function: 0_2_00B70B87 CreateToolhelp32Snapshot,Thread32First,Wow64SuspendThread,CloseHandle,

0_2_00B70B87

Source: G7T8lHJWWM.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\G7T8lHJWWM.exe

Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Jump to behavior

Source: C:\Users\user\Desktop\G7T8lHJWWM.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: G7T8lHJWWM.exe	Virustotal: Detection: 9%
Source: G7T8lHJWWM.exe	ReversingLabs: Detection: 33%

Source: C:\Users\user\Desktop\G7T8lHJWWM.exe

File read: C:\Users\user\Desktop\G7T8lHJWWM.exe

Jump to behavior

Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Section loaded: dpapi.dll	Jump to behavior

Source: G7T8lHJWWM.exe

Static PE information: certificate valid

Source: G7T8lHJWWM.exe

Static PE information: More than 283 > 100 exports found

Source: G7T8lHJWWM.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: G7T8lHJWWM.exe

Static file information: File size 2667856 > 1048576

Source: G7T8lHJWWM.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x166400

Source: G7T8lHJWWM.exe

Static PE information: More than 200 imports for USER32.DLL

Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00BB3154 push eax; mov dword ptr [esp], 424D4C7Fh	0_2_00BB3158
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B7DE50 push ss; retf	0_2_00B7DE51
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00BABFE9 push esi; retf	0_2_00BABFF2

Source: C:\Users\user\Desktop\G7T8lHJWWM.exe TID: 3492	Thread sleep time: -60000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe TID: 4780	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: G7T8lHJWWM.exe, 00000000.00000002.2299376762.0000000000978000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009C8000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\G7T8lHJWWM.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B70477 mov edx, dword ptr fs:[00000030h]	0_2_00B70477
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B70A37 mov eax, dword ptr fs:[00000030h]	0_2_00B70A37
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B71087 mov eax, dword ptr fs:[00000030h]	0_2_00B71087
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B71086 mov eax, dword ptr fs:[00000030h]	0_2_00B71086
Source: C:\Users\user\Desktop\G7T8lHJWWM.exe	Code function: 0_2_00B70DE7 mov eax, dword ptr fs:[00000030h]	0_2_00B70DE7

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: G7T8lHJWWM.exe	String found in binary or memory: shoefeatthe.lat
Source: G7T8lHJWWM.exe	String found in binary or memory: finickypwk.lat
Source: G7T8lHJWWM.exe	String found in binary or memory: kickykiduz.lat
Source: G7T8lHJWWM.exe	String found in binary or memory: savorraiykj.lat
Source: G7T8lHJWWM.exe	String found in binary or memory: leggelatez.lat
Source: G7T8lHJWWM.exe	String found in binary or memory: miniatureyu.lat
Source: G7T8lHJWWM.exe	String found in binary or memory: bloodyswif.lat
Source: G7T8lHJWWM.exe	String found in binary or memory: washyceehsu.lat
Source: G7T8lHJWWM.exe	String found in binary or memory: plodnittpw.lat

Source: C:\Users\user\Desktop\G7T8lHJWWM.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 PowerShell	1 DLL Side-Loading	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	11 Deobfuscate/Decode Files or Information	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	2 System Information Discovery	Distributed Component Object Model	Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
G7T8lHJWWM.exe	10%	Virustotal		Browse
G7T8lHJWWM.exe	33%	ReversingLabs

Source	Detection	Scanner	Label
bloodyswif.lat	100%	Avira URL Cloud	malware
miniatureyu.lat	100%	Avira URL Cloud	malware
finickypwk.lat	100%	Avira URL Cloud	malware
leggelatez.lat	100%	Avira URL Cloud	malware
http://pwgen-win.sourceforge.nethttp://sourceforge.net/donate/index.php?group_id=57385http://pwgen-w	0%	Avira URL Cloud	safe
savorraiykj.lat	100%	Avira URL Cloud	malware
kickykiduz.lat	100%	Avira URL Cloud	malware
washyceehsu.lat	100%	Avira URL Cloud	malware
plodnittpw.lat	100%	Avira URL Cloud	malware
shoefeatthe.lat	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
steamcommunity.com	104.102.49.254	true	false	high
finickypwk.lat	unknown	unknown	true	unknown
washyceehsu.lat	unknown	unknown	true	unknown
kickykiduz.lat	unknown	unknown	true	unknown
bloodyswif.lat	unknown	unknown	true	unknown
shoefeatthe.lat	unknown	unknown	true	unknown
savorraiykj.lat	unknown	unknown	true	unknown
miniatureyu.lat	unknown	unknown	true	unknown
plodnittpw.lat	unknown	unknown	true	unknown
leggelatez.lat	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
bloodyswif.lat	true	Avira URL Cloud: malware	unknown
leggelatez.lat	true	Avira URL Cloud: malware	unknown
https://steamcommunity.com/profiles/76561199724331900	false		high
kickykiduz.lat	true	Avira URL Cloud: malware	unknown
miniatureyu.lat	true	Avira URL Cloud: malware	unknown
plodnittpw.lat	true	Avira URL Cloud: malware	unknown
finickypwk.lat	true	Avira URL Cloud: malware	unknown
shoefeatthe.lat	true	Avira URL Cloud: malware	unknown
washyceehsu.lat	true	Avira URL Cloud: malware	unknown
savorraiykj.lat	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp	false		high
https://player.vimeo.com	G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/?subsection=broadcasts	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/points/shopu	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/subscriber_agreement/	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.gstatic.cn/recaptcha/	G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.valvesoftware.com/legal.htm	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com	G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com	G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.0000000000984000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2299376762.0000000000978000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/	G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s.ytimg.com;	G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2299376762.0000000000978000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.certum.pl/CPS0	G7T8lHJWWM.exe	false		high
https://community.fastly.steamstatic.com/	G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/fatalerror.css?v=OFUqlcDNiD6y&l=engli	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steam.tv/	G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cevcsca2021.ocsp-certum.com07	G7T8lHJWWM.exe	false		high
http://crl.certum.pl/ctnca.crl0k	G7T8lHJWWM.exe	false		high
http://store.steampowered.com/privacy_agreement/	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2299376762.0000000000978000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/points/shop/	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cevcsca2021.crl.certum.pl/cevcsca2021.crl0w	G7T8lHJWWM.exe	false		high
https://sketchfab.com	G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lv.queniujq.cn	G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com/	G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/privacy_agreement/	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/of	G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A04000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009E3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=M_FULq_A	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2299376762.0000000000978000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/	G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://checkout.steampowered.com/	G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/;	G7T8lHJWWM.exe, 00000000.00000002.2299973443.00000000009CF000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/about/	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/my/wishlist/	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://repository.certum.pl/ctsca2021.cer0A	G7T8lHJWWM.exe	false		high
http://crl.certum.pl/ctsca2021.crl0o	G7T8lHJWWM.exe	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.steampowered.com/en/	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/market/	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/news/	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/subscriber_agreement/	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2299376762.0000000000978000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2299376762.0000000000978000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://recaptcha.net/recaptcha/;	G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://repository.certum.pl/cevcsca2021.cer0	G7T8lHJWWM.exe	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=Eq36AUaEgab8&l=en	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/discussions/	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/stats/	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://medal.tv	G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://broadcast.st.dl.eccdnx.com	G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/steam_refunds/	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp	false		high
http://subca.ocsp-certum.com05	G7T8lHJWWM.exe	false		high
http://subca.ocsp-certum.com02	G7T8lHJWWM.exe	false		high
http://subca.ocsp-certum.com01	G7T8lHJWWM.exe	false		high
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.certum.pl/ctnca2.crl0l	G7T8lHJWWM.exe	false		high
http://repository.certum.pl/ctnca2.cer09	G7T8lHJWWM.exe	false		high
https://steamcommunity.com/workshop/	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.steampowered.com/	G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb	G7T8lHJWWM.exe, 00000000.00000002.2299973443.00000000009CF000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009C8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/legal/	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2299376762.0000000000978000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://repository.certum.pl/ctnca.cer09	G7T8lHJWWM.exe	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=BFN_	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2299376762.0000000000978000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://recaptcha.net	G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/	G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.certum.pl/CPS0	G7T8lHJWWM.exe	false		high
https://steamcommunity.com	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2299376762.0000000000978000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp	false		high
http://127.0.0.1:27060	G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.steampowered.com/	G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.steampowered.com/	G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/account/cookiepreferences/	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2299376762.0000000000978000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/mobile	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/	G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298391985.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000002.2300113245.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pwgen-win.sourceforge.nethttp://sourceforge.net/donate/index.php?group_id=57385http://pwgen-w	G7T8lHJWWM.exe	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l	G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A12000.00000004.00000020.00020000.00000000.sdmp, G7T8lHJWWM.exe, 00000000.00000003.2298337079.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.102.49.254	steamcommunity.com	United States		16625	AKAMAI-ASUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1590539
Start date and time:	2025-01-14 08:54:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	G7T8lHJWWM.exe renamed because original name is a hash value
Original Sample Name:	3e7395ddfc7e38e08e6be54e3ba7c9de2d7ea1a73c9926ab607c76f3031394f6.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@10/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 8 Number of non-executed functions: 114
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 20.109.210.53, 2.23.77.188, 13.95.31.18, 13.107.246.45
Excluded domains from analysis (whitelisted): client.wns.windows.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, e3913.cd.akamaiedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com, cac-ocsp.digicert.com.edgekey.net, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:55:21	API Interceptor	3x Sleep call for process: G7T8lHJWWM.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.102.49.254	r4xiHKy8aM.exe	Get hash	malicious	Socks5Systemz	Browse	/ISteamUser/GetFriendList/v1/?key=AE2AE4DBF33A541E83BC08989DB1F397&steamid=76561198400860497
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	009.vbe	Get hash	malicious	AgentTesla	Browse	199.232.210.172
	577119676170175151.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	RFQ.exe	Get hash	malicious	Quasar, PureLog Stealer	Browse	199.232.210.172
	possible SPAM## Msig Insurance Europe Complete via-Sign Monday January 2025.msg	Get hash	malicious	Unknown	Browse	199.232.214.172
	3ClBcOpPUX.exe	Get hash	malicious	CyberGate	Browse	199.232.210.172
	40#U0433.doc	Get hash	malicious	Unknown	Browse	199.232.214.172
	KymUijfvKi.doc	Get hash	malicious	Unknown	Browse	199.232.210.172
	Rev5_ Joint Declaration C5 GER_track changes.doc	Get hash	malicious	Unknown	Browse	199.232.210.172
	RoYAd85faz.doc	Get hash	malicious	Unknown	Browse	199.232.210.172
	40#U0433.doc	Get hash	malicious	Unknown	Browse	199.232.210.172
steamcommunity.com	92.255.57_2.112.ps1	Get hash	malicious	LummaC	Browse	104.102.49.254
	uo9m.exe	Get hash	malicious	LummaC	Browse	23.197.127.21
	uo9m.exe	Get hash	malicious	LummaC	Browse	23.50.98.133
	L7GNkeVm5e.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	NDWffRLk7z.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	g3toRYa6JE.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	lBb4XI4eGD.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	UWYXurYZ2x.exe	Get hash	malicious	LummaC, Amadey, Babadeda, DanaBot, KeyLogger, LummaC Stealer, Poverty Stealer	Browse	104.102.49.254
	TBI87y49f9.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	H5JVfa61AV.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	possible SPAM## Msig Insurance Europe Complete via-Sign Monday January 2025.msg	Get hash	malicious	Unknown	Browse	23.47.168.24
	92.255.57_2.112.ps1	Get hash	malicious	LummaC	Browse	104.102.49.254
	https://fsgospefx6g2.sg.larksuite.com/wiki/Y7ybwFESRiirQPkoARZlhCyVgFb?	Get hash	malicious	HTMLPhisher	Browse	2.19.126.80
	https://staemcomnunlty.com/glft/91832	Get hash	malicious	Unknown	Browse	2.19.126.91
	https://fsgospefx6g2.sg.larksuite.com/wiki/Y7ybwFESRiirQPkoARZlhCyVgFb?	Get hash	malicious	HTMLPhisher	Browse	2.19.126.83
	uo9m.exe	Get hash	malicious	LummaC	Browse	23.50.98.133
	https://timecusa-my.sharepoint.com/:f:/p/stephensw/Erq5TMDIJBVBvh6vbWmpurEB4UwHKTW8nzSkPE2Ckmvugg?e=SepTcT	Get hash	malicious	HTMLPhisher	Browse	2.19.126.84
	Handler.exe	Get hash	malicious	DanaBot, Vidar	Browse	23.40.179.46
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse	2.19.126.75
	Cardfactory Executed Agreement DocsID- Sign & Review..eml	Get hash	malicious	HTMLPhisher	Browse	23.56.162.204

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	92.255.57_2.112.ps1	Get hash	malicious	LummaC	Browse	104.102.49.254
	8e8JUOzOjR.exe	Get hash	malicious	DBatLoader	Browse	104.102.49.254
	UTstKgkJNY.exe	Get hash	malicious	DBatLoader	Browse	104.102.49.254
	On9ahUpI4R.exe	Get hash	malicious	DBatLoader	Browse	104.102.49.254
	JDQS879kiy.exe	Get hash	malicious	DBatLoader	Browse	104.102.49.254
	UAHIzSm2x2.exe	Get hash	malicious	DBatLoader	Browse	104.102.49.254
	LbZ88q4uPa.exe	Get hash	malicious	DBatLoader	Browse	104.102.49.254
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.102.49.254
	183643586-388657435.07.exe	Get hash	malicious	Unknown	Browse	104.102.49.254

File type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.601032134939483
TrID:	Win32 Executable (generic) a (10002005/4) 98.87% InstallShield setup (43055/19) 0.43% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Windows Screen Saver (13104/52) 0.13% DOS Executable Borland C++ (13009/5) 0.13%
File name:	G7T8lHJWWM.exe
File size:	2'667'856 bytes
MD5:	9928e66ecbb91e45d7d48fafc8a3e21f
SHA1:	e5ef6accf90da7c944548ec9196c31a611da5628
SHA256:	3e7395ddfc7e38e08e6be54e3ba7c9de2d7ea1a73c9926ab607c76f3031394f6
SHA512:	e81ca5273485b2e5ae9c799a702467801624927e712a17829e9f5a73d5f58b3962b0d4b0c7a7ffd581fce3919b048c17b46775fc20c4798a382c5ce479531428
SSDEEP:	49152:Sw/xoGWh/IMhFzFQfVYkIU1JNmNHp1GR9+p/cqT+Bcx:Sw/CFodhIbP1GRAUq9
TLSH:	00C58C11B30AC836D07227F4995BAB66A1B1BF643610DD8367E23E1C5EB46C43E3D297
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	0f33dc96c662138e

Static PE Info

General

Entrypoint:	0x4016c8
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:
Time Stamp:	0x57D1BD3C [Thu Sep 8 19:34:20 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	782537a5fa467186d66af5eac7a5dc70

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Certum Extended Validation Code Signing 2021 CA, O=Asseco Data Systems S.A., C=PL
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	26/11/2024 07:07:48 26/11/2025 07:07:47
Subject Chain	CN=T H SUPPORT SERVICES LTD, O=T H SUPPORT SERVICES LTD, STREET=Suites 10s And 11s Trafford House Chester Road, PostalCode=M32 0RS, L=Stretford, S=Greater Manchester, C=GB, SERIALNUMBER=07890919, OID.1.3.6.1.4.1.311.60.2.1.3=GB, OID.2.5.4.15=Private Organization
Version:	3
Thumbprint MD5:	99CC43DD50C8C235E6703FBFE86B0302
Thumbprint SHA-1:	21297766029D043DFBA740CD5203E45171FC8EAA
Thumbprint SHA-256:	0A2CAAF3A1E6490DE521CCCA8452705AF0BD9A4A91D7F02CD8D3588404BCF77C
Serial:	502F183B00B497DFC821D09DEB30526B

Entrypoint Preview

Instruction
jmp 00007F50C4D97402h
bound di, dword ptr [edx]
inc ebx
sub ebp, dword ptr [ebx]
dec eax
dec edi
dec edi
dec ebx
nop
jmp 00007F50C52FF48Dh
mov eax, dword ptr [0056808Bh]
shl eax, 02h
mov dword ptr [0056808Fh], eax
push edx
push 00000000h
call 00007F50C4EFC308h
mov edx, eax
call 00007F50C4EE922Bh
pop edx
call 00007F50C4EE9189h
call 00007F50C4EE9260h
push 00000000h
call 00007F50C4EEB8D9h
pop ecx
push 00568034h
push 00000000h
call 00007F50C4EFC2E2h
mov dword ptr [00568093h], eax
push 00000000h
jmp 00007F50C4EF58C0h
jmp 00007F50C4EEB907h
xor eax, eax
mov al, byte ptr [0056807Dh]
ret
mov eax, dword ptr [00568093h]
ret
pushad
mov ebx, BCB05000h
push ebx
push 00000BADh
ret
mov ecx, 000000CCh
or ecx, ecx
je 00007F50C4D9743Fh
cmp dword ptr [0056808Bh], 00000000h
jnc 00007F50C4D973FCh
mov eax, 000000FEh
call 00007F50C4D973CCh
mov ecx, 000000CCh
push ecx
push 00000008h
call 00007F50C4EFC29Fh
push eax
call 00007F50C4EFC3A1h
or eax, eax
jne 00007F50C4D973FCh
mov eax, 000000FDh
call 00007F50C4D973ABh
push eax
push eax
push dword ptr [0056808Bh]
call 00007F50C4EF5A8Ah
push dword ptr [0056808Bh]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x1b3000	0x21754	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1af000	0x3ebb	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1d5000	0x68400	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x288c00	0x2950	.reloc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x1ae000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x167000	0x166400	114461da172a78854a3047f93a577af5	False	0.48329757828855546	data	6.5422380481820674	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x168000	0x45000	0x3d000	1ba3b0fbc421256da49335c0cd5e4580	False	0.3366178919057377	data	5.055084597758105	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x1ad000	0x1000	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x1ae000	0x1000	0x200	04893e65da93b44426dd8c0b15bd02d1	False	0.05078125	data	0.2044881574398449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.idata	0x1af000	0x4000	0x4000	e7b5fa464c7584ec15a6d24157210fbf	False	0.304931640625	data	5.240601010287695	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.edata	0x1b3000	0x22000	0x21800	d230081f8c46f8527715decf71e70a0b	False	0.20841592817164178	data	5.648414786049198	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x1d5000	0x69000	0x68400	1c963a1db28f7b1e42ba9545736ab3a3	False	0.19399636540767387	data	4.206417940488535	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x23e000	0x750b2	0x57200	da655f7be3e170b61315e9dd39a88a7a	False	0.680472112625538	data	7.491683269793998	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x1d635c	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"			0.38636363636363635
RT_CURSOR	0x1d6490	0x134	data			0.4642857142857143
RT_CURSOR	0x1d65c4	0x134	data			0.4805194805194805
RT_CURSOR	0x1d66f8	0x134	data			0.38311688311688313
RT_CURSOR	0x1d682c	0x134	data			0.36038961038961037
RT_CURSOR	0x1d6960	0x134	data			0.4090909090909091
RT_CURSOR	0x1d6a94	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"			0.4967532467532468
RT_BITMAP	0x1d6bc8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.43103448275862066
RT_BITMAP	0x1d6d98	0x1e4	Device independent bitmap graphic, 36 x 19 x 4, image size 380			0.46487603305785125
RT_BITMAP	0x1d6f7c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.43103448275862066
RT_BITMAP	0x1d714c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39870689655172414
RT_BITMAP	0x1d731c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.4245689655172414
RT_BITMAP	0x1d74ec	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5021551724137931
RT_BITMAP	0x1d76bc	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5064655172413793
RT_BITMAP	0x1d788c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39655172413793105
RT_BITMAP	0x1d7a5c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5344827586206896
RT_BITMAP	0x1d7c2c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39655172413793105
RT_BITMAP	0x1d7dfc	0xd8	Device independent bitmap graphic, 14 x 14 x 4, image size 112			0.4074074074074074
RT_BITMAP	0x1d7ed4	0xd8	Device independent bitmap graphic, 14 x 14 x 4, image size 112			0.38425925925925924
RT_BITMAP	0x1d7fac	0xd8	Device independent bitmap graphic, 14 x 14 x 4, image size 112			0.35185185185185186
RT_BITMAP	0x1d8084	0xd8	Device independent bitmap graphic, 14 x 14 x 4, image size 112			0.5509259259259259
RT_BITMAP	0x1d815c	0xd8	Device independent bitmap graphic, 14 x 14 x 4, image size 112			0.4074074074074074
RT_BITMAP	0x1d8234	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128			0.4870689655172414
RT_BITMAP	0x1d831c	0x188	Device independent bitmap graphic, 24 x 24 x 4, image size 288	English	United States	0.32908163265306123
RT_BITMAP	0x1d84a4	0x188	Device independent bitmap graphic, 24 x 24 x 4, image size 288	English	United States	0.32908163265306123
RT_BITMAP	0x1d862c	0x188	Device independent bitmap graphic, 24 x 24 x 4, image size 288	English	United States	0.3137755102040816
RT_BITMAP	0x1d87b4	0x188	Device independent bitmap graphic, 24 x 24 x 4, image size 288	English	United States	0.33418367346938777
RT_ICON	0x1d893c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	German	Germany	0.5405405405405406
RT_ICON	0x1d8a64	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	German	Germany	0.31647398843930635
RT_ICON	0x1d8fcc	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	German	Germany	0.48936170212765956
RT_ICON	0x1d9434	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	German	Germany	0.5094086021505376
RT_ICON	0x1d971c	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	German	Germany	0.44945848375451264
RT_ICON	0x1d9fc4	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	German	Germany	0.33419324577861165
RT_ICON	0x1db06c	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 0	German	Germany	0.42317073170731706
RT_ICON	0x1db6d4	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	German	Germany	0.43150319829424305
RT_ICON	0x1dc57c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	German	Germany	0.2654564315352697
RT_ICON	0x1deb24	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 0	German	Germany	0.06756146995295441
RT_DIALOG	0x220b4c	0x52	data			0.7682926829268293
RT_STRING	0x220ba0	0xe8	data			0.5172413793103449
RT_STRING	0x220c88	0xec	data			0.5508474576271186
RT_STRING	0x220d74	0x210	data			0.4715909090909091
RT_STRING	0x220f84	0x3c0	data			0.3614583333333333
RT_STRING	0x221344	0x35c	data			0.4104651162790698
RT_STRING	0x2216a0	0x310	data			0.36607142857142855
RT_STRING	0x2219b0	0x3ec	data			0.33565737051792827
RT_STRING	0x221d9c	0x398	data			0.38369565217391305
RT_STRING	0x222134	0x3f0	data			0.3412698412698413
RT_STRING	0x222524	0x454	data			0.41245487364620936
RT_STRING	0x222978	0x40c	data			0.42084942084942084
RT_STRING	0x222d84	0x1bc	data			0.5225225225225225
RT_STRING	0x222f40	0xec	data			0.597457627118644
RT_STRING	0x22302c	0x24c	data			0.4523809523809524
RT_STRING	0x223278	0x140	data			0.55625
RT_STRING	0x2233b8	0x428	data			0.37781954887218044
RT_STRING	0x2237e0	0x40c	data			0.37934362934362936
RT_STRING	0x223bec	0x4ec	data			0.3531746031746032
RT_STRING	0x2240d8	0x444	data			0.33791208791208793
RT_RCDATA	0x22451c	0x10	data			1.5
RT_RCDATA	0x22452c	0x5b2f	Delphi compiled form 'TAboutForm'			0.9458510045838153
RT_RCDATA	0x22a05c	0x265	Delphi compiled form 'TCallbackForm'			0.6508972267536705
RT_RCDATA	0x22a2c4	0xe6e	Delphi compiled form 'TConfigurationDlg'			0.3952355170546833
RT_RCDATA	0x22b134	0x695	Delphi compiled form 'TCreateRandDataFileDlg'			0.4362017804154303
RT_RCDATA	0x22b7cc	0x5ba	Delphi compiled form 'TCreateTrigramFileDlg'			0.43997271487039563
RT_RCDATA	0x22bd88	0xbfdf	Delphi compiled form 'TMainForm'			0.38683605122254117
RT_RCDATA	0x237d68	0x2360	Delphi compiled form 'TMPPasswGenDlg'			0.3099602473498233
RT_RCDATA	0x23a0c8	0x613	Delphi compiled form 'TPasswEnterDlg'			0.40514469453376206
RT_RCDATA	0x23a6dc	0x618	Delphi compiled form 'TPasswListForm'			0.42948717948717946
RT_RCDATA	0x23acf4	0xe1d	Delphi compiled form 'TPasswOptionsDlg'			0.40381954054802105
RT_RCDATA	0x23bb14	0x685	Delphi compiled form 'TProfileEditDlg'			0.4415817855002996
RT_RCDATA	0x23c19c	0x456	Delphi compiled form 'TProvideEntropyDlg'			0.5900900900900901
RT_RCDATA	0x23c5f4	0x4c1	Delphi compiled form 'TQuickHelpForm'			0.485620377978636
RT_GROUP_CURSOR	0x23cab8	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0x23cacc	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0x23cae0	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x23caf4	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x23cb08	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x23cb1c	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x23cb30	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_ICON	0x23cb44	0x92	data	German	Germany	0.6164383561643836
RT_VERSION	0x23cbd8	0x324	data	English	United States	0.4689054726368159
RT_MANIFEST	0x23cefc	0x38e	XML 1.0 document, ASCII text, with CRLF line terminators	German	Germany	0.45604395604395603

