Edit tour

Windows Analysis Report
nogtpjadthaw.exe

Overview

General Information

Sample name:	nogtpjadthaw.exe
Analysis ID:	1635475
MD5:	2e070594f72d17abe15d822aca9f7d40
SHA1:	4d9ed6638bcf8749e2de2a42f379c81781e63e77
SHA256:	f4aa315f8ff0c107dce56c88112e061f4e6260682eaf0ffc42a5bcf0d5fd6b8d
Tags:	exeLummaStealeruser-aachum
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

Joe Sandbox ML detected suspicious sample

PE file has nameless sections

Sample uses string decryption to hide its real strings

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Detected non-DNS traffic on DNS port

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

nogtpjadthaw.exe (PID: 7256 cmdline: "C:\Users\user\Desktop\nogtpjadthaw.exe" MD5: 2E070594F72D17ABE15D822ACA9F7D40)

cleanup

Malware Configuration

Threatname: LummaC

{
  "C2 url": [
    "techvkortex.bet",
    "explorebieology.run",
    "gadgethgfub.icu",
    "moderzysics.top",
    "techmindzs.live",
    "codxefusion.top",
    "phygcsforum.life",
    "techspherxe.top"
  ],
  "Build id": "yau6Na--7400515879"
}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.nogtpjadthaw.exe.790000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-11T17:45:12.974708+0100	2028371	3	Unknown Traffic	192.168.2.11	49705	172.67.189.66	443	TCP
2025-03-11T17:45:20.249893+0100	2028371	3	Unknown Traffic	192.168.2.11	49708	172.67.212.102	443	TCP
2025-03-11T17:45:27.325064+0100	2028371	3	Unknown Traffic	192.168.2.11	49713	172.67.214.226	443	TCP
2025-03-11T17:45:32.444264+0100	2028371	3	Unknown Traffic	192.168.2.11	49720	23.197.127.21	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (codxefusion .top in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-11T17:45:20.249893+0100	2060531	1	Domain Observed Used for C2 Detected	192.168.2.11	49708	172.67.212.102	443	TCP
2025-03-11T17:45:23.424801+0100	2060531	1	Domain Observed Used for C2 Detected	192.168.2.11	49709	172.67.212.102	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (moderzysics .top in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-11T17:45:12.974708+0100	2060553	1	Domain Observed Used for C2 Detected	192.168.2.11	49705	172.67.189.66	443	TCP
2025-03-11T17:45:16.200011+0100	2060553	1	Domain Observed Used for C2 Detected	192.168.2.11	49706	172.67.189.66	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (techspherxe .top in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-11T17:45:27.325064+0100	2060570	1	Domain Observed Used for C2 Detected	192.168.2.11	49713	172.67.214.226	443	TCP
2025-03-11T17:45:30.519445+0100	2060570	1	Domain Observed Used for C2 Detected	192.168.2.11	49716	172.67.214.226	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (codxefusion .top)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-11T17:45:16.217185+0100	2060530	1	Domain Observed Used for C2 Detected	192.168.2.11	51181	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (earthsymphzony .today)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-11T17:45:30.525377+0100	2060412	1	Domain Observed Used for C2 Detected	192.168.2.11	55320	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (explorebieology .run)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-11T17:45:09.100686+0100	2060536	1	Domain Observed Used for C2 Detected	192.168.2.11	60211	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (gadgethgfub .icu)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-11T17:45:09.111047+0100	2060538	1	Domain Observed Used for C2 Detected	192.168.2.11	52188	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (moderzysics .top)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-11T17:45:09.123970+0100	2060551	1	Domain Observed Used for C2 Detected	192.168.2.11	64439	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (phygcsforum .life)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-11T17:45:23.579968+0100	2060554	1	Domain Observed Used for C2 Detected	192.168.2.11	49398	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (techmindzs .live)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-11T17:45:16.204521+0100	2060565	1	Domain Observed Used for C2 Detected	192.168.2.11	51654	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (techspherxe .top)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-11T17:45:23.620425+0100	2060568	1	Domain Observed Used for C2 Detected	192.168.2.11	61075	1.1.1.1	53	UDP

Joe Sandbox Signatures

• AV Detection
• Compliance
• Spreading
• Software Vulnerabilities
• Networking
• System Summary
• Data Obfuscation
• Malware Analysis System Evasion
• Anti Debugging
• Language, Device and Operating System Detection
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: nogtpjadthaw.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://phygcsforum.life:443/api	Avira URL Cloud: Label: malware
Source: https://moderzysics.top:443/api	Avira URL Cloud: Label: malware
Source: https://earthsymphzony.today:443/api	Avira URL Cloud: Label: malware
Source: https://techmindzs.live:443/api	Avira URL Cloud: Label: malware
Source: techvkortex.bet	Avira URL Cloud: Label: malware
Source: https://techspherxe.top:443/apiv0?a	Avira URL Cloud: Label: malware
Source: https://codxefusion.top:443/api	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["techvkortex.bet", "explorebieology.run", "gadgethgfub.icu", "moderzysics.top", "techmindzs.live", "codxefusion.top", "phygcsforum.life", "techspherxe.top"], "Build id": "yau6Na--7400515879"}

Multi AV Scanner detection for submitted file

Source: nogtpjadthaw.exe	Virustotal: Detection: 75%			Perma Link
Source: nogtpjadthaw.exe	ReversingLabs: Detection: 89%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp	String decryptor: techvkortex.bet
Source: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp	String decryptor: explorebieology.run
Source: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp	String decryptor: gadgethgfub.icu
Source: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp	String decryptor: moderzysics.top
Source: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp	String decryptor: techmindzs.live
Source: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp	String decryptor: codxefusion.top
Source: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp	String decryptor: phygcsforum.life
Source: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp	String decryptor: techspherxe.top

Source: nogtpjadthaw.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.11:49720 version: TLS 1.2

Source: C:\Users\user\Desktop\nogtpjadthaw.exe

Code function: 0_2_00822490 FindFirstFileW,

0_2_00822490

Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 4x nop then cmp dword ptr [edx+ebx*8], 744E5843h	0_2_007DA050
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	0_2_0079A2B0
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	0_2_0079A2B0
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	0_2_00792800
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 4x nop then movsx ecx, byte ptr [esi+eax]	0_2_007AB3A0
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 4x nop then mov eax, ebx	0_2_007B5800
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+2D625574h]	0_2_007B3B00
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+50h]	0_2_007D5ED0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2060565 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (techmindzs .live) : 192.168.2.11:51654 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2060538 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (gadgethgfub .icu) : 192.168.2.11:52188 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2060553 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (moderzysics .top in TLS SNI) : 192.168.2.11:49705 -> 172.67.189.66:443
Source: Network traffic	Suricata IDS: 2060554 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (phygcsforum .life) : 192.168.2.11:49398 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2060551 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (moderzysics .top) : 192.168.2.11:64439 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2060568 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (techspherxe .top) : 192.168.2.11:61075 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2060553 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (moderzysics .top in TLS SNI) : 192.168.2.11:49706 -> 172.67.189.66:443
Source: Network traffic	Suricata IDS: 2060536 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (explorebieology .run) : 192.168.2.11:60211 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2060531 