Imports

DLL	Import
ADVAPI32.DLL	CryptAcquireContextA, CryptGenRandom, GetUserNameA, GetUserNameW, RegCloseKey, RegFlushKey, RegOpenKeyExA, RegQueryValueExA
KERNEL32.DLL	CloseHandle, CompareStringA, CompareStringW, CopyFileA, CopyFileW, CreateDirectoryA, CreateDirectoryW, CreateEventA, CreateFileA, CreateFileW, CreateMutexA, CreateProcessA, CreateProcessW, CreateThread, DeleteCriticalSection, DeleteFileA, DeleteFileW, EnterCriticalSection, EnumCalendarInfoA, ExitProcess, ExitThread, FileTimeToDosDateTime, FileTimeToLocalFileTime, FileTimeToSystemTime, FindClose, FindFirstFileA, FindFirstFileW, FindNextFileA, FindNextFileW, FindResourceA, FindResourceW, FormatMessageA, FormatMessageW, FreeLibrary, FreeResource, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetComputerNameA, GetComputerNameW, GetCurrencyFormatA, GetCurrencyFormatW, GetCurrentDirectoryA, GetCurrentDirectoryW, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetDateFormatA, GetDiskFreeSpaceA, GetDiskFreeSpaceW, GetDriveTypeA, GetEnvironmentStrings, GetEnvironmentVariableA, GetExitCodeThread, GetFileAttributesA, GetFileAttributesW, GetFileSize, GetFileType, GetFullPathNameA, GetFullPathNameW, GetLastError, GetLocalTime, GetLocaleInfoA, GetLocaleInfoW, GetLogicalDrives, GetModuleFileNameA, GetModuleFileNameW, GetModuleHandleA, GetOEMCP, GetProcAddress, GetProcessHeap, GetProcessTimes, GetProcessWorkingSetSize, GetProfileStringA, GetShortPathNameA, GetShortPathNameW, GetStartupInfoA, GetStdHandle, GetStringTypeA, GetStringTypeExA, GetStringTypeExW, GetStringTypeW, GetSystemDefaultLCID, GetSystemDefaultLangID, GetSystemDirectoryA, GetSystemDirectoryW, GetSystemInfo, GetSystemTimeAsFileTime, GetTempFileNameA, GetTempFileNameW, GetTempPathA, GetTempPathW, GetThreadLocale, GetThreadTimes, GetTickCount, GetTimeZoneInformation, GetUserDefaultLCID, GetUserDefaultLangID, GetVersion, GetVersionExA, GetVolumeInformationW, GetWindowsDirectoryA, GetWindowsDirectoryW, GlobalAddAtomA, GlobalAlloc, GlobalDeleteAtom, GlobalFindAtomA, GlobalFree, GlobalHandle, GlobalLock, GlobalMemoryStatus, GlobalReAlloc, GlobalSize, GlobalUnlock, HeapAlloc, HeapFree, InitializeCriticalSection, InterlockedDecrement, InterlockedExchange, InterlockedIncrement, IsProcessorFeaturePresent, IsValidLocale, LCMapStringA, LCMapStringW, LeaveCriticalSection, LoadLibraryA, LoadLibraryExA, LoadLibraryExW, LoadLibraryW, LoadResource, LocalAlloc, LocalFree, LockResource, MoveFileA, MoveFileW, MulDiv, MultiByteToWideChar, OutputDebugStringA, QueryPerformanceCounter, QueryPerformanceFrequency, RaiseException, ReadFile, RemoveDirectoryA, RemoveDirectoryW, ResetEvent, ResumeThread, RtlUnwind, SetConsoleCtrlHandler, SetCurrentDirectoryA, SetCurrentDirectoryW, SetEndOfFile, SetEnvironmentVariableA, SetErrorMode, SetEvent, SetFileAttributesA, SetFileAttributesW, SetFilePointer, SetHandleCount, SetLastError, SetThreadLocale, SetThreadPriority, SizeofResource, Sleep, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnhandledExceptionFilter, VirtualAlloc, VirtualFree, VirtualLock, VirtualProtect, VirtualQuery, VirtualUnlock, WaitForSingleObject, WideCharToMultiByte, WriteFile, WriteProfileStringA, lstrcmpA, lstrcmpW, lstrcpyA, lstrcpynA, lstrlenA, GetVolumeInformationA
VERSION.DLL	GetFileVersionInfoA, GetFileVersionInfoSizeA, GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueA, VerQueryValueW
WINSPOOL.DRV	ClosePrinter, DocumentPropertiesA, EnumPrintersA, OpenPrinterA
COMCTL32.DLL	ImageList_Add, ImageList_BeginDrag, ImageList_Create, ImageList_Destroy, ImageList_DragEnter, ImageList_DragLeave, ImageList_DragMove, ImageList_DragShowNolock, ImageList_Draw, ImageList_DrawEx, ImageList_EndDrag, ImageList_GetBkColor, ImageList_GetDragImage, ImageList_GetIconSize, ImageList_GetImageCount, ImageList_Read, ImageList_Remove, ImageList_Replace, ImageList_ReplaceIcon, ImageList_SetBkColor, ImageList_SetDragCursorImage, ImageList_SetIconSize, ImageList_Write
COMDLG32.DLL	ChooseColorA, ChooseFontA, FindTextA, GetOpenFileNameA, GetOpenFileNameW, GetSaveFileNameA, PrintDlgA, ReplaceTextA, GetSaveFileNameW
GDI32.DLL	BitBlt, CombineRgn, CopyEnhMetaFileA, CreateBitmap, CreateBrushIndirect, CreateCompatibleBitmap, CreateCompatibleDC, CreateDCA, CreateDIBSection, CreateDIBitmap, CreateFontIndirectA, CreateHalftonePalette, CreateICA, CreatePalette, CreatePenIndirect, CreateRectRgn, CreateSolidBrush, DeleteDC, DeleteEnhMetaFile, DeleteObject, Ellipse, EndDoc, EndPage, EnumFontFamiliesExA, ExcludeClipRect, ExtCreatePen, ExtTextOutA, ExtTextOutW, GdiFlush, GetBitmapBits, GetBrushOrgEx, GetClipBox, GetClipRgn, GetCurrentPositionEx, GetDCOrgEx, GetDIBColorTable, GetDIBits, GetDeviceCaps, GetEnhMetaFileBits, GetEnhMetaFileHeader, GetEnhMetaFilePaletteEntries, GetObjectA, GetPaletteEntries, GetPixel, GetRgnBox, GetStockObject, GetSystemPaletteEntries, GetTextExtentPoint32A, GetTextExtentPoint32W, GetTextExtentPointA, GetTextExtentPointW, GetTextMetricsA, GetWinMetaFileBits, GetWindowOrgEx, IntersectClipRect, LineTo, MaskBlt, MoveToEx, PatBlt, Pie, PlayEnhMetaFile, PolyPolyline, Polyline, RealizePalette, RectVisible, Rectangle, RestoreDC, RoundRect, SaveDC, SelectClipRgn, SelectObject, SelectPalette, SetAbortProc, SetBkColor, SetBkMode, SetBrushOrgEx, SetDIBColorTable, SetEnhMetaFileBits, SetMapMode, SetPixel, SetROP2, SetStretchBltMode, SetTextColor, SetViewportExtEx, SetViewportOrgEx, SetWinMetaFileBits, SetWindowExtEx, SetWindowOrgEx, StartDocA, StartPage, StretchBlt, TranslateCharsetInfo, UnrealizeObject
SHELL32.DLL	ExtractAssociatedIconA, ExtractAssociatedIconW, ExtractIconExA, ExtractIconExW, SHBrowseForFolderA, SHFileOperationA, SHFreeNameMappings, SHGetFileInfoA, ShellExecuteA, ShellExecuteW, Shell_NotifyIconA, Shell_NotifyIconW, SHGetPathFromIDListA
SHFOLDER.DLL	SHGetFolderPathA, SHGetFolderPathW
USER32.DLL	ActivateKeyboardLayout, AdjustWindowRectEx, BeginDeferWindowPos, BeginPaint, BringWindowToTop, CallNextHookEx, CallWindowProcA, CallWindowProcW, CharLowerA, CharLowerBuffA, CharLowerBuffW, CharLowerW, CharNextA, CharUpperA, CharUpperBuffA, CharUpperBuffW, CharUpperW, CheckMenuItem, ChildWindowFromPoint, ClientToScreen, CloseClipboard, CreateIcon, CreateMDIWindowW, CreateMenu, CreatePopupMenu, CreateWindowExA, CreateWindowExW, DefFrameProcA, DefFrameProcW, DefMDIChildProcA, DefMDIChildProcW, DefWindowProcA, DefWindowProcW, DeferWindowPos, DeleteMenu, DestroyCursor, DestroyIcon, DestroyMenu, DestroyWindow, DispatchMessageA, DispatchMessageW, DrawEdge, DrawFocusRect, DrawFrameControl, DrawIcon, DrawIconEx, DrawMenuBar, DrawTextA, DrawTextW, EmptyClipboard, EnableMenuItem, EnableScrollBar, EnableWindow, EndDeferWindowPos, EndPaint, EnumClipboardFormats, EnumThreadWindows, EnumWindows, EqualRect, FillRect, FindWindowA, FrameRect, GetActiveWindow, GetCapture, GetCaretBlinkTime, GetCaretPos, GetClassInfoA, GetClassInfoW, GetClassNameA, GetClassNameW, GetClientRect, GetClipboardData, GetClipboardOwner, GetClipboardViewer, GetCursor, GetCursorPos, GetDC, GetDCEx, GetDesktopWindow, GetDialogBaseUnits, GetDlgItem, GetDoubleClickTime, GetFocus, GetForegroundWindow, GetIconInfo, GetInputState, GetKeyNameTextA, GetKeyNameTextW, GetKeyState, GetKeyboardLayout, GetKeyboardLayoutList, GetKeyboardState, GetKeyboardType, GetLastActivePopup, GetMenu, GetMenuItemCount, GetMenuItemID, GetMenuItemInfoA, GetMenuItemInfoW, GetMenuState, GetMenuStringA, GetMenuStringW, GetMessagePos, GetMessageTime, GetOpenClipboardWindow, GetParent, GetProcessWindowStation, GetPropA, GetQueueStatus, GetScrollInfo, GetScrollPos, GetScrollRange, GetSubMenu, GetSystemMenu, GetSystemMetrics, GetTopWindow, GetUpdateRect, GetWindow, GetWindowDC, GetWindowLongA, GetWindowLongW, GetWindowPlacement, GetWindowRect, GetWindowTextA, GetWindowTextLengthW, GetWindowTextW, GetWindowThreadProcessId, InflateRect, InsertMenuA, InsertMenuItemA, InsertMenuItemW, IntersectRect, InvalidateRect, IsCharAlphaA, IsCharAlphaNumericA, IsChild, IsClipboardFormatAvailable, IsDialogMessageA, IsDialogMessageW, IsIconic, IsRectEmpty, IsWindow, IsWindowEnabled, IsWindowUnicode, IsWindowVisible, IsZoomed, KillTimer, LoadBitmapA, LoadCursorA, LoadIconA, LoadImageA, LoadKeyboardLayoutA, LoadStringA, LoadStringW, MapVirtualKeyA, MapVirtualKeyW, MapWindowPoints, MessageBeep, MessageBoxA, MessageBoxW, MsgWaitForMultipleObjects, OemToCharA, OffsetRect, OpenClipboard, PeekMessageA, PostMessageA, PostMessageW, PostQuitMessage, PtInRect, RedrawWindow, RegisterClassA, RegisterClassW, RegisterClipboardFormatA, RegisterHotKey, RegisterWindowMessageA, ReleaseCapture, ReleaseDC, RemoveMenu, RemovePropA, ScreenToClient, ScrollWindow, ScrollWindowEx, SendDlgItemMessageA, SendMessageA, SendMessageTimeoutA, SendMessageW, SetActiveWindow, SetCapture, SetClassLongA, SetClipboardData, SetCursor, SetFocus, SetForegroundWindow, SetKeyboardState, SetMenu, SetMenuItemInfoA, SetMenuItemInfoW, SetPropA, SetRect, SetScrollInfo, SetScrollPos, SetScrollRange, SetTimer, SetWindowLongA, SetWindowLongW, SetWindowPlacement, SetWindowPos, SetWindowTextA, SetWindowTextW, SetWindowsHookExA, SetWindowsHookExW, ShowCursor, ShowOwnedPopups, ShowScrollBar, ShowWindow, SystemParametersInfoA, TrackPopupMenu, TranslateMDISysAccel, TranslateMessage, UnhookWindowsHookEx, UnionRect, UnregisterClassA, UnregisterClassW, UnregisterHotKey, UpdateWindow, ValidateRect, VkKeyScanW, WaitMessage, WinHelpA, WindowFromPoint, wsprintfA, GetSysColor
OLE32.DLL	CoCreateInstance, CoInitialize, CoLockObjectExternal, CoTaskMemAlloc, CoTaskMemFree, CoUninitialize, DoDragDrop, IsEqualGUID, OleInitialize, OleUninitialize, ProgIDFromCLSID, RegisterDragDrop, ReleaseStgMedium, RevokeDragDrop, StringFromCLSID
OLEAUT32.DLL	GetActiveObject, GetErrorInfo, SafeArrayCreate, SafeArrayGetElement, SafeArrayGetLBound, SafeArrayGetUBound, SafeArrayPtrOfIndex, SafeArrayPutElement, SafeArrayRedim, SysAllocStringLen, SysFreeString, SysReAllocStringLen, VarCyFromStr, VarDateFromStr, VariantChangeType, VariantClear, VariantCopy, VariantCopyInd, VariantInit
WININET.DLL	DeleteUrlCacheEntryA, DeleteUrlCacheEntryW
URLMON.DLL	URLDownloadToCacheFileA, URLDownloadToCacheFileW

Exports

Name	Ordinal	Address
@$xp$10TCCalendar	2066	0x51a028
@$xp$17TPerformanceGraph	2139	0x51fd70
@$xp$17Tntforms@TTntForm	742	0x4e0458
@$xp$18Tntforms@TFormProc	735	0x4df7b4
@$xp$18Tntforms@TTntFrame	740	0x4dfbec
@$xp$20Tntstdctrls@TTntEdit	862	0x4e4a1c
@$xp$20Tntstdctrls@TTntMemo	868	0x4e5648
@$xp$21Tntbuttons@TTntBitBtn	1661	0x4f905c
@$xp$21Tntextctrls@TTntBevel	1182	0x4ef4c0
@$xp$21Tntextctrls@TTntImage	1180	0x4ef35c
@$xp$21Tntextctrls@TTntPanel	1186	0x4ef7a8
@$xp$21Tntextctrls@TTntShape	1176	0x4ef0cc
@$xp$21Tntmenus@TTntMainMenu	812	0x4e2348
@$xp$21Tntmenus@TTntMenuItem	810	0x4e2248
@$xp$21Tntstdctrls@TTntLabel	889	0x4e7df0
@$xp$22Tntactnlist@ITntAction	1278	0x4f2430
@$xp$22Tntactnlist@TTntAction	1282	0x4f26ac
@$xp$22Tntclasses@TTntStrings	152	0x4cbe48
@$xp$22Tntcomctrls@TTntUpDown	326	0x4d36dc
@$xp$22Tntforms@TTntScrollBox	736	0x4df8f4
@$xp$22Tntmenus@TTntPopupList	816	0x4e24a8
@$xp$22Tntmenus@TTntPopupMenu	814	0x4e2410
@$xp$22Tntstdctrls@TTntButton	891	0x4e84e0
@$xp$23Tntclasses@TAnsiStrings	164	0x4cc200
@$xp$23Tntcomctrls@TTntToolBar	306	0x4d1660
@$xp$23Tntgraphics@TTntPicture	798	0x4e1d20
@$xp$23Tntstdactns@TTntEditCut	1364	0x4f4840
@$xp$23Tntstdctrls@TTntListBox	885	0x4e72b4
@$xp$23Tntsysutils@TSearchRecW	1763	0x4fc9e0
@$xp$24Activeimm_tlb@IActiveIME	67	0x4c9eac
@$xp$24Tntclipbrd@TTntClipboard	1651	0x4f8a20
@$xp$24Tntcomctrls@TTntListItem	288	0x4cfcb4
@$xp$24Tntcomctrls@TTntListView	302	0x4d051c
@$xp$24Tntcomctrls@TTntRichEdit	310	0x4d1a1c
@$xp$24Tntcomctrls@TTntTabSheet	316	0x4d2f3c
@$xp$24Tntcomctrls@TTntTrackBar	320	0x4d3278
@$xp$24Tntcomctrls@TTntTreeNode	281	0x4cfa78
@$xp$24Tntcomctrls@TTntTreeView	353	0x4d5130
@$xp$24Tntcontrols@TWideCaption	691	0x4dd348
@$xp$24Tntextctrls@TTntPaintBox	1178	0x4ef214
@$xp$24Tntextctrls@TTntSplitter	1196	0x4f1380
@$xp$24Tntforms@TTntApplication	733	0x4df788
@$xp$24Tntforms@TTntCustomFrame	738	0x4dfa78
@$xp$24Tntstdactns@TTntEditCopy	1366	0x4f49bc
@$xp$24Tntstdactns@TTntEditUndo	1372	0x4f4e34
@$xp$24Tntstdactns@TTntFileExit	1412	0x4f6c38
@$xp$24Tntstdactns@TTntFileOpen	1404	0x4f65d8
@$xp$24Tntstdactns@TTntFontEdit	1424	0x4f750c
@$xp$24Tntstdactns@TTntPrintDlg	1428	0x4f7804
@$xp$24Tntstdctrls@TTntCheckBox	895	0x4e880c
@$xp$24Tntstdctrls@TTntComboBox	876	0x4e63dc
@$xp$24Tntstdctrls@TTntGroupBox	903	0x4e9408
@$xp$25Activeimm_tlb@IActiveIME2	68	0x4c9ee4
@$xp$25Activeimm_tlb@TCActiveIMM	72	0x4ca054
@$xp$25Tntclasses@TTntFileStream	158	0x4cbf94
@$xp$25Tntclasses@TTntStringList	154	0x4cbe98
@$xp$25Tntclasses@TntClasses__11	175	0x4cc6a8
@$xp$25Tntcomctrls@TTntListItems	292	0x4cfde4
@$xp$25Tntcomctrls@TTntStatusBar	340	0x4d445c
@$xp$25Tntcomctrls@TTntTreeNodes	345	0x4d4bdc
@$xp$25Tntdialogs@TTntOpenDialog	1863	0x4ff604
@$xp$25Tntdialogs@TTntSaveDialog	1865	0x4ff7a8
@$xp$25Tntstdactns@TTntEditPaste	1368	0x4f4b34
@$xp$25Tntstdctrls@TTntScrollBar	899	0x4e910c
@$xp$25Tntsysutils@ETntUserError	1756	0x4fc834
@$xp$25Tntsysutils@TWideFileName	1762	0x4fc9cc
@$xp$26Activeimm_tlb@CoCActiveIMM	70	0x4c9f78
@$xp$26Tntactnlist@TTntActionList	1277	0x4f2404
@$xp$26Tntbuttons@ITntGlyphButton	1657	0x4f8c38
@$xp$26Tntbuttons@TTntSpeedButton	1659	0x4f8e0c
@$xp$26Tntchecklst@TntCheckLst__2	1151	0x4ee8a8
@$xp$26Tntchecklst@TntCheckLst__3	1152	0x4ee8cc
@$xp$26Tntchecklst@TntCheckLst__4	1153	0x4ee8f0
@$xp$26Tntcomctrls@TTntListColumn	284	0x4cfb34
@$xp$26Tntcomctrls@TTntTabControl	314	0x4d2684
@$xp$26Tntcomctrls@TTntToolButton	304	0x4d1464
@$xp$26Tntcontrols@TTntHintWindow	695	0x4dd610
@$xp$26Tntextctrls@TTntControlBar	1190	0x4f02a4
@$xp$26Tntextctrls@TTntRadioGroup	1194	0x4f0d70
@$xp$26Tntstdactns@TTntEditAction	1362	0x4f46c8
@$xp$26Tntstdactns@TTntEditDelete	1374	0x4f4fac
@$xp$26Tntstdactns@TTntFileAction	1402	0x4f649c
@$xp$26Tntstdactns@TTntFileSaveAs	1408	0x4f6918
@$xp$26Tntstdactns@TTntHelpAction	1390	0x4f5bd4
@$xp$26Tntstdactns@TTntHelpOnHelp	1396	0x4f604c
@$xp$26Tntstdactns@TTntHintAction	1360	0x4f456c
@$xp$26Tntstdactns@TTntSearchFind	1416	0x4f6efc
@$xp$26Tntstdctrls@TTntCustomEdit	860	0x4e4880
@$xp$26Tntstdctrls@TTntCustomMemo	866	0x4e54a4
@$xp$26Tntstdctrls@TTntStaticText	907	0x4e9cb4
@$xp$26Tntsystem@TTntSystemUpdate	1910	0x501894
@$xp$27Activeimm_tlb@IActiveIMMApp	65	0x4c9e34
@$xp$27Activeimm_tlb@IActiveIMMIME	66	0x4c9e70
@$xp$27Cdiroutl@TCDirectoryOutline	2088	0x51be80
@$xp$27Tntclasses@TSetAnsiStrEvent	178	0x4cc790
@$xp$27Tntclasses@TTntMemoryStream	160	0x4cc040
@$xp$27Tntcomctrls@TTntListColumns	286	0x4cfc08
@$xp$27Tntcomctrls@TTntPageControl	318	0x4d3100
@$xp$27Tntcomctrls@TTntProgressBar	322	0x4d33f4
@$xp$27Tntcomctrls@TTntStatusPanel	334	0x4d4078
@$xp$27Tntextctrls@TTntCustomPanel	1184	0x4ef63c
@$xp$27Tntstdactns@TTntColorSelect	1426	0x4f7684
@$xp$27Tntstdactns@TTntWindowClose	1378	0x4f52a8
@$xp$27Tntstdctrls@TTntCustomLabel	887	0x4e7cb4
@$xp$27Tntstdctrls@TTntMemoStrings	864	0x4e5308
@$xp$27Tntstdctrls@TTntRadioButton	897	0x4e8f70
@$xp$27Tntwidestrings@TWideStrings	1978	0x504a1c
@$xp$28Tntactnlist@TTntCustomAction	1280	0x4f2574
@$xp$28Tntchecklst@TTntCheckListBox	1155	0x4eeb20
@$xp$28Tntclasses@TTntStreamCharSet	155	0x4cbec4
@$xp$28Tntcomctrls@TTntCustomUpDown	324	0x4d3570
@$xp$28Tntcomctrls@TTntPageScroller	332	0x4d3f98
@$xp$28Tntcomctrls@TTntStatusPanels	336	0x4d414c
@$xp$28Tntstdactns@TTntFileOpenWith	1406	0x4f6778
@$xp$28Tntstdactns@TTntHelpContents	1392	0x4f5d50
@$xp$28Tntstdactns@TTntSearchAction	1414	0x4f6db8
@$xp$28Tntstdactns@TTntWindowAction	1376	0x4f512c
@$xp$28Tntsysutils@ETntGeneralError	1758	0x4fc8c0
@$xp$29Tntclasses@TListTargetCompare	156	0x4cbec4
@$xp$29Tntclasses@TTntResourceStream	162	0x4cc0ec
@$xp$29Tntcomctrls@TTntLVEditedEvent	293	0x4cfe10
@$xp$29Tntcomctrls@TTntMonthCalendar	330	0x4d3df8
@$xp$29Tntcomctrls@TTntTVEditedEvent	346	0x4d4c08
@$xp$29Tntcomctrls@TTntTreeNodeClass	283	0x4cfaa4
@$xp$29Tntdialogs@TIncludeItemEventW	1861	0x4ff4e4
@$xp$29Tntstdactns@TTntEditSelectAll	1370	0x4f4cb4
@$xp$29Tntstdactns@TTntSearchReplace	1418	0x4f7080
@$xp$29Tntstdactns@TTntWindowArrange	1388	0x4f5a58
@$xp$29Tntstdactns@TTntWindowCascade	1380	0x4f542c
@$xp$29Tntstdctrls@TTntCustomListBox	883	0x4e710c
@$xp$29Tntstdctrls@TWMCharMsgHandler	871	0x4e5f6c
@$xp$29Tntsystem@TTntSystemUpdateSet	1911	0x501910
@$xp$29Tntsysutils@ETntInternalError	1760	0x4fc950
@$xp$30Tntactnlist@TTntMenuActionLink	1284	0x4f27f4
@$xp$30Tntclasses@TBufferedAnsiString	172	0x4cc5d4
@$xp$30Tntclasses@TBufferedWideString	174	0x4cc678
@$xp$30Tntcomctrls@TTntCustomListView	300	0x4d0334
@$xp$30Tntcomctrls@TTntCustomRichEdit	308	0x4d186c
@$xp$30Tntcomctrls@TTntCustomTreeView	351	0x4d4f80
@$xp$30Tntcomctrls@TTntDateTimePicker	328	0x4d3c5c
@$xp$30Tntstdactns@TTntFilePrintSetup	1410	0x4f6abc
@$xp$30Tntstdactns@TTntSearchFindNext	1422	0x4f738c
@$xp$30Tntstdctrls@TTntCustomCheckBox	893	0x4e8690
@$xp$30Tntstdctrls@TTntCustomComboBox	874	0x4e620c
@$xp$30Tntstdctrls@TTntCustomGroupBox	901	0x4e9294
@$xp$30Tntstdctrls@TTntListBoxStrings	881	0x4e6ef4
@$xp$30Tntwidestrings@TWideStringItem	1972	0x504824
@$xp$31Activeimm_tlb@IEnumInputContext	62	0x4c9d6c
@$xp$31Tntclasses@TWideComponentHelper	180	0x4cc84c
@$xp$31Tntcomctrls@TTntCustomStatusBar	338	0x4d42dc
@$xp$31Tntstdactns@TTntHelpTopicSearch	1394	0x4f5ecc
@$xp$31Tntstdactns@TTntSearchFindFirst	1420	0x4f7208
@$xp$31Tntstdctrls@ITntComboFindString	872	0x4e5f98
@$xp$31Tntstdctrls@TLBGetWideDataEvent	877	0x4e6c24
@$xp$31Tntstdctrls@TTntComboBoxStrings	870	0x4e5f38
@$xp$32Activeimm_tlb@IEnumRegisterWordA	60	0x4c9cec
@$xp$32Activeimm_tlb@IEnumRegisterWordW	61	0x4c9d2c
@$xp$32Tntactnlist@TTntButtonActionLink	1294	0x4f2da4
@$xp$32Tntclasses@TBufferedStreamReader	177	0x4cc75c
@$xp$32Tntcomctrls@TTntCustomTabControl	312	0x4d2504
@$xp$32Tntcontrols@TTntCustomHintWindow	693	0x4dd4a4
@$xp$32Tntextctrls@TTntCustomControlBar	1188	0x4f0114
@$xp$32Tntextctrls@TTntCustomRadioGroup	1192	0x4f0c14
@$xp$32Tntstdctrls@TAccessCustomListBox	879	0x4e6dd4
@$xp$32Tntstdctrls@TTntCustomStaticText	905	0x4e9b40
@$xp$33Activeimm_tlb@IActiveIMMRegistrar	63	0x4c9dac
@$xp$33Tntactnlist@TTntControlActionLink	1274	0x4f233c
@$xp$33Tntstdactns@TTntHelpContextAction	1398	0x4f61cc
@$xp$33Tntstdactns@TTntWindowMinimizeAll	1386	0x4f58d0
@$xp$34Tntactnlist@TTntListViewActionLink	1286	0x4f2920
@$xp$34Tntcontrols@IWideCustomListControl	696	0x4dd63c
@$xp$34Tntformatstrutils@EFormatSpecError	1933	0x503004
@$xp$34Tntstdactns@TTntCommonDialogAction	1400	0x4f6358
@$xp$34Tntstdactns@TTntWindowTileVertical	1384	0x4f5744
@$xp$34Tntsysutils@TTntTextLineBreakStyle	1761	0x4fc980
@$xp$34Tntwidestrings@IWideStringsAdapter	1973	0x50484c
@$xp$34Tntwidestrings@PWideStringItemList	1974	0x50484c
@$xp$34Tntwidestrings@TWideStringItemList	1984	0x504a74
@$xp$35Tntcomctrls@TTntListItemsEnumerator	290	0x4cfd44
@$xp$35Tntcomctrls@TTntTreeNodesEnumerator	343	0x4d4b3c
@$xp$36Tntactnlist@TTntComboBoxExActionLink	1288	0x4f2a54
@$xp$36Tntactnlist@TTntToolButtonActionLink	1292	0x4f2c8c
@$xp$36Tntactnlist@TTntWinControlActionLink	1296	0x4f2ebc
@$xp$36Tntcomctrls@TTntLVOwnerDataFindEvent	294	0x4cfe5c
@$xp$36Tntstdactns@TTntWindowTileHorizontal	1382	0x4f55b8
@$xp$37Tntactnlist@TTntSpeedButtonActionLink	1290	0x4f2b70
@$xp$37Tntclasses@TWideStringListSortCompare	153	0x4cbe96
@$xp$37Tntwidestrings@TWideStringsEnumerator	1976	0x5048f4
@$xp$38Tntcomctrls@_TntInternalCustomListView	296	0x4d00c0
@$xp$38Tntcomctrls@_TntInternalCustomTreeView	348	0x4d4dbc
@$xp$39Tntactnlist@TUpgradeActionListItemsProc	1276	0x4f2370
@$xp$40Activeimm_tlb@IActiveIMMMessagePumpOwner	64	0x4c9dec
@$xp$44Tntclasses@TAnsiStringsForWideStringsAdapter	168	0x4cc33c
@$xp$7TCGauge	2109	0x51dd70
@@About@Finalize	27	0x433cc4
@@About@Initialize	26	0x433cb4
@@Aesctrprng@Finalize	49	0x4be778
@@Aesctrprng@Initialize	48	0x4be768
@@Callback@Finalize	25	0x4333f0
@@Callback@Initialize	24	0x4333e0
@@Ccalendr@Finalize	2069	0x51a8d4
@@Ccalendr@Initialize	2068	0x51a8c4
@@Cdiroutl@Finalize	2090	0x51c890
@@Cdiroutl@Initialize	2089	0x51c880
@@Cgauges@Finalize	2111	0x51e4bc
@@Cgauges@Initialize	2110	0x51e4ac
@@Configuration@Finalize	53	0x4c64f4
@@Configuration@Initialize	52	0x4c64dc
@@Createranddatafile@Finalize	29	0x434db8
@@Createranddatafile@Initialize	28	0x434da0
@@Createtrigramfile@Finalize	45	0x4bb840
@@Createtrigramfile@Initialize	44	0x4bb828
@@Crypttext@Finalize	17	0x42d9ac
@@Crypttext@Initialize	16	0x42d99c
@@Cryptutil@Finalize	51	0x4be8f8
@@Cryptutil@Initialize	50	0x4be8e8
@@Entropymanager@Finalize	13	0x42a84c
@@Entropymanager@Initialize	12	0x42a834
@@Fastprng@Finalize	35	0x4b83c8
@@Fastprng@Initialize	34	0x4b83b8
@@Hrtimer@Finalize	9	0x41c0c0
@@Hrtimer@Initialize	8	0x41c0b0
@@Language@Finalize	21	0x43196c
@@Language@Initialize	20	0x43195c
@@Main@Finalize	3	0x41acb0
@@Main@Initialize	2	0x41ac98
@@Meminifilew@Finalize	41	0x4ba478
@@Meminifilew@Initialize	40	0x4ba468
@@Memutil@Finalize	33	0x438300
@@Memutil@Initialize	32	0x4382f0
@@Mppasswgen@Finalize	47	0x4be4c8
@@Mppasswgen@Initialize	46	0x4be4b0
@@Passwgen@Finalize	11	0x42a2fc
@@Passwgen@Initialize	10	0x42a2ec
@@Passwlist@Finalize	15	0x42b510
@@Passwlist@Initialize	14	0x42b4f8
@@Passwoptions@Finalize	23	0x432e84
@@Passwoptions@Initialize	22	0x432e6c
@@Perfgrap@Finalize	2141	0x520034
@@Perfgrap@Initialize	2140	0x520024
@@Profileeditor@Finalize	37	0x4b9028
@@Profileeditor@Initialize	36	0x4b9010
@@Provideentropy@Finalize	55	0x4c6c58
@@Provideentropy@Initialize	54	0x4c6c40
@@Quickhelp@Finalize	31	0x438234
@@Quickhelp@Initialize	30	0x43821c
@@Randomgenerator@Finalize	7	0x41bf88
@@Randomgenerator@Initialize	6	0x41bf78
@@Randompool@Finalize	5	0x41bf38
@@Randompool@Initialize	4	0x41bf28
@@Stringfilestreamw@Finalize	43	0x4badd8
@@Stringfilestreamw@Initialize	42	0x4badc8
@@Topmostmanager@Finalize	59	0x4c9cd0
@@Topmostmanager@Initialize	58	0x4c9cc0
@@Unicodeutil@Finalize	39	0x4b9da4
@@Unicodeutil@Initialize	38	0x4b9d94
@@Updatecheck@Finalize	57	0x4c8870
@@Updatecheck@Initialize	56	0x4c8860
@@Util@Finalize	19	0x42ffa0
@@Util@Initialize	18	0x42ff88
@Activeimm_tlb@CLASS_CActiveIMM	2153	0x59bce4
@Activeimm_tlb@CoCActiveIMM@	69	0x4c9f64
@Activeimm_tlb@CoCActiveIMM@Create$qqrp17System@TMetaClass	73	0x4ca07c
@Activeimm_tlb@CoCActiveIMM@CreateRemote$qqrp17System@TMetaClassx17System@AnsiString	74	0x4ca0e0
@Activeimm_tlb@Finalization$qqrv	150	0x4cbe0c
@Activeimm_tlb@IID_IActiveIME	2151	0x59bcc4
@Activeimm_tlb@IID_IActiveIME2	2152	0x59bcd4
@Activeimm_tlb@IID_IActiveIMMApp	2149	0x59bca4
@Activeimm_tlb@IID_IActiveIMMIME	2150	0x59bcb4
@Activeimm_tlb@IID_IActiveIMMMessagePumpOwner	2148	0x59bc94
@Activeimm_tlb@IID_IActiveIMMRegistrar	2147	0x59bc84
@Activeimm_tlb@IID_IEnumInputContext	2146	0x59bc74
@Activeimm_tlb@IID_IEnumRegisterWordA	2144	0x59bc54
@Activeimm_tlb@IID_IEnumRegisterWordW	2145	0x59bc64
@Activeimm_tlb@LIBID_ActiveIMM	2143	0x59bc44
@Activeimm_tlb@TCActiveIMM@	71	0x4c9fec
@Activeimm_tlb@TCActiveIMM@$bctr$qqrp18Classes@TComponent	80	0x4ca354
@Activeimm_tlb@TCActiveIMM@$bdtr$qqrv	81	0x4ca38c
@Activeimm_tlb@TCActiveIMM@Activate$qqri	139	0x4cb9c8
@Activeimm_tlb@TCActiveIMM@AssociateContext$qqrr30Activeimm_tlb@_RemotableHandleuirui	82	0x4ca3b4
@Activeimm_tlb@TCActiveIMM@AssociateContextEx$qqrr30Activeimm_tlb@_RemotableHandleuiui	145	0x4cbbf4
@Activeimm_tlb@TCActiveIMM@ConfigureIMEA$qqrrpvr30Activeimm_tlb@_RemotableHandleuir46Activeimm_tlb@__MIDL___MIDL_itf_dimm_0000_0001	83	0x4ca414
@Activeimm_tlb@TCActiveIMM@ConfigureIMEW$qqrrpvr30Activeimm_tlb@_RemotableHandleuir46Activeimm_tlb@__MIDL___MIDL_itf_dimm_0000_0002	84	0x4ca478
@Activeimm_tlb@TCActiveIMM@Connect$qqrv	76	0x4ca16c

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
German	Germany

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-14T08:55:22.853835+0100	2059189	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bloodyswif .lat)	1	192.168.2.6	51366	1.1.1.1	53	UDP
2025-01-14T08:55:22.865132+0100	2059211	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (washyceehsu .lat)	1	192.168.2.6	63875	1.1.1.1	53	UDP
2025-01-14T08:55:22.877564+0100	2059201	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (leggelatez .lat)	1	192.168.2.6	53096	1.1.1.1	53	UDP
2025-01-14T08:55:22.888946+0100	2059203	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (miniatureyu .lat)	1	192.168.2.6	59227	1.1.1.1	53	UDP
2025-01-14T08:55:22.900201+0100	2059199	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (kickykiduz .lat)	1	192.168.2.6	59756	1.1.1.1	53	UDP
2025-01-14T08:55:22.910951+0100	2059207	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (savorraiykj .lat)	1	192.168.2.6	59592	1.1.1.1	53	UDP
2025-01-14T08:55:22.922550+0100	2059209	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (shoefeatthe .lat)	1	192.168.2.6	59454	1.1.1.1	53	UDP
2025-01-14T08:55:22.932749+0100	2059191	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (finickypwk .lat)	1	192.168.2.6	64570	1.1.1.1	53	UDP
2025-01-14T08:55:23.640697+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49755	104.102.49.254	443	TCP
2025-01-14T08:55:24.123032+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.6	49755	104.102.49.254	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 08:55:22.956357956 CET	49755	443	192.168.2.6	104.102.49.254
Jan 14, 2025 08:55:22.956425905 CET	443	49755	104.102.49.254	192.168.2.6
Jan 14, 2025 08:55:22.956497908 CET	49755	443	192.168.2.6	104.102.49.254
Jan 14, 2025 08:55:22.983589888 CET	49755	443	192.168.2.6	104.102.49.254
Jan 14, 2025 08:55:22.983627081 CET	443	49755	104.102.49.254	192.168.2.6
Jan 14, 2025 08:55:23.640611887 CET	443	49755	104.102.49.254	192.168.2.6
Jan 14, 2025 08:55:23.640697002 CET	49755	443	192.168.2.6	104.102.49.254
Jan 14, 2025 08:55:23.642146111 CET	49755	443	192.168.2.6	104.102.49.254
Jan 14, 2025 08:55:23.642152071 CET	443	49755	104.102.49.254	192.168.2.6
Jan 14, 2025 08:55:23.642658949 CET	443	49755	104.102.49.254	192.168.2.6
Jan 14, 2025 08:55:23.684398890 CET	49755	443	192.168.2.6	104.102.49.254
Jan 14, 2025 08:55:23.754621029 CET	49755	443	192.168.2.6	104.102.49.254
Jan 14, 2025 08:55:23.799333096 CET	443	49755	104.102.49.254	192.168.2.6
Jan 14, 2025 08:55:24.123054028 CET	443	49755	104.102.49.254	192.168.2.6
Jan 14, 2025 08:55:24.123079062 CET	443	49755	104.102.49.254	192.168.2.6
Jan 14, 2025 08:55:24.123120070 CET	49755	443	192.168.2.6	104.102.49.254
Jan 14, 2025 08:55:24.123121977 CET	443	49755	104.102.49.254	192.168.2.6
Jan 14, 2025 08:55:24.123138905 CET	443	49755	104.102.49.254	192.168.2.6
Jan 14, 2025 08:55:24.123173952 CET	443	49755	104.102.49.254	192.168.2.6
Jan 14, 2025 08:55:24.123195887 CET	443	49755	104.102.49.254	192.168.2.6
Jan 14, 2025 08:55:24.123223066 CET	49755	443	192.168.2.6	104.102.49.254
Jan 14, 2025 08:55:24.123223066 CET	49755	443	192.168.2.6	104.102.49.254
Jan 14, 2025 08:55:24.123223066 CET	49755	443	192.168.2.6	104.102.49.254
Jan 14, 2025 08:55:24.123260975 CET	49755	443	192.168.2.6	104.102.49.254
Jan 14, 2025 08:55:24.207751989 CET	443	49755	104.102.49.254	192.168.2.6
Jan 14, 2025 08:55:24.207829952 CET	443	49755	104.102.49.254	192.168.2.6
Jan 14, 2025 08:55:24.207910061 CET	49755	443	192.168.2.6	104.102.49.254
Jan 14, 2025 08:55:24.207973003 CET	49755	443	192.168.2.6	104.102.49.254
Jan 14, 2025 08:55:24.228765011 CET	49755	443	192.168.2.6	104.102.49.254
Jan 14, 2025 08:55:24.228806019 CET	443	49755	104.102.49.254	192.168.2.6
Jan 14, 2025 08:55:24.228820086 CET	49755	443	192.168.2.6	104.102.49.254
Jan 14, 2025 08:55:24.228827000 CET	443	49755	104.102.49.254	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 08:55:22.841058016 CET	53439	53	192.168.2.6	1.1.1.1
Jan 14, 2025 08:55:22.850780964 CET	53	53439	1.1.1.1	192.168.2.6
Jan 14, 2025 08:55:22.853835106 CET	51366	53	192.168.2.6	1.1.1.1
Jan 14, 2025 08:55:22.862679958 CET	53	51366	1.1.1.1	192.168.2.6
Jan 14, 2025 08:55:22.865132093 CET	63875	53	192.168.2.6	1.1.1.1
Jan 14, 2025 08:55:22.873991013 CET	53	63875	1.1.1.1	192.168.2.6
Jan 14, 2025 08:55:22.877563953 CET	53096	53	192.168.2.6	1.1.1.1
Jan 14, 2025 08:55:22.886214972 CET	53	53096	1.1.1.1	192.168.2.6
Jan 14, 2025 08:55:22.888946056 CET	59227	53	192.168.2.6	1.1.1.1
Jan 14, 2025 08:55:22.897633076 CET	53	59227	1.1.1.1	192.168.2.6
Jan 14, 2025 08:55:22.900201082 CET	59756	53	192.168.2.6	1.1.1.1
Jan 14, 2025 08:55:22.908620119 CET	53	59756	1.1.1.1	192.168.2.6
Jan 14, 2025 08:55:22.910950899 CET	59592	53	192.168.2.6	1.1.1.1
Jan 14, 2025 08:55:22.920286894 CET	53	59592	1.1.1.1	192.168.2.6
Jan 14, 2025 08:55:22.922549963 CET	59454	53	192.168.2.6	1.1.1.1
Jan 14, 2025 08:55:22.931195974 CET	53	59454	1.1.1.1	192.168.2.6
Jan 14, 2025 08:55:22.932749033 CET	64570	53	192.168.2.6	1.1.1.1
Jan 14, 2025 08:55:22.941490889 CET	53	64570	1.1.1.1	192.168.2.6
Jan 14, 2025 08:55:22.943902969 CET	57689	53	192.168.2.6	1.1.1.1
Jan 14, 2025 08:55:22.950923920 CET	53	57689	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 14, 2025 08:55:22.841058016 CET	192.168.2.6	1.1.1.1	0xd308	Standard query (0)	plodnittpw.lat	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:55:22.853835106 CET	192.168.2.6	1.1.1.1	0xfe04	Standard query (0)	bloodyswif.lat	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:55:22.865132093 CET	192.168.2.6	1.1.1.1	0xa3ff	Standard query (0)	washyceehsu.lat	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:55:22.877563953 CET	192.168.2.6	1.1.1.1	0x6511	Standard query (0)	leggelatez.lat	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:55:22.888946056 CET	192.168.2.6	1.1.1.1	0x6897	Standard query (0)	miniatureyu.lat	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:55:22.900201082 CET	192.168.2.6	1.1.1.1	0xbbef	Standard query (0)	kickykiduz.lat	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:55:22.910950899 CET	192.168.2.6	1.1.1.1	0xac2e	Standard query (0)	savorraiykj.lat	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:55:22.922549963 CET	192.168.2.6	1.1.1.1	0xd2c7	Standard query (0)	shoefeatthe.lat	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:55:22.932749033 CET	192.168.2.6	1.1.1.1	0x3797	Standard query (0)	finickypwk.lat	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:55:22.943902969 CET	192.168.2.6	1.1.1.1	0x59a4	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 14, 2025 08:55:22.850780964 CET	1.1.1.1	192.168.2.6	0xd308	Name error (3)	plodnittpw.lat	none	none	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:55:22.862679958 CET	1.1.1.1	192.168.2.6	0xfe04	Name error (3)	bloodyswif.lat	none	none	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:55:22.873991013 CET	1.1.1.1	192.168.2.6	0xa3ff	Name error (3)	washyceehsu.lat	none	none	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:55:22.886214972 CET	1.1.1.1	192.168.2.6	0x6511	Name error (3)	leggelatez.lat	none	none	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:55:22.897633076 CET	1.1.1.1	192.168.2.6	0x6897	Name error (3)	miniatureyu.lat	none	none	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:55:22.908620119 CET	1.1.1.1	192.168.2.6	0xbbef	Name error (3)	kickykiduz.lat	none	none	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:55:22.920286894 CET	1.1.1.1	192.168.2.6	0xac2e	Name error (3)	savorraiykj.lat	none	none	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:55:22.931195974 CET	1.1.1.1	192.168.2.6	0xd2c7	Name error (3)	shoefeatthe.lat	none	none	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:55:22.941490889 CET	1.1.1.1	192.168.2.6	0x3797	Name error (3)	finickypwk.lat	none	none	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:55:22.950923920 CET	1.1.1.1	192.168.2.6	0x59a4	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:55:29.638876915 CET	1.1.1.1	192.168.2.6	0xc387	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:55:29.638876915 CET	1.1.1.1	192.168.2.6	0xc387	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49755	104.102.49.254	443	5052	C:\Users\user\Desktop\G7T8lHJWWM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:55:23 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2025-01-14 07:55:24 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Tue, 14 Jan 2025 07:55:24 GMT Content-Length: 25665 Connection: close Set-Cookie: sessionid=4ec73977b0c4dcb52d29135a; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2025-01-14 07:55:24 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2025-01-14 07:55:24 UTC	11186	IN	Data Raw: 3f 6c 3d 6b 6f 72 65 61 6e 61 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 6b 6f 72 65 61 6e 61 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e ed 95 9c ea b5 ad ec 96 b4 20 28 4b 6f 72 65 61 6e 29 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 6d 65 6e 75 5f 69 74 65 6d 20 74 69 67 68 74 22 20 68 72 65 66 3d 22 3f 6c 3d 74 68 61 69 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 74 68 61 69 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e e0 b9 84 e0 b8 97 e0 b8 a2 20 28 54 68 61 69 29 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 Data Ascii: ?l=koreana" onclick="ChangeLanguage( 'koreana' ); return false;"> (Korean)</a><a class="popup_menu_item tight" href="?l=thai" onclick="ChangeLanguage( 'thai' ); return false;"> (Thai)</a>

Target ID:	0
Start time:	02:55:10
Start date:	14/01/2025
Path:	C:\Users\user\Desktop\G7T8lHJWWM.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\G7T8lHJWWM.exe"
Imagebase:	0x400000
File size:	2'667'856 bytes
MD5 hash:	9928E66ECBB91E45D7D48FAFC8A3E21F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	36.7%
Total number of Nodes:	128
Total number of Limit Nodes:	13

Executed Functions

Function 00BC5D2C Relevance: 12.7, APIs: 8, Instructions: 730memorynativethreadCOMMON

Download Yara Rule

APIs

NtCreateSection.NTDLL(?,000F001F,00000000,?,00000040,08000000,00000000,00000000), ref: 00BC5DC5
NtMapViewOfSection.NTDLL(?,00000000), ref: 00BC5E6D
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 00BC61E1
NtMapViewOfSection.NTDLL(?,00000000,?,?,?,?,?,?), ref: 00BC6296
VirtualProtect.KERNEL32(?,?,00000008,?,?,?,?,?,?,?), ref: 00BC62B3
VirtualProtect.KERNEL32(?,?,?,00000000), ref: 00BC6356
VirtualProtect.KERNEL32(?,?,00000002,?,?,?,?,?,?,?), ref: 00BC6389
CreateThread.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,?,?,?,?,?,?), ref: 00BC64FA

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID: Virtual$ProtectSection$CreateView$AllocThread
String ID:
API String ID: 1248616170-0
Opcode ID: 34e3949558d47ac2efbd442dc042839410f73323f736e1ca0bff09bbd7760ed0
Instruction ID: 610815a90d7261b8f3b997dc10e2550d55e7572d10855ba7772de516c663c842
Opcode Fuzzy Hash: 34e3949558d47ac2efbd442dc042839410f73323f736e1ca0bff09bbd7760ed0
Instruction Fuzzy Hash: 94427971608341AFDB24CF28C884F6BBBE8EF88714F1449ADF9859B241E771E945CB91

Function 00B70B87 Relevance: 6.1, APIs: 4, Instructions: 100
threadprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000004,00000000,?,?,?,?,?,00B706CD,?,00000001,?,81EC8B55,000000FF), ref: 00B70BC5
Thread32First.KERNEL32(00000000,0000001C), ref: 00B70BF1
Wow64SuspendThread.KERNEL32(00000000), ref: 00B70C44
CloseHandle.KERNEL32(00000000), ref: 00B70C6E

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID: CloseCreateFirstHandleSnapshotSuspendThreadThread32Toolhelp32Wow64
String ID:
API String ID: 1849706056-0
Opcode ID: ed4f7e93d5c748d87e273fbd072de27cfcb41b6612c19f34ce8dd7f2a24eca5e
Instruction ID: ada23c48b04e40114cedc34e15e6426f606be8e146f233eb2f39623642d0f40e
Opcode Fuzzy Hash: ed4f7e93d5c748d87e273fbd072de27cfcb41b6612c19f34ce8dd7f2a24eca5e
Instruction Fuzzy Hash: 2241FD75600108EFDB18DF68C890BADB7F6EF88300F20C169E6199B794DA34AE45CB94

Function 00B70A37 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 103
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00B70B03

Strings

,, xrefs: 00B70B4F

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID: ,
API String ID: 2422867632-3772416878
Opcode ID: fc60953fbf7661c618888493d7684cefa6d88d8934743e077e5b29c3addb46ae
Instruction ID: 798a3ca72f6fbd55ed47c8a7c45728b29fab590cc2d8720deb62040ad869dea7
Opcode Fuzzy Hash: fc60953fbf7661c618888493d7684cefa6d88d8934743e077e5b29c3addb46ae
Instruction Fuzzy Hash: BC41B374A00209EFDB04DF98C994BAEB7B1FF88314F208199D525AB380C771AE81DB94

Function 00B70477 Relevance: 1.9, APIs: 1, Instructions: 399
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,?,00000001,?,81EC8B55,000000FF), ref: 00B7071A

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 6436e51615b93b57a77e305a0776b4bd0f7ecb2bb71abc1bbc2fe0aa8c3eff0d
Instruction ID: 07d8e56900ded069c9bbe119918ee68d5a1177a76253ce120015809adbb874cc
Opcode Fuzzy Hash: 6436e51615b93b57a77e305a0776b4bd0f7ecb2bb71abc1bbc2fe0aa8c3eff0d
Instruction Fuzzy Hash: 5A12D3B4E10219DFDB14DF98C990BADBBB1FF88304F2482A9D519AB385C735AA41CF54

Function 00BC478C Relevance: 6.1, APIs: 4, Instructions: 99
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BC69AA: LoadLibraryA.KERNEL32(00000000,?,?), ref: 00BC6A3C

VirtualProtect.KERNEL32(00000000,0000000C,00000040,?), ref: 00BC47E7
VirtualProtect.KERNEL32(00000000,0000000C,?,?), ref: 00BC481A
VirtualProtect.KERNEL32(00000000,0040145E,00000040,?), ref: 00BC484D
VirtualProtect.KERNEL32(00000000,0040145E,?,?), ref: 00BC4877

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: 544c524c5f03252b96133d4295c441da5d44db607709df4b952f0ae727dfced4
Instruction ID: 4643b6c1a77133036a42720bd4cb2ca1af1922d76ef5ce6b0d8beff04c312255
Opcode Fuzzy Hash: 544c524c5f03252b96133d4295c441da5d44db607709df4b952f0ae727dfced4
Instruction Fuzzy Hash: B121C4B22042493FE310AA619C55FBB77DCDB95300F04087EFB46D1052EB75EA0587B1

Function 00BC55FC Relevance: 4.8, APIs: 3, Instructions: 325
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00003000,00000004,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00BC5676
VirtualFree.KERNELBASE(00000000,00000000,0000C000), ref: 00BC59BA
RtlExitUserProcess.NTDLL(00000000), ref: 00BC59C3

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID: Virtual$AllocExitFreeProcessUser
String ID:
API String ID: 1828502597-0
Opcode ID: 3017fd99d0584aa20b0153e116f0a50b272e6a421316d4372083565c5f77b8b3
Instruction ID: 4d39e090bc700d26bfad2dc52a801a7ffaea5a56bc8b53f44497955a2f94d10e
Opcode Fuzzy Hash: 3017fd99d0584aa20b0153e116f0a50b272e6a421316d4372083565c5f77b8b3
Instruction Fuzzy Hash: 76B1D031500B06EBDB319A60CC85FABB7E8FF45320F1009ADF99996141E771F9A0DBA1

Function 00BC69AA Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(00000000,?,?), ref: 00BC6A3C

Strings

.dll, xrefs: 00BC69E1

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: .dll
API String ID: 1029625771-2738580789
Opcode ID: f6f06f52cd4a024ca790678b75224790e8b38e6a55f670a1ffdfea5ea75d1fe1
Instruction ID: 4d1d7be8ee49408f10e848c859c0b55dfd01b9937c71f63b9da829a0a3399e86
Opcode Fuzzy Hash: f6f06f52cd4a024ca790678b75224790e8b38e6a55f670a1ffdfea5ea75d1fe1
Instruction Fuzzy Hash: 3321AF366042959FEB21DFA9C884F6A7BE4EF09364F1881ADE8469BA41D770EC458B40

Function 00BC4887 Relevance: 3.0, APIs: 2, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BC69AA: LoadLibraryA.KERNEL32(00000000,?,?), ref: 00BC6A3C

VirtualProtect.KERNEL32(00000000,00000004,00000040,?), ref: 00BC48BF
VirtualProtect.KERNEL32(00000000,00000004,?,?), ref: 00BC48E2

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: 355f7a5a870867b02340d2dab44903ecb3bac44aab23468b058fab7a7d97728b
Instruction ID: 50887b2add1fb171d1b3c038455a679b291f1ccfa874b20319a26b9dd521211e
Opcode Fuzzy Hash: 355f7a5a870867b02340d2dab44903ecb3bac44aab23468b058fab7a7d97728b
Instruction Fuzzy Hash: 30F06DBA2406047BE611AA65CC42FFB73ECDB49B10F000468FB06D6080EB75EA0597A5

Non-executed Functions

Function 00B83414 Relevance: 103.2, Strings: 81, Instructions: 1908COMMON

Download Yara Rule

Strings

3, xrefs: 00B8496F
6, xrefs: 00B846E3
A, xrefs: 00B84506
`, xrefs: 00B843F2
G, xrefs: 00B846CB
V, xrefs: 00B84CD0
g, xrefs: 00B84D10
3, xrefs: 00B83DF6
a, xrefs: 00B83652
^, xrefs: 00B84CB0
;, xrefs: 00B84A1F
d, xrefs: 00B84899
B, xrefs: 00B84C50
Y, xrefs: 00B8471B
q, xrefs: 00B837F4
", xrefs: 00B842A4
;, xrefs: 00B83E84
\, xrefs: 00B84A6F
J, xrefs: 00B84182
A, xrefs: 00B84C70
}, xrefs: 00B838DF
h, xrefs: 00B840B7
d, xrefs: 00B840D7
A, xrefs: 00B846DB
>, xrefs: 00B849EF
W, xrefs: 00B84A9F
D, xrefs: 00B8511F
1, xrefs: 00B8499F
8, xrefs: 00B846A3
h, xrefs: 00B84CE0
], xrefs: 00B846FB
<, xrefs: 00B846D3
`, xrefs: 00B836ED
U, xrefs: 00B84C80
S, xrefs: 00B83B1C
=, xrefs: 00B840A7
#, xrefs: 00B842C2
g, xrefs: 00B84D70
>, xrefs: 00B849FF
@, xrefs: 00B84172
z, xrefs: 00B8355D
m, xrefs: 00B84703
Z, xrefs: 00B84723
8, xrefs: 00B8492F
, xrefs: 00B8376F
c, xrefs: 00B842B8
,, xrefs: 00B8497F
n, xrefs: 00B842AE
K, xrefs: 00B846AB
[, xrefs: 00B84C60
(, xrefs: 00B846F3
t, xrefs: 00B83475
L, xrefs: 00B84192
], xrefs: 00B84CC0
w, xrefs: 00B84DA0
9, xrefs: 00B83E7A
X, xrefs: 00B84C90
_, xrefs: 00B8470B
z, xrefs: 00B8450B
m, xrefs: 00B836E8
k, xrefs: 00B84D30
", xrefs: 00B84A5F
|, xrefs: 00B84D20
}, xrefs: 00B83990
x, xrefs: 00B84D80
C, xrefs: 00B846EB
0, xrefs: 00B846C3
[, xrefs: 00B8472B
i, xrefs: 00B83562
W, xrefs: 00B84CA0
E, xrefs: 00B846BB
!, xrefs: 00B84A3F
Z, xrefs: 00B848A3
3, xrefs: 00B8498F
e, xrefs: 00B8489E
D, xrefs: 00B84EB7
:, xrefs: 00B83E7F
6, xrefs: 00B84A4F
u, xrefs: 00B84DB0
", xrefs: 00B849CF
j, xrefs: 00B84713

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: $!$"$"$"$#$($,$0$1$3$3$3$6$6$8$8$9$:$;$;$<$=$>$>$@$A$A$A$B$C$D$D$E$G$J$K$L$S$U$V$W$W$X$Y$Z$Z$[$[$\$]$]$^$_$`$`$a$c$d$d$e$g$g$h$h$i$j$k$m$m$n$q$t$u$w$x$z$z$|$}$}
API String ID: 0-4160516955
Opcode ID: 5cb2b2cafd6755493b88c3331a7c43df45eb58a6300e302f2a16af4dbd397ce7
Instruction ID: 7e0e9210eb75399ee332ac1912c5a441de79f34887badd4614c12b3ee69b7b61
Opcode Fuzzy Hash: 5cb2b2cafd6755493b88c3331a7c43df45eb58a6300e302f2a16af4dbd397ce7
Instruction Fuzzy Hash: 3403C17150C7C18AD334DB38848539FBBD1AB96324F188AADE4E9873E2D7788945CB53

Function 00B8E394 Relevance: 83.7, Strings: 66, Instructions: 1193
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0, xrefs: 00B8EF3E
0, xrefs: 00B8E8DF
/, xrefs: 00B8E88F
&, xrefs: 00B8E5E9
q, xrefs: 00B8E877
}, xrefs: 00B8E85F
R, xrefs: 00B8E72C
P, xrefs: 00B8E8A7
T, xrefs: 00B8E8D7
., xrefs: 00B8EA2F
S, xrefs: 00B8E947
P, xrefs: 00B8E9EF
d, xrefs: 00B8E8C7
s, xrefs: 00B8E92F
f, xrefs: 00B8E907
?, xrefs: 00B8EF39
\, xrefs: 00B8E8B7
V, xrefs: 00B8E90F
f, xrefs: 00B8E8FF
Y, xrefs: 00B8E754
Q, xrefs: 00B8E8AF
[, xrefs: 00B8E91F
c, xrefs: 00B8E611
n, xrefs: 00B8E96F
\, xrefs: 00B8E9DF
[, xrefs: 00B8E8CF
b, xrefs: 00B8E927
%, xrefs: 00B8E5E4
&, xrefs: 00B8E5EE
], xrefs: 00B8E9A7
A, xrefs: 00B8E987
H, xrefs: 00B8EA07
,, xrefs: 00B8EA47
J, xrefs: 00B8E9FF
>, xrefs: 00B8EF34
$, xrefs: 00B8E5F3
G, xrefs: 00B8E917
R, xrefs: 00B8E94F
:, xrefs: 00B8E616
H, xrefs: 00B8E937
8, xrefs: 00B8E602
N, xrefs: 00B8E9D7
X, xrefs: 00B8E9BF
O, xrefs: 00B8E977
b, xrefs: 00B8E787
P, xrefs: 00B8E9E7
P, xrefs: 00B8E8BF
J, xrefs: 00B8E997
u, xrefs: 00B8EA0F
:, xrefs: 00B8E89F
D, xrefs: 00B8E887
H, xrefs: 00B8E8F7
, xrefs: 00B8EA3F
7, xrefs: 00B8EA4F
b, xrefs: 00B8E607
_, xrefs: 00B8E9B7
H, xrefs: 00B8E9AF
., xrefs: 00B8EA37
G, xrefs: 00B8F407
z, xrefs: 00B8E99F
_, xrefs: 00B8E8E7
E, xrefs: 00B8E9F7
-, xrefs: 00B8EF2F
a, xrefs: 00B8E60C
R, xrefs: 00B8E98F
A, xrefs: 00B8E967

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: $$$%$&$&$,$-$.$.$/$0$0$7$8$:$:$>$?$A$A$D$E$G$G$H$H$H$H$J$J$N$O$P$P$P$P$Q$R$R$R$S$T$V$X$Y$[$[$\$\$]$_$_$a$b$b$b$c$d$f$f$n$q$s$u$z$}
API String ID: 0-3743354863
Opcode ID: 4b6c9f38657fedcb7e7c6a6a2fc1027f769ddcf3984a63c958d800a384496369
Instruction ID: 3999a25e7598220ca5ac8a6cb2264f9a91485944b2e815b1bfa9c274bbe2942a
Opcode Fuzzy Hash: 4b6c9f38657fedcb7e7c6a6a2fc1027f769ddcf3984a63c958d800a384496369
Instruction Fuzzy Hash: 46B2903160C7C18BC325DA3C889439EBBD1ABD6324F194BADE4E98B3E2D6759805C753

Function 00B9460B Relevance: 69.1, Strings: 55, Instructions: 394
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

t, xrefs: 00B94656
#, xrefs: 00B94836
y, xrefs: 00B946B8
!, xrefs: 00B9472C
c, xrefs: 00B94B51
(, xrefs: 00B94633
O, xrefs: 00B94AC5
2, xrefs: 00B94A63
., xrefs: 00B949D7
:, xrefs: 00B9474C
1, xrefs: 00B94768
8, xrefs: 00B94A47
Q, xrefs: 00B94AE1
P, xrefs: 00B94B0B
7, xrefs: 00B94738
., xrefs: 00B94728
], xrefs: 00B94AFD
I, xrefs: 00B94A7F
,, xrefs: 00B949C9
w, xrefs: 00B9462C
#, xrefs: 00B94764
W, xrefs: 00B94710
1, xrefs: 00B9476C
m, xrefs: 00B94740
^, xrefs: 00B94724
+, xrefs: 00B9473C
", xrefs: 00B9475C
, xrefs: 00B94760
`, xrefs: 00B94641
I, xrefs: 00B94C4C
I, xrefs: 00B9470C
<, xrefs: 00B94A1D
~, xrefs: 00B9465D
+, xrefs: 00B94617
X, xrefs: 00B94B19
g, xrefs: 00B9464F
r, xrefs: 00B94687
v, xrefs: 00B94664
O, xrefs: 00B94A8D
{, xrefs: 00B9461E
,, xrefs: 00B949E5
, xrefs: 00B94758
m, xrefs: 00B946E8
`, xrefs: 00B94625
H, xrefs: 00B94AD3
M, xrefs: 00B94A9B
#, xrefs: 00B94754
;, xrefs: 00B94744
t, xrefs: 00B94680
;, xrefs: 00B94A39
", xrefs: 00B94734
N, xrefs: 00B94708
~, xrefs: 00B9466B
?, xrefs: 00B94750
^, xrefs: 00B94B35

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: $ $!$"$"$#$#$#$($+$+$,$,$.$.$1$1$2$7$8$:$;$;$<$?$H$I$I$I$M$N$O$O$P$Q$W$X$]$^$^$`$`$c$g$m$m$r$t$t$v$w$y${$~$~
API String ID: 0-2443450857
Opcode ID: d38c60a90824ad46133972e7c4cbed06e95cef7b7f0db34d98dc1f8cdee652d2
Instruction ID: aaa4e261f42be9dc41136a5a9969af2dfd012c3b2b991ff3a99de645803b2a15
Opcode Fuzzy Hash: d38c60a90824ad46133972e7c4cbed06e95cef7b7f0db34d98dc1f8cdee652d2
Instruction Fuzzy Hash: 6122FC1190C7EAC9DB32C67C9C487CDBFA11B63224F0847D9D0E86B2D6D7750A86DB62

Function 00B96AC0 Relevance: 35.4, Strings: 28, Instructions: 433
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

&P%V, xrefs: 00B972F5
G0]6, xrefs: 00B9729D
)p*v, xrefs: 00B971A9
Rd"j, xrefs: 00B9732C
4~|, xrefs: 00B96FE8
(X6^, xrefs: 00B9730B
$, xrefs: 00B96AC1
T`Zf, xrefs: 00B97321
U\, xrefs: 00B96E90
x~, xrefs: 00B974C3
7w, xrefs: 00B96C39
BpFv, xrefs: 00B9734D
{x, xrefs: 00B971BF
.H>N, xrefs: 00B972DF
.D)J, xrefs: 00B972D4
!h#n, xrefs: 00B97337
|,X2, xrefs: 00B97292
`g, xrefs: 00B96E9B
_lYr, xrefs: 00B97342
K4l:, xrefs: 00B97104
rp, xrefs: 00B96D25
tj, xrefs: 00B974E4
8>, xrefs: 00B97573
;T&Z, xrefs: 00B97300
T8e>, xrefs: 00B972B3
-tz, xrefs: 00B971B4
2{<u, xrefs: 00B96C2E
o<KB, xrefs: 00B972BE

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: !h#n$$$&P%V$(X6^$)p*v$-tz$.D)J$.H>N$2{<u$4~|$7w$;T&Z$BpFv$G0]6$K4l:$Rd"j$T8e>$T`Zf$U\$_lYr$`g$o<KB${x$|,X2$8>$rp$tj$x~
API String ID: 0-2721255210
Opcode ID: 1b2c9cd0342a9e47e3d44aab4ca0d67673ff476f0f2922c19ef01971a6907c39
Instruction ID: eb473afc7cfdfe754ba500bf94984adc12255192ed4fdba5536a65f6ced1ed61
Opcode Fuzzy Hash: 1b2c9cd0342a9e47e3d44aab4ca0d67673ff476f0f2922c19ef01971a6907c39
Instruction Fuzzy Hash: 5732FAB160D7D48AD334CF14C442BDFBAF2EB92304F00892CC5E96B255D7B6564A8B9B

Function 00BAC794 Relevance: 22.9, Strings: 18, Instructions: 366
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

6cxU, xrefs: 00BAC8B5
6cxU, xrefs: 00BAC7EC
6cxU, xrefs: 00BAC7F3
c, xrefs: 00BACB27
6cxU, xrefs: 00BAC8AE
[, xrefs: 00BAC865
Y, xrefs: 00BAC7AD
*, xrefs: 00BACA14
_, xrefs: 00BACA5E
[, xrefs: 00BAC7A3
!, xrefs: 00BACA63
6, xrefs: 00BACA0F
J, xrefs: 00BACA59
8, xrefs: 00BACA0A
X, xrefs: 00BAC86A
X, xrefs: 00BAC7A8
Y, xrefs: 00BAC86F
kyeE, xrefs: 00BAC9A6

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: !$*$6$6cxU$6cxU$6cxU$6cxU$8$J$X$X$Y$Y$[$[$_$c$kyeE
API String ID: 0-79597815
Opcode ID: fbbbd6998d66d1ff913caef885f0d1f43bf92717102f9addf7045befe193c24d
Instruction ID: 664fc3255bed4086e70b946bc04e0d23604e26c1391c1021609236ba92b24268
Opcode Fuzzy Hash: fbbbd6998d66d1ff913caef885f0d1f43bf92717102f9addf7045befe193c24d
Instruction Fuzzy Hash: 36C1582361CB954BD318887C8C9425BAEC20BE7234F1DC77DD8F9973C2D5A9C9068392

Function 00B95892 Relevance: 10.2, Strings: 8, Instructions: 241
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d)E+, xrefs: 00B95BEF
A!K#, xrefs: 00B95BDF
Y1\3, xrefs: 00B95BBF
P5Y7, xrefs: 00B95BC7
H%Z', xrefs: 00B95BE7
<QrS, xrefs: 00B95BFF
O-O/, xrefs: 00B95BF7
4Y>[, xrefs: 00B95C0F

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: 4Y>[$<QrS$A!K#$H%Z'$O-O/$P5Y7$Y1\3$d)E+
API String ID: 0-1137044552
Opcode ID: db664d97611cd2b0ea31a962eb31bb62c560aebccfa291759c0dfe4ae8306fa6
Instruction ID: 7aeb7117f99ba264fadc1905f092a1b1c8fc23dd91b17c34d8e763fd30936ff3
Opcode Fuzzy Hash: db664d97611cd2b0ea31a962eb31bb62c560aebccfa291759c0dfe4ae8306fa6
Instruction Fuzzy Hash: 1B71DAB0508350DBCB24CF54D88116BFBF1EF96394F148A6DE9E95B361E3789901CB86

Function 00BB0774 Relevance: 8.1, Strings: 6, Instructions: 616
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

6G01, xrefs: 00BB07F4
6G01, xrefs: 00BB087A, 00BB08BC
S"(w, xrefs: 00BB0AE7
S"(w, xrefs: 00BB0894
f, xrefs: 00BB0A1E
[XX^, xrefs: 00BB096B, 00BB09DB

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: 6G01$6G01$S"(w$S"(w$[XX^$f
API String ID: 0-3115683409
Opcode ID: 348f023ca78b2a33b92335d9a1234e2a1b6113961118bb4496a79888e6f44e23
Instruction ID: 535fd84e5735893d1e2dee7ecbab34ff42273d5f858156349a0a9beba679ab03
Opcode Fuzzy Hash: 348f023ca78b2a33b92335d9a1234e2a1b6113961118bb4496a79888e6f44e23
Instruction Fuzzy Hash: A822D271A183418FC714DF18C880ABFBBE2EBC5314F158AACE4A5572A1D7B1D946CB92

Function 00B91D34 Relevance: 6.7, Strings: 5, Instructions: 435COMMON

Download Yara Rule

Strings

y, xrefs: 00B92242
,, xrefs: 00B921B2
~, xrefs: 00B9224C
!@, xrefs: 00B91D67
}, xrefs: 00B92247

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: !@$,$y$}$~
API String ID: 0-3044378546
Opcode ID: 24f79ce7ec7ede984511a7683478084d7a1d94fa8b0057a537d58610d9033e05
Instruction ID: 50a418e07cdefebd64e2d5ac5688df5a27ff8c62ed4ba5d28abc67b63c19c659
Opcode Fuzzy Hash: 24f79ce7ec7ede984511a7683478084d7a1d94fa8b0057a537d58610d9033e05
Instruction Fuzzy Hash: 8B028D71A0C7819FDB24CF28C48436EBBE1AB85314F148A6DE5E9873D2D7B98845DB42

Function 00B7C204 Relevance: 6.7, Strings: 5, Instructions: 422COMMON

Download Yara Rule

Strings

~|, xrefs: 00B7C2FC
WR, xrefs: 00B7C436
~Bzx, xrefs: 00B7C216
<, xrefs: 00B7C2EC
C|, xrefs: 00B7C2F4

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: <$C|$WR$~Bzx$~|
API String ID: 0-1711356705
Opcode ID: 42a10b6da1222523d84042899d75f0fbff551e0a26b14e01256eb7c536352f42
Instruction ID: 43b3082a41a4d7e6cc314ee921aaf0dee061f56a338db1b043ee422255d5e5b7
Opcode Fuzzy Hash: 42a10b6da1222523d84042899d75f0fbff551e0a26b14e01256eb7c536352f42
Instruction Fuzzy Hash: A8D10B7661C3504BD318CE29889126FBFE3EBD2310F19C96DE4E99B341C775C90A8B46

Function 00B7AAB4 Relevance: 6.6, Strings: 5, Instructions: 382COMMON

Download Yara Rule

Strings

}UW^, xrefs: 00B7AB64
uP, xrefs: 00B7AC17
IIMC, xrefs: 00B7ABF7
R, xrefs: 00B7ADBA
C]E[, xrefs: 00B7AE62

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: C]E[$IIMC$R$uP$}UW^
API String ID: 0-892063760
Opcode ID: 205ed248482d7a065e056c637e6f518a5e6eb8ae255233571312f867963e7cbf
Instruction ID: ff61004f28f9b01cfc5d3594481242c29445df118d09302259ce0d671b83a5f3
Opcode Fuzzy Hash: 205ed248482d7a065e056c637e6f518a5e6eb8ae255233571312f867963e7cbf
Instruction Fuzzy Hash: ACB1D37164C3D18BC3268F25849075FFFE0DFD2754F188AACE4E91B282D239894AC796

Function 00B92404 Relevance: 5.5, Strings: 4, Instructions: 470COMMON

Download Yara Rule

Strings

745:2$76, xrefs: 00B924F8
p@, xrefs: 00B9281A
_\], xrefs: 00B925CA
2$76, xrefs: 00B924C9

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: 2$76$745:2$76$_\]$p@
API String ID: 0-2055486527
Opcode ID: 8b739f0aadc3fc91c1b2ac1539c3a718c0ad65865adbdb4aedbddadf997ebabb
Instruction ID: 6de7288011cad8ce7ac479aebd9ca8ce8558b2814e1fdf1f3a65196abf810a6e
Opcode Fuzzy Hash: 8b739f0aadc3fc91c1b2ac1539c3a718c0ad65865adbdb4aedbddadf997ebabb
Instruction Fuzzy Hash: BFD1BE71A083409FDB14DF64C891BABBBE0EFD5314F04886CE99997391E7B9E805CB52

Function 00BA108C Relevance: 5.4, Strings: 4, Instructions: 394COMMON

Download Yara Rule

Strings

0-/?, xrefs: 00BA12CA
$&?3, xrefs: 00BA12C3
;(?>, xrefs: 00BA13F4
99C?, xrefs: 00BA13FB

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: $&?3$0-/?$99C?$;(?>
API String ID: 0-2409071036
Opcode ID: c3d1be89028db4a1f2c2333a608d2b5e78d7535835fec0e3064d115d6cb41594
Instruction ID: df6b49544f0df899c5e965d8f9f13725abc3ae31b570e82f70d8ff4f3699adb6
Opcode Fuzzy Hash: c3d1be89028db4a1f2c2333a608d2b5e78d7535835fec0e3064d115d6cb41594
Instruction Fuzzy Hash: EAD15DB48047419FD724EF39C586752BFF0EB16300F148A9ED8EA4B786D734A45ACB92

Function 00B7EF84 Relevance: 5.3, Strings: 4, Instructions: 329COMMON

Download Yara Rule

Strings

^_/C, xrefs: 00B7F04A
;d, xrefs: 00B7F1A5
SD, xrefs: 00B7F1AC
TC03, xrefs: 00B7F051

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: ;d$SD$TC03$^_/C
API String ID: 0-3729532250
Opcode ID: 2812e617d036c375e3da603f544641752ab874253ccd01004949b5816314b26e
Instruction ID: 6f708c3fb553b8e33f8760fdd14f120e136a1b0b2572844e3eaca425a3220584
Opcode Fuzzy Hash: 2812e617d036c375e3da603f544641752ab874253ccd01004949b5816314b26e
Instruction Fuzzy Hash: 7DA1F6B42087928FD719CF25C4A0276BFE1FF67310B28819CD0E64BB46D739A806CB55

Function 00B7A7A4 Relevance: 5.3, Strings: 4, Instructions: 299COMMON

Download Yara Rule

Strings

mooj, xrefs: 00B7A884
MP, xrefs: 00B7A806
`]0o, xrefs: 00B7A894
", xrefs: 00B7A8BC

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: "$MP$`]0o$mooj
API String ID: 0-750224902
Opcode ID: b1852bd034d5f07e6c7418944058fbcc2db243f872094cebdf7b16bddf70df29
Instruction ID: 4dbc496236bd243bb94e6afe42c3a3c1753b7a787907db46c461a204cc7acbb0
Opcode Fuzzy Hash: b1852bd034d5f07e6c7418944058fbcc2db243f872094cebdf7b16bddf70df29
Instruction Fuzzy Hash: 3F71F7215093918ADB11CF29859077BFFE1DFD2344F1889ADD4D99B283D639890AC763

Function 00B8C74A Relevance: 4.1, Strings: 3, Instructions: 312COMMON

Download Yara Rule

Strings

YF, xrefs: 00B8C9BF
]Z, xrefs: 00B8C7F0
>j%h, xrefs: 00B8C9D9

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: >j%h$YF$]Z
API String ID: 0-4187760579
Opcode ID: 2b05d0f14d0d6e5591c68a104f4f511412e46e2e0091bcfa594d04fdcead0a9b
Instruction ID: db16cfd3b6aed32e6dd677e1fc150207e7a50bc29a43631a27cf85002caf1fde
Opcode Fuzzy Hash: 2b05d0f14d0d6e5591c68a104f4f511412e46e2e0091bcfa594d04fdcead0a9b
Instruction Fuzzy Hash: 308107B1A083008BD714EF28C89227BBBF1EFD1314F18995CE9D69B391E3789905C756

Function 00B87AD3 Relevance: 4.1, Strings: 3, Instructions: 310COMMON

Download Yara Rule

Strings

LH, xrefs: 00B87CA1
PS, xrefs: 00B87CAF
[T, xrefs: 00B87CA8

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: LH$PS$[T
API String ID: 0-1629221622
Opcode ID: a3e1f9736eed060c3fa966c10d1dea8dc1f709a6b253d1cf9a7cd6a57d747b48
Instruction ID: d20526e37bf9dcd6e0378516db7cb94aad190cb6efdd1127d635a35e3ebd2bd1
Opcode Fuzzy Hash: a3e1f9736eed060c3fa966c10d1dea8dc1f709a6b253d1cf9a7cd6a57d747b48
Instruction Fuzzy Hash: FC91CFB16447018BD728CF25C991362B7B2FF95318F2995ADC8864F7A5DB3AE803CB50

Function 00B8B004 Relevance: 4.0, Strings: 3, Instructions: 239COMMON

Download Yara Rule

Strings

qp, xrefs: 00B8B0EA
4, xrefs: 00B8B0F2
Nw, xrefs: 00B8B0E2

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: 4$Nw$qp
API String ID: 0-4265586298
Opcode ID: 07ee0dda83b10c6babdba6f7f560729ff036302cd3f30b88450a197e3d0d674c
Instruction ID: 932a10d812b808b123d2f00276e0c4a247dc982ee33a077dbb1421983265b7dc
Opcode Fuzzy Hash: 07ee0dda83b10c6babdba6f7f560729ff036302cd3f30b88450a197e3d0d674c
Instruction Fuzzy Hash: 8C6119719183518BC72CDF29C8A167BB7E1EFC6314F094A6DE9D69B290D7388C05C786

Function 00B8AD64 Relevance: 4.0, Strings: 3, Instructions: 230COMMON

Download Yara Rule

Strings

~, xrefs: 00B8ADE4
0, xrefs: 00B8ADB6
}, xrefs: 00B8ADDF

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: 0$}$~
API String ID: 0-1378824556
Opcode ID: 884f6f9cf58a5a59d449aea1ec521a8ac50cc9cc68e7f295d775d02287a41394
Instruction ID: b7bc41ff3f433dd3ec46258ad5d814559e801630c341f1cef579ba579ac14450
Opcode Fuzzy Hash: 884f6f9cf58a5a59d449aea1ec521a8ac50cc9cc68e7f295d775d02287a41394
Instruction Fuzzy Hash: 25713722B0DA944BD718697C5C512AA7A934BD2330F2CC3FEEAB5D73E6D4684C059382

Function 00B9FEB6 Relevance: 3.9, Strings: 3, Instructions: 189COMMON

Download Yara Rule

Strings

khvr, xrefs: 00BA000A
|lx1, xrefs: 00BA0011
)2^, xrefs: 00B9FFB4

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: )2^$khvr$|lx1
API String ID: 0-2191243274
Opcode ID: e0043f7c070bd71afc432f3349eebb0a5253881f2526b2449ca6c403794a358b
Instruction ID: ead043810972f399bc884c009718bd1e655d4cb395cdbdf03b246ab091ea904f
Opcode Fuzzy Hash: e0043f7c070bd71afc432f3349eebb0a5253881f2526b2449ca6c403794a358b
Instruction Fuzzy Hash: F041E574505682CBDB258F3AC4A0771BBE2EF5B305F2885ECC0C6CB396C639A846CB14

Function 00B99EAF Relevance: 3.9, Strings: 3, Instructions: 107COMMON

Download Yara Rule

Strings

7@7F, xrefs: 00B99F75
6L:B, xrefs: 00B99F6E
.D)z, xrefs: 00B99F7C

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: .D)z$6L:B$7@7F
API String ID: 0-1054234650
Opcode ID: 1acc238c7ea912079cd8e851d5e9fdcf69ca3467f2d8d33a48e05f11496af54d
Instruction ID: 2287fba9ca3a9eb3f7e1e372b78987f8816292268c17314ff1c29b7ff1676edd
Opcode Fuzzy Hash: 1acc238c7ea912079cd8e851d5e9fdcf69ca3467f2d8d33a48e05f11496af54d
Instruction Fuzzy Hash: EC419AF4E00756ABC710CFAACA86199FFB0FF06310B64926CD5446BA08D339A452CFC5

Function 00B89F84 Relevance: 3.4, Strings: 2, Instructions: 893COMMON

Download Yara Rule

Strings

^_, xrefs: 00B8A2A6
fg$, xrefs: 00B8A009

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: ^_$fg$
API String ID: 0-722828377
Opcode ID: d85e9e83ea640c257f6531e8fb9b0d5529058831f55591611b60998b19f6d1d8
Instruction ID: c985ee3b15deb8441e2ae434857931d870f4a11ef5092ee503b1c79489e6c3a2
Opcode Fuzzy Hash: d85e9e83ea640c257f6531e8fb9b0d5529058831f55591611b60998b19f6d1d8
Instruction Fuzzy Hash: 3162E5746083419BE728EB25C884B7ABBE2EFD5314F188A5DE195572B1E3B1DC41CB83

Function 00BAD0A4 Relevance: 3.4, Strings: 2, Instructions: 851COMMON

Download Yara Rule

Strings

./, xrefs: 00BAD6BA
qn, xrefs: 00BAD5C4

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: ./$qn
API String ID: 0-3823645636
Opcode ID: 668406d8b88442255c7392c9cd83faa7d6d5703eb8d5a977212719c6739b98c7
Instruction ID: e77799ce9929581b3b862124e04608913dca82fbbd0d2e79f2e2dc96945e27d1
Opcode Fuzzy Hash: 668406d8b88442255c7392c9cd83faa7d6d5703eb8d5a977212719c6739b98c7
Instruction Fuzzy Hash: 1152BE76A083508FD724CF28C89176BBBE2EFC6310F14896DE5D69B791DB749805CB82

Function 00B764F4 Relevance: 3.3, Strings: 2, Instructions: 792COMMON

Download Yara Rule

Strings

0, xrefs: 00B76E0F
8, xrefs: 00B76E07

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 6c0d5d3be257b6a3fd1de638671c8b12e5484a8c530135887e69e884293760cf
Instruction ID: 57de242a816da1663e3ba486a1dc0935e1757f88ee8362a0abe70299f0a52a67
Opcode Fuzzy Hash: 6c0d5d3be257b6a3fd1de638671c8b12e5484a8c530135887e69e884293760cf
Instruction Fuzzy Hash: 527233715087409FDB14CF18C880BABBBE1EF98314F4489ADF9A98B391D375D958CB92

Function 00B91004 Relevance: 3.0, Strings: 2, Instructions: 527COMMON

Download Yara Rule

Strings

pv, xrefs: 00B9108B
LMB, xrefs: 00B910E3

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: LMB$pv
API String ID: 0-122907696
Opcode ID: 600361d03a19618f7b8b94130096601f70c9cb3cba6cb4618556b265baeca412
Instruction ID: 4645edc722fcc83a2026fd2afeed8439d3b3a7fee173361f496c72d57c36d352
Opcode Fuzzy Hash: 600361d03a19618f7b8b94130096601f70c9cb3cba6cb4618556b265baeca412
Instruction Fuzzy Hash: FBE135715083518BDB24DF29C8923ABB7F1FFD2310F19896CE5828B3A5E7799805C746

Function 00B9E594 Relevance: 3.0, Strings: 2, Instructions: 512COMMON

Download Yara Rule

Strings

", xrefs: 00B9EA44
", xrefs: 00B9E9D2

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: "$"
API String ID: 0-3758156766
Opcode ID: b07952227d8657c70647f12afd6039f58e3d334232c99a160f9b339d411ffc2b
Instruction ID: 094ae688a89ef54ce46062747f7e29424aced2bd59cbfb6fc931e078e280fd62
Opcode Fuzzy Hash: b07952227d8657c70647f12afd6039f58e3d334232c99a160f9b339d411ffc2b
Instruction Fuzzy Hash: D1F1F571A083549FCF14CE68C49076ABBD6EB84314F1989BDE8A98B392D774DD08C792

Function 00B8CAF4 Relevance: 2.9, Strings: 2, Instructions: 440COMMON

Download Yara Rule

Strings

uw, xrefs: 00B8CB9B
45, xrefs: 00B8CE56

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: 45$uw
API String ID: 0-851133776
Opcode ID: ab637dcdc1d75d2e8c1a6476f08b4d58cc792c803b02a06a08f3a248bcfca3ae
Instruction ID: 3478fe7c6a237ffb504e048f63bf64306338baa338637e8a0aadee1a4d59a36d
Opcode Fuzzy Hash: ab637dcdc1d75d2e8c1a6476f08b4d58cc792c803b02a06a08f3a248bcfca3ae
Instruction Fuzzy Hash: C0C105B15083408BD718EF28C85266BBBF1EFC5310F19C9ACE9958B3A0E778D905C762

Function 00B9F7D9 Relevance: 2.9, Strings: 2, Instructions: 437COMMON

Download Yara Rule

Strings

'5%s, xrefs: 00BA0713
$qk, xrefs: 00BA062C

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: $qk$'5%s
API String ID: 0-1674721824
Opcode ID: 756eda49438ed6f715e4a2a56022fc783d197dac7b59b75270c18a3458952d0e
Instruction ID: 0f69be7384c68e1a1fe47c73517025abcb6c589e88d1a041a3fe6c4a29106ec9
Opcode Fuzzy Hash: 756eda49438ed6f715e4a2a56022fc783d197dac7b59b75270c18a3458952d0e
Instruction Fuzzy Hash: 4FD1C2716087428FD729CF29C491762FBE2EFA6310F28C5ADC4D68B752D779A806CB50

Function 00B7AE94 Relevance: 2.9, Strings: 2, Instructions: 375COMMON

Download Yara Rule

Strings

no, xrefs: 00B7B1AC
JO}, xrefs: 00B7B074

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: JO}$no
API String ID: 0-1394444436
Opcode ID: 2dfd4d0383cadca2cae1fbc9fcdd2193fbb587bea3ba498617e60247ac0bf5c6
Instruction ID: c2cddb5950397bc8640e146e5ee0fd7033cd5cf18801787f9be8ab5032d2fae4
Opcode Fuzzy Hash: 2dfd4d0383cadca2cae1fbc9fcdd2193fbb587bea3ba498617e60247ac0bf5c6
Instruction Fuzzy Hash: D7C1F5B160C3408BD718DF74C891AAFBBE1EFD2304F14496DE5A687291DB39C509CB56

Function 00BA05C4 Relevance: 2.9, Strings: 2, Instructions: 370COMMON

Download Yara Rule

Strings

'5%s, xrefs: 00BA0713
$qk, xrefs: 00BA062C

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: $qk$'5%s
API String ID: 0-1674721824
Opcode ID: 4c7b881c96a4be9f1b9c585b43e2c14d7cd1363174d38c4307d0490ceea73aa2
Instruction ID: 44616067cd9019dfba052c22465166c7586054b75494ce1a9004f27e06b1e47f
Opcode Fuzzy Hash: 4c7b881c96a4be9f1b9c585b43e2c14d7cd1363174d38c4307d0490ceea73aa2
Instruction Fuzzy Hash: 24B1D1B16187828BD719CF29C450762FBE2EFA6300F1CC5ADC4DA8B752D779A806CB54

Function 00BADD04 Relevance: 2.8, Strings: 2, Instructions: 349COMMON

Download Yara Rule

Strings

mij, xrefs: 00BADF95
NP,?, xrefs: 00BADF14

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: NP,?$mij
API String ID: 0-1436015776
Opcode ID: 32edd598096961b7a1e9cd21a5037e7bfbbfcb0cb5fe29abcc1e634ef87fb66e
Instruction ID: a9885fa9ba557c9ecbc9f5b8990b28b04c03d50397df7acfc61b7254251ee19f
Opcode Fuzzy Hash: 32edd598096961b7a1e9cd21a5037e7bfbbfcb0cb5fe29abcc1e634ef87fb66e
Instruction Fuzzy Hash: B6A167716083108BDB24DF24C8C167BB7E1EB87724F19466CE6AA2B690D7B1DC05C7D2

Function 00B75BC4 Relevance: 2.8, Strings: 2, Instructions: 329COMMON

Download Yara Rule

Strings

), xrefs: 00B75C3F
IEND, xrefs: 00B75FB5

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: )$IEND
API String ID: 0-707183367
Opcode ID: dc7d0d6d934237c850a5b44cf0ffb38fdb6b1a249ae30cb4f64657c66714754e
Instruction ID: 0e283992afd72ff8654ecc941cb914bdad385aac3fdf3120a66ab43a158a5645
Opcode Fuzzy Hash: dc7d0d6d934237c850a5b44cf0ffb38fdb6b1a249ae30cb4f64657c66714754e
Instruction Fuzzy Hash: C5D19FB19087449FD720CF24C885B9EBBE4EB95304F14896DF9AD9B381D3B5D908CB92

Function 00B79B94 Relevance: 2.8, Strings: 2, Instructions: 288COMMON

Download Yara Rule

Strings

(RD, xrefs: 00B79E3C
%=>?, xrefs: 00B79CD4

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: %=>?$(RD
API String ID: 0-3761482541
Opcode ID: e07febe003d47278271e69a6a0aefd5b767d6bdb8c9269540a4227fbb6a47e9b
Instruction ID: b8bb598ab12acb9c5de921b43c30c8597ed491f2c48b9bb962c4ba929c101dc6
Opcode Fuzzy Hash: e07febe003d47278271e69a6a0aefd5b767d6bdb8c9269540a4227fbb6a47e9b
Instruction Fuzzy Hash: 4F910C72F086554BC711CE2DC8C025AB7E2EB85750F29CAB9E8A9DB395E234CD454781

Function 00B8DC64 Relevance: 2.8, Strings: 2, Instructions: 273COMMON

Download Yara Rule

Strings

~, xrefs: 00B8DD0E
}, xrefs: 00B8DD09

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: }$~
API String ID: 0-3846021004
Opcode ID: 1372fe1faa3213356ea37d011b0fe6f96b5a543017ec8f08801fdd0d73131f8c
Instruction ID: af8f0f1a61c50780d550949e1029bf678486569b0c38cb8877d76ebbd3be3c1e
Opcode Fuzzy Hash: 1372fe1faa3213356ea37d011b0fe6f96b5a543017ec8f08801fdd0d73131f8c
Instruction Fuzzy Hash: B791062670AA814BC7199A3C4C513AABF934BE7230F2DC3BEE5F58B3E6D5648805D351

Function 00B87EF1 Relevance: 2.7, Strings: 2, Instructions: 244COMMON

Download Yara Rule

Strings

GpFv, xrefs: 00B87F27
AtP, xrefs: 00B87F2E

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: AtP$GpFv
API String ID: 0-4236438475
Opcode ID: 8aa9151458862fb57c123df3b33a7af73a6272534d29202287a33acae2e1af0f
Instruction ID: 3a22bd3042732e2b550ee9faab3ed419b12ef7c60b4120f4aac2ab724d948e32
Opcode Fuzzy Hash: 8aa9151458862fb57c123df3b33a7af73a6272534d29202287a33acae2e1af0f
Instruction Fuzzy Hash: A281D0752007418BCB28DF29C8A1667B7F2FF49324B19899DD8838F765EB74E841CB44

Function 00BA5104 Relevance: 2.7, Strings: 2, Instructions: 239COMMON

Download Yara Rule

Strings

~, xrefs: 00BA51AA
}, xrefs: 00BA51A5

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: }$~
API String ID: 0-3846021004
Opcode ID: 9c651afb8884db2b8ed531508840d92c93680f60ef013fdbb885d5c65550ea95
Instruction ID: 317369c92117397e73392b133f9880a4159d4db3c8dffefbabf9c136e63d063a
Opcode Fuzzy Hash: 9c651afb8884db2b8ed531508840d92c93680f60ef013fdbb885d5c65550ea95
Instruction Fuzzy Hash: 4A71382660EAD14BD738863C4C513AABED34BD3230F2DC7ADE4F68B3D2D5A589059351

Function 00BA7A34 Relevance: 2.7, Strings: 2, Instructions: 234COMMON

Download Yara Rule

Strings

}, xrefs: 00BA7ABD
~, xrefs: 00BA7AC2

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: }$~
API String ID: 0-3846021004
Opcode ID: b89aeb8f7c5bc573797a562e5b9ad2442b0305510d530974ee3cfcaf6155a88d
Instruction ID: 0d8b974284aece3ed8e072bd7b05f13151f540e4dcab3f3fcd01f87588573e71
Opcode Fuzzy Hash: b89aeb8f7c5bc573797a562e5b9ad2442b0305510d530974ee3cfcaf6155a88d
Instruction Fuzzy Hash: F971292279DA804BD728493C8C9136ABBC34BD3230F2DC7AEE5F58B3E1E96589059351

Function 00B9F8A3 Relevance: 2.6, Strings: 2, Instructions: 124COMMON

Download Yara Rule

Strings

fI.K, xrefs: 00BA0167
M"O, xrefs: 00BA016E

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: M"O$fI.K
API String ID: 0-3473069917
Opcode ID: 80b5e25900e62fa5b7f868b9038989c12ce663ab15b6782b2becc0f24b60a991
Instruction ID: d7661c262c5beb1d762670fabd4b26eaa76330e419a4ec23f4398b4a33eca140
Opcode Fuzzy Hash: 80b5e25900e62fa5b7f868b9038989c12ce663ab15b6782b2becc0f24b60a991
Instruction Fuzzy Hash: BA31D375108681CBEB158F298490772BBE2EFA3310F2995DDC0D5AB392C6799842CB54

Function 00BA00DF Relevance: 2.6, Strings: 2, Instructions: 108COMMON

Download Yara Rule

Strings

fI.K, xrefs: 00BA0167
M"O, xrefs: 00BA016E

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: M"O$fI.K
API String ID: 0-3473069917
Opcode ID: a50f177498f9f56b16f7faf9ec1f3eef4274cbe2d8e1a906e5367dc70dca7c59
Instruction ID: a70b99db8cb68324ff66f057fc98d39ca18457a9a74b4048debaa0c006027f2b
Opcode Fuzzy Hash: a50f177498f9f56b16f7faf9ec1f3eef4274cbe2d8e1a906e5367dc70dca7c59
Instruction Fuzzy Hash: A031E4B52047418BE715CF29D850772FBE2EF97310F29959CC0859F392CA799843CB44

Function 00BC2A34 Relevance: 2.3, Strings: 1, Instructions: 1066COMMON

Download Yara Rule

Strings

@, xrefs: 00BC2B33

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 7d58ce99e14cd4456ae23e5809613514da7f6838dea5dcaaa26db1aac14b0b8b
Instruction ID: f2866b2bc0cffc394ddfd44e7a2df5ba47f223f62127d4839c268f2b3b13d80c
Opcode Fuzzy Hash: 7d58ce99e14cd4456ae23e5809613514da7f6838dea5dcaaa26db1aac14b0b8b
Instruction Fuzzy Hash: FE72E630618B498FDB69DF28C885BA973E1FB98705F54466DD88BC7241DF34EA42CB81

Function 00B99344 Relevance: 1.7, Strings: 1, Instructions: 403COMMON

Download Yara Rule

Strings

klm", xrefs: 00B99425

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: klm"
API String ID: 0-2308819284
Opcode ID: 5ecadd6f7ec23193bce9450410173a0c4ee4496c18b207c1d03c5920547ecbaa
Instruction ID: cd0b5600f77b5828ff104cd63201e58777313e7b3a567ef7054ae2a19b875b71
Opcode Fuzzy Hash: 5ecadd6f7ec23193bce9450410173a0c4ee4496c18b207c1d03c5920547ecbaa
Instruction Fuzzy Hash: 07B15B726183418BEF68CF6C888167BB7D5EBA9310F1986BCE99597381E334DC05C792

Function 00B8BE68 Relevance: 1.6, Strings: 1, Instructions: 324COMMON

Download Yara Rule

Strings

KtBD, xrefs: 00B8C1B9

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: KtBD
API String ID: 0-2371315874
Opcode ID: 6d1fb5ce0045cb9f34235038d5880c04dc3b93b51e3ba4dcd46ce03b2af1d0cd
Instruction ID: afc1a369d1302a36cdca1698bf9adbc5633118d75a258dd897228f370e36f63c
Opcode Fuzzy Hash: 6d1fb5ce0045cb9f34235038d5880c04dc3b93b51e3ba4dcd46ce03b2af1d0cd
Instruction Fuzzy Hash: F8A179715483914FD718DF38C89066FBFE2ABD6700F088A6CF1D697295DB758905CB82

Function 00B9F187 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

FL~O, xrefs: 00B9F2C7

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: FL~O
API String ID: 0-2976162848
Opcode ID: 18649a1a29131128d5b4adce49bc42d5c1c1f33e7a2e72b95aa3a9eea7d687c0
Instruction ID: e6b03bc007fcc7c9920c7c0850e5ecb4804fe84e805551a9f2faa2956dea957a
Opcode Fuzzy Hash: 18649a1a29131128d5b4adce49bc42d5c1c1f33e7a2e72b95aa3a9eea7d687c0
Instruction Fuzzy Hash: 0771F5752047828FDB25CF2AC4D0762FBE2EFA6310B2885ADD4D68B352D735A806CB51

Function 00B776B4 Relevance: 1.5, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

,, xrefs: 00B77827

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: ecebe23ec0881f7020f4b901c59648ec2a6586f088ba65e78406499129a36248
Instruction ID: 2bd2ccc936c8a8bc215999ca32d9be883492d6a66edb172abab5605fa38d0c7c
Opcode Fuzzy Hash: ecebe23ec0881f7020f4b901c59648ec2a6586f088ba65e78406499129a36248
Instruction Fuzzy Hash: D2B1397010D3859FD325CF68C88061BFBE0AFA9704F448A6DF5E997342D671EA18CB96

Function 00B861A4 Relevance: 1.5, Strings: 1, Instructions: 263COMMON

Download Yara Rule

Strings

gfff, xrefs: 00B863CB

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: gfff
API String ID: 0-1553575800
Opcode ID: da9dc378ba23d74061a16eeb81585a4670e68b3d59944b4248796e150ca8c016
Instruction ID: 5992dc706e886ddac35e2ca24ce5201c1f58933ee317c5c320b77da5821510db
Opcode Fuzzy Hash: da9dc378ba23d74061a16eeb81585a4670e68b3d59944b4248796e150ca8c016
Instruction Fuzzy Hash: EB910476610A018BD728CB39C8917A677E2FB85324F18866DD526CB7E5DB78A806CB40

Function 00B7A034 Relevance: 1.5, Strings: 1, Instructions: 234COMMON

Download Yara Rule

Strings

b/7, xrefs: 00B7A088

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: b/7
API String ID: 0-2085417233
Opcode ID: 6e982e3cfaf07f258f3effdd4bbc4fdd32167dcef8fa8f803002f04f24a2a174
Instruction ID: 7542332521761ab061fbed646a11ac1888852febc6b8a72723f65c136a86efa5
Opcode Fuzzy Hash: 6e982e3cfaf07f258f3effdd4bbc4fdd32167dcef8fa8f803002f04f24a2a174
Instruction Fuzzy Hash: 1F71FB73A043114FC718EF78CC8576AF6D6ABC5310F0AC67DE598A7392EA7498048782

Function 00BA0A89 Relevance: 1.4, Strings: 1, Instructions: 190COMMON

Download Yara Rule

Strings

h~BL, xrefs: 00BA0C02

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: h~BL
API String ID: 0-1016882582
Opcode ID: 2353f16c686568adc0586de7d1e93e01bd2d2aed02e5eac9b0619ca2789dfc7a
Instruction ID: 10cba356bd468914c40306c4d9eb8eba458b37df8d0efa3eee679f53af9ccec5
Opcode Fuzzy Hash: 2353f16c686568adc0586de7d1e93e01bd2d2aed02e5eac9b0619ca2789dfc7a
Instruction Fuzzy Hash: 4C514B316597828BD7188F28C4D1362BBD2EF97364F1C87ADC5958B7C2D3389806D760

Function 00B9F624 Relevance: 1.4, Strings: 1, Instructions: 167COMMON

Download Yara Rule

Strings

3Z{, xrefs: 00B9F694

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: 3Z{
API String ID: 0-2331068373
Opcode ID: 23b383c78454ef6be3be3edf7f88053188138058e6849870bafb74795745ec60
Instruction ID: 73fa7dfcbc40939b5590a03ab41ab9f371eb83ba571cbc4e2a276772683cdf14
Opcode Fuzzy Hash: 23b383c78454ef6be3be3edf7f88053188138058e6849870bafb74795745ec60
Instruction Fuzzy Hash: 9A41F8705043819FEB268F28C891B72BFE1EF57715F2844ECE4D68F292D7669806C761

Function 00B9F8F6 Relevance: 1.4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

Strings

79.', xrefs: 00B9F909

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: 79.'
API String ID: 0-3373235548
Opcode ID: 3052bdd5b9f525bfd9188c849dd4df91fdd9a95299ae7d6644acfbbe7ea22ffb
Instruction ID: 42afdcf12b2c4d168aa46d7a827b634951e369ce8b4cc50d5450ea9373602ec5
Opcode Fuzzy Hash: 3052bdd5b9f525bfd9188c849dd4df91fdd9a95299ae7d6644acfbbe7ea22ffb
Instruction Fuzzy Hash: 7441E6645043D19BEB274B2888E1732BFE1FF27325F2855ECD4E25F692C265E806CB51

Function 00B9C104 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

~, xrefs: 00B9C126

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: ~
API String ID: 0-2894255414
Opcode ID: b65a2b0f6834741de1f91dc40b806d39aebe2b80ec226c2fcdce17e422ad554e
Instruction ID: 46b6d34be88cbfc3c32b599c97e66a9a6a700fce47a9a4b7a3afaa2dc65ba76f
Opcode Fuzzy Hash: b65a2b0f6834741de1f91dc40b806d39aebe2b80ec226c2fcdce17e422ad554e
Instruction Fuzzy Hash: AE31B8B56493558FE350DF259890A2FFBF6FBD2740F10A82CE6809B296C7B0D406CB46

Function 00B7D31D Relevance: 1.3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

WT, xrefs: 00B7D37C

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID: WT
API String ID: 0-3626323073
Opcode ID: c98c440a951f3e80385427973262f6473fe4faebb6d8defc51fc15df456e7494
Instruction ID: 3f621136a3948a28cf4cdaeadc53cbf008dd95bbc931d4fc24f2c838167543b0
Opcode Fuzzy Hash: c98c440a951f3e80385427973262f6473fe4faebb6d8defc51fc15df456e7494
Instruction Fuzzy Hash: A2213A765093408FC7288F24C89066BF7F2EFC6318F19891DD69617645DA75A806CF4A

Function 00B81D3A Relevance: .9, Instructions: 941COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1474361b0d2a4b0e8945a45e811d4af63ccafd11140a6d488a7330ea5c481797
Instruction ID: 72f655d22f349118f49db93011ff51480013b912adc9b2983476807991f8a1ec
Opcode Fuzzy Hash: 1474361b0d2a4b0e8945a45e811d4af63ccafd11140a6d488a7330ea5c481797
Instruction Fuzzy Hash: 3182F7B1604B408FD724EF38C89539ABBE2AF95320F198A7DD5EA877D1D635E405CB02

Function 00BA1944 Relevance: .9, Instructions: 875COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 407d260e2984e500bc938a2af9084afc88076a4a5a4afd9904190e82843a23c4
Instruction ID: 3bd6ae350b06ae152fcedfd9389680f8ac588235512a92b77ff049d8eae26cca
Opcode Fuzzy Hash: 407d260e2984e500bc938a2af9084afc88076a4a5a4afd9904190e82843a23c4
Instruction Fuzzy Hash: C992A6B0615B809FD3A1CF3DC841793BBE8AB1A301F14496EE1EED7342D774A9408B69

Function 00BA53C4 Relevance: .8, Instructions: 767COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14e624bee96e47c6332c5ade784e2d0ceaf0cdec4d8aca0be867267f1b83f6b7
Instruction ID: 685d2e670c6f85f81c2509b8556a01bd7071f581da1486ab980dfccea54a6c43
Opcode Fuzzy Hash: 14e624bee96e47c6332c5ade784e2d0ceaf0cdec4d8aca0be867267f1b83f6b7
Instruction Fuzzy Hash: 3A7237B1614B819FD365CF39C805793BFE9AB9A310F18892ED0EAC3752C778A901CB55

Function 00B8FB44 Relevance: .7, Instructions: 677COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f17ea89f4d1b368da92741cca1a27be89d7296a3ee0b739eace175103a64188a
Instruction ID: f892b19b0f17788ea6eb9f87066f54377284c047cd20d5520f59c2cbb80bf913
Opcode Fuzzy Hash: f17ea89f4d1b368da92741cca1a27be89d7296a3ee0b739eace175103a64188a
Instruction Fuzzy Hash: BC627EB0609B818ED325CF3C8815797BFD5AB5A324F148A9DE0FA873D2C7756102CB66

Function 00B77F14 Relevance: .7, Instructions: 665COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6622422d7539ce0b52b06fdf36dba662481708c3368aacd43c76f1fee5f17e3d
Instruction ID: 2684b4f1f7c6fa7aac40654382ea56f07d8a45e1584a49da2d51a4cd8fda134c
Opcode Fuzzy Hash: 6622422d7539ce0b52b06fdf36dba662481708c3368aacd43c76f1fee5f17e3d
Instruction Fuzzy Hash: 0252D470948B848FE735CB24C4883A7BBE1EB55710F14889ED6FF07A82D779A885C716

Function 00B78CF4 Relevance: .6, Instructions: 625COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c7625dc8a02050d2483af0f75c91bb5bc7877375563f0b19dd77e196208affe
Instruction ID: 055e7a1468d8604cde790f1bfb1bc176053f06287d88517d0c182481ddcb4cf2
Opcode Fuzzy Hash: 0c7625dc8a02050d2483af0f75c91bb5bc7877375563f0b19dd77e196208affe
Instruction Fuzzy Hash: 2622D332A083119BC735DF18D9846ABB3E2FFC4315F29CA6DD9DA97281D734A811CB46

Function 00B75214 Relevance: .6, Instructions: 600COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be30a2da7f887a4e4f80172f92d1401173ff8208445a594a074021b1418aa212
Instruction ID: 56e20fc0786db48e264a165da1bb043df569470e70ec2182005ea11c238b84be
Opcode Fuzzy Hash: be30a2da7f887a4e4f80172f92d1401173ff8208445a594a074021b1418aa212
Instruction Fuzzy Hash: 8632F270914F108FC378CF29C58052AB7F2FB55710B648A6ED6AB8BA90D7B6F845CB14

Function 00B8296C Relevance: .6, Instructions: 560COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae7b3f51c9effa284a301cfccf5d1c2fc080d0954d373b0cf9aaca151b60bb47
Instruction ID: eada135d86696b1998c255195cd692b8418d42e7c7709879d40d792b2651a573
Opcode Fuzzy Hash: ae7b3f51c9effa284a301cfccf5d1c2fc080d0954d373b0cf9aaca151b60bb47
Instruction Fuzzy Hash: 1E22E871604B408FD754EF38C48536ABBE1AF95310F188AADD8EB877A1D635E909CB02

Function 00B70000 Relevance: .5, Instructions: 497COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96ff1b0c91c94a8fe6779f2a7a36278e5e830afab3b5d96a6aa7dac4e4e8855c
Instruction ID: fee2a62e86fbb10fac941c6c7cd38d2a0ab066d34e1901a85e109f1d6e7e2f66
Opcode Fuzzy Hash: 96ff1b0c91c94a8fe6779f2a7a36278e5e830afab3b5d96a6aa7dac4e4e8855c
Instruction Fuzzy Hash: 21E15BB7D143394BDB28CEB98C893AEA612F7C0308F82E62DD956EF645CF35454646C1

Function 00B7FDA4 Relevance: .4, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 287fe9960c1a609efd5c0c66f2ac5d44ad56dc0fe5693a4a92eca0da343a75c5
Instruction ID: 46d59eb16438ba8fa2c3cee2c42b6ff7504bf89c19386f010baa9a2f5e8309f2
Opcode Fuzzy Hash: 287fe9960c1a609efd5c0c66f2ac5d44ad56dc0fe5693a4a92eca0da343a75c5
Instruction Fuzzy Hash: 5F02F3F1911B00AFC3A1DF3AC842797BEEDEB4A360F14495EF1AEC7251D63165058BA2

Function 00BC1338 Relevance: .4, Instructions: 429COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f25aa825a39bec38ad6b6d36dd1a7b58a115f37f7b46c95bc86c5f4f7415b87
Instruction ID: 55d94cfa6771d597e7ad1b146fd8d98fa0fd113ac6a10b03f8c89e7d7f515946
Opcode Fuzzy Hash: 3f25aa825a39bec38ad6b6d36dd1a7b58a115f37f7b46c95bc86c5f4f7415b87
Instruction Fuzzy Hash: 03D17970718A498BDB28DF68D849BAEB7E5FB59701F00462ED84BD7241DF30E9118B81

Function 00B771D4 Relevance: .4, Instructions: 413COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1f1e7085290bf942a3f1d451a847f46da938290f2730fd2d0b09b2c529a42b5
Instruction ID: 0bd89d94ae2aa6f69aef17b6fceb1502502494a068385afd78b3ad943d0066fc
Opcode Fuzzy Hash: b1f1e7085290bf942a3f1d451a847f46da938290f2730fd2d0b09b2c529a42b5
Instruction Fuzzy Hash: A8E1597124C7418FD725CF29C880A2BFBE2EF98300F48896DE5D987751D675E944CB52

Function 00BC25FC Relevance: .4, Instructions: 409COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e74d2aa687a79bc353c1e30e2761018af6d861ea5a8c8f1c92844b65f1d9ba9
Instruction ID: 50c370cdec3e115acfebc3103233362e7546a81246138ba1f930fe6f59980e61
Opcode Fuzzy Hash: 3e74d2aa687a79bc353c1e30e2761018af6d861ea5a8c8f1c92844b65f1d9ba9
Instruction Fuzzy Hash: 81D15D31518A488FDB59EF28D889AEAB7E1FF98310F04466DE84AC7155DF30E945CB82

Function 00BAB03E Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e221bef2291457b3eeae710c9d360d698535e8fada81a59d1dc249c91ca4b13b
Instruction ID: 7458299f54ddae21ab1eb062798784dedd3e287e82df55b2355d4e562f2a8705
Opcode Fuzzy Hash: e221bef2291457b3eeae710c9d360d698535e8fada81a59d1dc249c91ca4b13b
Instruction Fuzzy Hash: ED124420908BD18ED326CB7C8848B497F916B67224F0E83D9D4F55F3F3D6A58906C7A2

Function 00BC222C Relevance: .4, Instructions: 380COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e45004cfa00b96cc07e21d80348e0ecc464919f4c4bc6f170ace2c42d415ba2b
Instruction ID: 55e7d068a21afc6ae531f0990d13f9b2e49f5d650914695339700288c4fcd0b9
Opcode Fuzzy Hash: e45004cfa00b96cc07e21d80348e0ecc464919f4c4bc6f170ace2c42d415ba2b
Instruction Fuzzy Hash: A8B17330714E098BCB59EB28C8D5FBAB3D2FB98301F5446ADD84AC7245DB34E946CB91

Function 00BB3D54 Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80768ea15acc26a1c01c9e33948a476274676e0131c1a2678f72f8bc7e0d6ba4
Instruction ID: ce4e90393c42593f17080e510f17804b83dc28ff6124833e549c428fea16c056
Opcode Fuzzy Hash: 80768ea15acc26a1c01c9e33948a476274676e0131c1a2678f72f8bc7e0d6ba4
Instruction Fuzzy Hash: D1A145326083018BC724EF28C8906BBB7E2EFD5720F19867DE99597291D7B5DC05CB92

Function 00B77A84 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05437df602dc57edd95d2a5d4231048cbcefe00e6ea43abd62f39208546a0616
Instruction ID: 62d56eacb263562855fcc40a99d13d715916da7724e36aad3304b9aa81c3919e
Opcode Fuzzy Hash: 05437df602dc57edd95d2a5d4231048cbcefe00e6ea43abd62f39208546a0616
Instruction Fuzzy Hash: DAC14CB29487418FC370CF68CC86BABB7E1EF85318F08896DD1D9C6242E778A555CB45

Function 00BAB5CC Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aebfea78292e90f22496fe1e3b2e789f277366479e7ad366d1224988f739e111
Instruction ID: ee57e2deb2f092e39016545dd307f0cb021a11ce1e7931e70d8fe6043505c6fd
Opcode Fuzzy Hash: aebfea78292e90f22496fe1e3b2e789f277366479e7ad366d1224988f739e111
Instruction Fuzzy Hash: 90D18221508BD18ED322CB3C884874ABFE16F57224F59879DD0F65B7E2C365A906C792

Function 00BB46D4 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e2bb4869fa71b171da7062b259e1c56349b948f9aff5454853da40c7c8ac9c8
Instruction ID: 9ea6ef30d2342a7b6d3233d3110a1158d2ff8c3f0df0ac98a8a19e177edf3c51
Opcode Fuzzy Hash: 4e2bb4869fa71b171da7062b259e1c56349b948f9aff5454853da40c7c8ac9c8
Instruction Fuzzy Hash: 848115356082518BD7188E29DC915BB77E2FBC5320F19867CE9964B392DBB09C06C782

Function 00BAAA20 Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ec4b32ad510046600747c2ad7e746814a4556868eeb270525aca74a288b5846
Instruction ID: f2f2015508eb43d2c715991a561ed1f8bcea61ca3d49a5578a3c92c56ea37888
Opcode Fuzzy Hash: 2ec4b32ad510046600747c2ad7e746814a4556868eeb270525aca74a288b5846
Instruction Fuzzy Hash: 23D19321508BC18ED322CB3C888874ABFE26B57224F4D879DD0E55B7E2D775A506C762

Function 00B8D3C4 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72ede770be2ae462dea2a9dd93b537463ac65c81dc379a0d06bada6212b2b16b
Instruction ID: c06c62ad9dc0c44963cd072631923a81794c836b8e154c8d5b75691debb4377d
Opcode Fuzzy Hash: 72ede770be2ae462dea2a9dd93b537463ac65c81dc379a0d06bada6212b2b16b
Instruction Fuzzy Hash: 1B9129326082654FC7159E28D88179EBBD2EB95220F1C827EE8B8CB3D1D779D806D7D1

Function 00BB4384 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecc63a2072383da7df41fad46595759b9d4fca71c53878d26cb3a42d08f0d3f2
Instruction ID: 5c824aa101cb0445555bb89e606b11360b94759f1e4b3742914ca61b399d1c63
Opcode Fuzzy Hash: ecc63a2072383da7df41fad46595759b9d4fca71c53878d26cb3a42d08f0d3f2
Instruction Fuzzy Hash: 6B9127326047159BC7289F58C8D06BAB3E2FF89310F1986BCE9955B3A1DBB0AC05C781

Function 00BC34D4 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2e903f92329977da97ab707699d6460e74b4fcfb6d1b984767a57618237eb95
Instruction ID: 62f89ce7b19d9d5e648be7dddc5b2c68eddfa72ac5e819e8f7f1c1863e217673
Opcode Fuzzy Hash: e2e903f92329977da97ab707699d6460e74b4fcfb6d1b984767a57618237eb95
Instruction Fuzzy Hash: 71A10C71508A4C8FDB55EF28C889BEAB7F5FB68315F10466EE44AC7161EB30DA44CB81

Function 00B98664 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5515b50c9ee47dc2f8c36c8cce0e7028ab4af9639b4148825816c497b9ac7762
Instruction ID: 1363180f875309386b233716307d21e8c24a33c0b3c30663aa7edd3e2a9eb05f
Opcode Fuzzy Hash: 5515b50c9ee47dc2f8c36c8cce0e7028ab4af9639b4148825816c497b9ac7762
Instruction Fuzzy Hash: CB816BB29093108BCB18DF24C85026BBBF2EFD2314F18CA6DE5D59B394EB748905C792

Function 00BA3A7C Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 168d4cee08773db59f2c79459135757ac00f7aebb2ce96548f69e8bf57a9f324
Instruction ID: c539d55c60b76e9e8593f86cde98c68d004436256d39d5c58df0f60823f7d057
Opcode Fuzzy Hash: 168d4cee08773db59f2c79459135757ac00f7aebb2ce96548f69e8bf57a9f324
Instruction Fuzzy Hash: 85C1C472608B808FD3258B38C8953A7BFD25FA6310F1DCA6DD4EE87786D679A405C712

Function 00BA2ADA Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80a5d58a3208a3eb61af739105256fa8bec8b08d3f8ae1ffcf71027051207583
Instruction ID: 236c18a35c6a59459fc134fe81b219634a68c73083299d53b48eb903ff03f4c4
Opcode Fuzzy Hash: 80a5d58a3208a3eb61af739105256fa8bec8b08d3f8ae1ffcf71027051207583
Instruction Fuzzy Hash: DFB1D871609B808FD3298B3CC4953ABBFE15B96310F18CAACD5EB877C2D535A509C752

Function 00BA337C Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea2e314d6c797e7380a4729dce3a043da3c6b9074752915ea08d70c4aaab4540
Instruction ID: 0241a1f71ab7bd7b47f6c3585022c4effde1b5b2e09e7e8a32d7398a57b80ce2
Opcode Fuzzy Hash: ea2e314d6c797e7380a4729dce3a043da3c6b9074752915ea08d70c4aaab4540
Instruction Fuzzy Hash: 61B1F761608F808FD3258B3CC49539BBFE25B96314F1CCAACD5EB87782D639A509C752

Function 00B9B014 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efb83c220a63a8557cd1619c2e1cd551980cd5c94d2b991c8a0d9f5023c9805e
Instruction ID: 28fa650344a414482a86cc213a7b837cc1b028ee2e7c71a489c45002cd26b871
Opcode Fuzzy Hash: efb83c220a63a8557cd1619c2e1cd551980cd5c94d2b991c8a0d9f5023c9805e
Instruction Fuzzy Hash: 07713471900325CBCF14CF58D9A2ABBB3B1FF56310B1582ACC8916B794E735AD01CB98

Function 00B8E0C4 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fb8983ddb80d549abcaca12ea37e6bb225b10b3ed429340747722f435c066c2
Instruction ID: 71b867e5347424118e9c67e2ec3511a91e01eb8f397e20e2e2fd12fbb4346ad4
Opcode Fuzzy Hash: 6fb8983ddb80d549abcaca12ea37e6bb225b10b3ed429340747722f435c066c2
Instruction Fuzzy Hash: CE812832B199914BC7199E7C8C912AABAA35BD7330B2D83B9E5B19B3E1C5658C01C360

Function 00BB40D4 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 405b15d91be31db6790b6c9e05e5eb7c1f838f3a3464d3462c435711021f930a
Instruction ID: 37c9f34ad6b7867fa37db02a0987ffe5c480d7a01c13d5a743a658b15a990dda
Opcode Fuzzy Hash: 405b15d91be31db6790b6c9e05e5eb7c1f838f3a3464d3462c435711021f930a
Instruction Fuzzy Hash: DD818F346042029BC714DF1CC880ABAB7F2FF99710F1986ACE9949B3A2EB71DC51DB45

Function 00BB2301 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 620a92d7b8cb787c03d1ce8c562cc66d8847493fdb5bd5087683695be5fbde3f
Instruction ID: f35bf16dd9a141c6a94f90df8e41b8fceb114ffad7da7b33d6515b9317de9934
Opcode Fuzzy Hash: 620a92d7b8cb787c03d1ce8c562cc66d8847493fdb5bd5087683695be5fbde3f
Instruction Fuzzy Hash: 0861EB71A102118FDB18CF64C8917BAB7F2FF99310F0A82ADD546AB3A5E7B59C01C794

Function 00B8F534 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cf96c1f918d61b0610e1e59964adfdb0061d02bd348bd41cdccd9df3b9e21b1
Instruction ID: dbb23310b31c74d588f045413888d8d2639148aa5df354415d51a38b2842741c
Opcode Fuzzy Hash: 8cf96c1f918d61b0610e1e59964adfdb0061d02bd348bd41cdccd9df3b9e21b1
Instruction Fuzzy Hash: AB6127356083924FC7259F38C89192E7BE1EF95310F4882BDE8E44B3A2D671DD05C792

Function 00BAC534 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bfe9ffa8413bde6872df37f013aed2b62b6051166d4a6f8bde0560446e4846b
Instruction ID: e8f4e9aeb727cca0a30cb21e84ac23f960f0a8eb79b3b1dfad5f9e9cf24af8c0
Opcode Fuzzy Hash: 8bfe9ffa8413bde6872df37f013aed2b62b6051166d4a6f8bde0560446e4846b
Instruction Fuzzy Hash: 8B514BB19087548FE314DF29D89475BBBE1FBC9314F044A2DE5E987350E779DA088B82

Function 00BB3AA4 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e639b92aa0330a83a9c8eabd28dc9be480c53553e2f66d9bbb52e8a64dcdd39
Instruction ID: d58e1a3867358332227da450171bad0fb5ce2d469286c970679c9bca2dda18cf
Opcode Fuzzy Hash: 8e639b92aa0330a83a9c8eabd28dc9be480c53553e2f66d9bbb52e8a64dcdd39
Instruction Fuzzy Hash: 19410273B583104FD314DEB9CC8136ABBD2EB94314F1A857DE9D4E7241E2B88A058792

Function 00B74234 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94ca20dc4f76e8c3e8d02b75f9c402b180f2256a0ed4e9f610f16215ed658aa6
Instruction ID: 741a19e432abf5022ae4f4ee7bee5853287ceaa9b38d54af6d6bb93d8f7f8b4a
Opcode Fuzzy Hash: 94ca20dc4f76e8c3e8d02b75f9c402b180f2256a0ed4e9f610f16215ed658aa6
Instruction Fuzzy Hash: D0412832B0C2654BC7149E2D8C5027ABAD68FC5209F0EC6BDA8DD9B78BE674D81097C4

Function 00BB2BA5 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fa374590dffa9170f901e677aeca6d256a19dc4d7adeacb217e02be019ebc1f
Instruction ID: 3fa1ab7b02fd1c8b686e5c9d1e48d2439efb696aafc18d901dd9a5e6f7e7ef40
Opcode Fuzzy Hash: 4fa374590dffa9170f901e677aeca6d256a19dc4d7adeacb217e02be019ebc1f
Instruction Fuzzy Hash: 7241F132A086614BC318CE3C889116BFBE6EBCA614F1A866DC889D7361D6B0DC018BC5

Function 00BB3674 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2389c2aa22a80157ecc906328f111fcc8f688184627fafe56874ccb06f0814c5
Instruction ID: 453038b7f7b89c11c0f02fefcd684b14ad41a560435230d10fad3044e67cfd4c
Opcode Fuzzy Hash: 2389c2aa22a80157ecc906328f111fcc8f688184627fafe56874ccb06f0814c5
Instruction Fuzzy Hash: 20317CB22187504BDB19CF3988F697BFBCBABCA714F5E857DC8C687295DD70A9048600

Function 00B7A5C4 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f822273db6c68e011de364cdba3ced214ba853329870a82143a1b3826a5d9c10
Instruction ID: 52b1d326938764498d9702678c3aef7199769c2698ef4e856cbda55fd520a4ec
Opcode Fuzzy Hash: f822273db6c68e011de364cdba3ced214ba853329870a82143a1b3826a5d9c10
Instruction Fuzzy Hash: 9B317D621453434BD758C92884911BAFBE1EBE1360F1C877DD47A077C1E318E918E3A2

Function 00B7F8DE Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 550955050dfdcde3c904be6984569726dad2dcd699ae92ba3bf8c7e90d3e8808
Instruction ID: 24d1004613c62d3d39a032dc560ccbc66141efa450f2a49379fad513dfcd82ee
Opcode Fuzzy Hash: 550955050dfdcde3c904be6984569726dad2dcd699ae92ba3bf8c7e90d3e8808
Instruction Fuzzy Hash: 2331E474614642DFD719CF2CC990A3677F2FB8A310B24C6A8D56A57B94E730EC11CB54

Function 00B9ED14 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20eb69036d69807debfbd8ef52ec59536dd4d5321856e452b3146c9f2ae76fca
Instruction ID: d5940726728d580f6b64ad81a7c03844a05d567b87ac80067f98b645486c3b04
Opcode Fuzzy Hash: 20eb69036d69807debfbd8ef52ec59536dd4d5321856e452b3146c9f2ae76fca
Instruction Fuzzy Hash: 9731E1356406828BEB29CF29C850331FBE3EF96310B2C82BCD1E1577E6D674E842C645

Function 00B7F766 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 398ed19c1b5591b7a93386f97a201355981c08b3bbe4d8edfbabb66191edd784
Instruction ID: d5f1bdd051bff758c0c30e4d4d01f3f6fca902c78a1307c4572b5b600daf1418
Opcode Fuzzy Hash: 398ed19c1b5591b7a93386f97a201355981c08b3bbe4d8edfbabb66191edd784
Instruction Fuzzy Hash: 9A316378700103DBD218CB29DC81A7573E7F786315BB9C675D529972A0E770EC22CA99

Function 00B71087 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b09967ac5482500bc099009dc95111bd7cc7545dcabcf40ba633cd1a509d9f95
Instruction ID: 5054bc457497e6c336747326a09046a0ad2d0bde6d61eb3970e5a6c0345cbb3c
Opcode Fuzzy Hash: b09967ac5482500bc099009dc95111bd7cc7545dcabcf40ba633cd1a509d9f95
Instruction Fuzzy Hash: 80517074E01209DFCB08CF88C590AAEB7F2FF88314F608599D915AB745D731AE91DBA0

Function 00B86F3D Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e840308f10c17a667c19588e25512fd9af3edd54cbb022b12e8be8527047f3a
Instruction ID: f84ca31b0184d0647c3bc17d17f954af36c6881b01fd820989a11b47f8051482
Opcode Fuzzy Hash: 4e840308f10c17a667c19588e25512fd9af3edd54cbb022b12e8be8527047f3a
Instruction Fuzzy Hash: 5431BF301046828FDB29CF29D4A0A76FBE1EF63310F1986DCD196CB6E2C728E446CB14

Function 00BB03F4 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2278262ddf3a3083b0dcafd05991e17689cd6f1b05302bf6df86fa708b8ff67
Instruction ID: 9c1690e4e36b8138a9b3b3b57690fe0ba8cdbe6c1b50b65689fee6530d097c4e
Opcode Fuzzy Hash: d2278262ddf3a3083b0dcafd05991e17689cd6f1b05302bf6df86fa708b8ff67
Instruction Fuzzy Hash: 19213471A182108BE728DF19C8857BBBBF2EBC5324F19896CD89857381D3F98C418BD1

Function 00B96696 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 912accffe033f0f82063d52dd10dad5a5a635153b51dfb6b5b4154f60fd1b491
Instruction ID: 0f01954d00bedbea1158fe2030086c10449d53a3d956825c3ffb7214b5b24065
Opcode Fuzzy Hash: 912accffe033f0f82063d52dd10dad5a5a635153b51dfb6b5b4154f60fd1b491
Instruction Fuzzy Hash: 4A21A976B097019BCB1CCF99C4912BFF3E2ABD0704F49887CD99AD7650EA38DD058685

Function 00B87519 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa270377212e71c5cc8816314e8c4dbc58a3caa0ef93d2f0f9f2b7a593cf6fff
Instruction ID: cad407aea6a8117e8ecf3cdf401c6269eaaf0a77c9a925f3ac5883096e8c3be4
Opcode Fuzzy Hash: aa270377212e71c5cc8816314e8c4dbc58a3caa0ef93d2f0f9f2b7a593cf6fff
Instruction Fuzzy Hash: 772101706057028FD329DF29C840966B7F3EF92314B26C5E8D0991BBB5DB30E912CB90

Function 00B74414 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfaf8d0e94f5c6e15ea278469f7b2b102a292380ec2eac3b30e0d01d28b7b789
Instruction ID: cccb1428eade66598b8bfbd69a8412c4dfa40e3d06e360c99ca5bcbf9338644d
Opcode Fuzzy Hash: bfaf8d0e94f5c6e15ea278469f7b2b102a292380ec2eac3b30e0d01d28b7b789
Instruction Fuzzy Hash: 8311E43AB546214BF758CF61D8F563AA382E7C631171A017ECA8B53381CF20E912E244

Function 00BB25CC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5026a4c9932bb01eb1cfa22389ce0795d21ac30bdbbfe162f59341988a769c1d
Instruction ID: e79b702dd0054301e628c329c9caf28a38df4e306bf77fecc0651a3c8d6123a0
Opcode Fuzzy Hash: 5026a4c9932bb01eb1cfa22389ce0795d21ac30bdbbfe162f59341988a769c1d
Instruction Fuzzy Hash: C111273BB658228BD71CCB35C8605B5A3C3ABA520430EC0BEC812E7298DF34D8118785

Function 00B71086 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e64317625e06953a0030493f718403388be9115d8c6a0e5777c3d8d6dbedd3d
Instruction ID: d56105bab67d4a0b68c5b26250bf9bd79b385e5e625a109d26d9607e0dccded8
Opcode Fuzzy Hash: 4e64317625e06953a0030493f718403388be9115d8c6a0e5777c3d8d6dbedd3d
Instruction Fuzzy Hash: A5318274E00119DFCB08CF99C590AAEBBF1FF88314F248599D815AB345D735AA82CFA4

Function 00BAA3E4 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: c58ec97538fb5d8403bcd37a635b55f9b979a40c8acbb43bbdd2ae84ae158e63
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: A811A332A091D00AC3168D3C84545A5BFE24A97635F5983E9F4B49B2D2CA268D8AD372

Function 00B9CD24 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89b2a4774bc0a00a24eedf7c1c3b08a8b7ef9a7eeaa125e52bef8acd1da686d4
Instruction ID: 568020d46e0eb7a705d0201522ec7b18fce54c9c50a704e5659ccc86b02ddb17
Opcode Fuzzy Hash: 89b2a4774bc0a00a24eedf7c1c3b08a8b7ef9a7eeaa125e52bef8acd1da686d4
Instruction Fuzzy Hash: AC011AB26113015BEF20AE64C8C1B2BAEE8AF95704F1884BCE91967201DB65EC15C6B2

Function 00B890B6 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0300f0208cd1114f316579f692d9aa852186acc26e1ebcd63d6f935a3c75c8a1
Instruction ID: c66268052a1709cc718875c11e82e4d3d15e4b51cde62c908aa6e18dc1821728
Opcode Fuzzy Hash: 0300f0208cd1114f316579f692d9aa852186acc26e1ebcd63d6f935a3c75c8a1
Instruction Fuzzy Hash: 0011E635204601EFEB25EF28CC84BB573E3E786310F198668D2666B6F5DB75A801C714

Function 00B85D24 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3aa60f6da63562edd3c50ec9b788223f3d88ec9aa917c1ea63b3a2a7d7e655f7
Instruction ID: aeffe59e774c42a712d1a0c1653f0ed30eee6e856e2a041519f21456ba03ec89
Opcode Fuzzy Hash: 3aa60f6da63562edd3c50ec9b788223f3d88ec9aa917c1ea63b3a2a7d7e655f7
Instruction Fuzzy Hash: 2D01A278600502CBCB38EB29DC9057673E1FB46703F5555ACE186AB974D330ED12C799

Function 00B870FA Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa0e802b754d52696746d0ec6f29ee9885b52feeac64a38fab2286ea8b451241
Instruction ID: 648c277d98095a870c141e231e2bbee9eaa6f474bf69cd6a31a1150454f75952
Opcode Fuzzy Hash: fa0e802b754d52696746d0ec6f29ee9885b52feeac64a38fab2286ea8b451241
Instruction Fuzzy Hash: 72017174649102DBD61CBB298CD963472A2FB43329FB456E4E511239B0EB70EC22C794

Function 00BB0704 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42cce553a47ad90661cc7164f6e5ecea50e894812c37f950bddd42d6e1c5427e
Instruction ID: 2bd33a407b31243cb8c0995d65433236ebf7088444619d4474d5cad2be11288c
Opcode Fuzzy Hash: 42cce553a47ad90661cc7164f6e5ecea50e894812c37f950bddd42d6e1c5427e
Instruction Fuzzy Hash: 9BF0F939614308ABD1246B4B9D80DB7B3EDE78E728F100358F515131A1EBA2FD119BE1

Function 00B98EF4 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12b5d8c97496696fa31f1fedca32606638faf7e08484992eb7175822c92a4753
Instruction ID: d05abd4016a672e4398a3fcdebd1728c5196e7fb335c9ffc3cbc1aecd38e0f2a
Opcode Fuzzy Hash: 12b5d8c97496696fa31f1fedca32606638faf7e08484992eb7175822c92a4753
Instruction Fuzzy Hash: B801B1B614C3418FD718CF91C84165BF7E1EB91314F28996DE58163201EB74CA0A8B5B

Function 00B98CA0 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0862e9f9da5d255eed0c602cc41b99171966797ed930e98455049133e38aa8b9
Instruction ID: 8818d8fdc3bfbe8d8d1223edcd4323365f1f443c8c3a56ef2196455f3b4e6cb1
Opcode Fuzzy Hash: 0862e9f9da5d255eed0c602cc41b99171966797ed930e98455049133e38aa8b9
Instruction Fuzzy Hash: 53F02475A01281DBDF2CCF18C85157AB3E6EF86311F64087CE292571A0E7A1A901C619

Function 00B70DE7 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f432f6d4d57ddd5edf10f0a55197208a6667e030cc273150dee4b63bd6a15e3
Instruction ID: 5d4d7275268cfda2d10dd37f9f59ac736a8140a5b960041b04dd7e71cb3458f0
Opcode Fuzzy Hash: 2f432f6d4d57ddd5edf10f0a55197208a6667e030cc273150dee4b63bd6a15e3
Instruction Fuzzy Hash: 1D019634A11508EBCB14EF94C284A9DB7F6EB48310F6086DAD8195B381D730AE41DB50

Function 00B7E438 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8656cd1a9d74df869ad8f22be8c3fd88ccb0ea15f397b936d6b69d150d3e7ac9
Instruction ID: ff61b9231b5af6c48cb1d82934a630ea8aeeaa7d7eb1477661cb3efef4af383c
Opcode Fuzzy Hash: 8656cd1a9d74df869ad8f22be8c3fd88ccb0ea15f397b936d6b69d150d3e7ac9
Instruction Fuzzy Hash: 72E0BD383C83007BF6398B08AC97F247221A743F22F301214B3623E2E58AE07140451D

Function 00B8F7A4 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction ID: 7e5c79c7b60c4746df52020c1fdcb95aa7c614604900135252ff86b306fc57cc
Opcode Fuzzy Hash: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction Fuzzy Hash: 86D0A7755487E20EAB58CD3404A0477FBF4EA47652B1814EEE4D1E3215D225DC01C79C

Function 00BB1C04 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b7598ff860c6c584cc28cc9e2ee4f827b81178b3db001d57e5e8ec4a7167bec
Instruction ID: 776a1f7dd0c074e79f55533e911544892ec85f46c384d1e8a4e462c15b4e92e9
Opcode Fuzzy Hash: 9b7598ff860c6c584cc28cc9e2ee4f827b81178b3db001d57e5e8ec4a7167bec
Instruction Fuzzy Hash: 97D022B86481003B0248CB09CC4AE33B77CC387200F002034BE05C3350C610EC2182EE

Function 00B982F4 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc2fa07c7324d2ac47afe96fa2dbd29daf0775af644ca9f8a24f442f38778e2a
Instruction ID: 034ce2f414d00fbbc7356c1ec6bd36ab0d7557729d9b8d26e3e3ee51a1e4b627
Opcode Fuzzy Hash: bc2fa07c7324d2ac47afe96fa2dbd29daf0775af644ca9f8a24f442f38778e2a
Instruction Fuzzy Hash: A0C04CB3C251008FD6152F209C0295EF9B16B97298F0C65B4A55D31131E622D665955B

Function 00B9A160 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d569c0e63b70640a0c233463593cb507a1bd4a74803e9e53c29ccff6e4ea7a7
Instruction ID: 4b1fd9a9a9f37212ac58872f1b97f01eb02d62766581f9a69686a2b5b45c2016
Opcode Fuzzy Hash: 4d569c0e63b70640a0c233463593cb507a1bd4a74803e9e53c29ccff6e4ea7a7
Instruction Fuzzy Hash: 0EB012B1C140008FCB00AF50DC428BDF6746707244F043030D10CB3121DA11D414865E

Function 00B9A2F8 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300468440.0000000000B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_G7T8lHJWWM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94cc0ccff712f6699580b0c52e39565fc483e3c5a352d2c9fb7cd4ff89b60668
Instruction ID: 69b8fc133355450a05f26199caa08c561b473884a00a94b966d4f1e8e9591281
Opcode Fuzzy Hash: 94cc0ccff712f6699580b0c52e39565fc483e3c5a352d2c9fb7cd4ff89b60668
Instruction Fuzzy Hash: DFA00139D892048B86449F44D4814B8F779A74F621F293414D409B3216CA20E8818A6C

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report G7T8lHJWWM.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
G7T8lHJWWM.exe

Function 00B70B87 Relevance: 6.1, APIs: 4, Instructions: 100
threadprocessCOMMON

Function 00B70A37 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 103
threadCOMMON

Function 00B70477 Relevance: 1.9, APIs: 1, Instructions: 399
threadCOMMON

Function 00BC478C Relevance: 6.1, APIs: 4, Instructions: 99
memoryCOMMON

Function 00BC55FC Relevance: 4.8, APIs: 3, Instructions: 325
memoryCOMMON

Function 00BC69AA Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
libraryCOMMON

Function 00BC4887 Relevance: 3.0, APIs: 2, Instructions: 48
memoryCOMMON

Function 00B8E394 Relevance: 83.7, Strings: 66, Instructions: 1193
COMMON

Function 00B9460B Relevance: 69.1, Strings: 55, Instructions: 394
COMMON

Function 00B96AC0 Relevance: 35.4, Strings: 28, Instructions: 433
COMMON

Function 00BAC794 Relevance: 22.9, Strings: 18, Instructions: 366
COMMON

Function 00B95892 Relevance: 10.2, Strings: 8, Instructions: 241
COMMON

Function 00BB0774 Relevance: 8.1, Strings: 6, Instructions: 616
COMMON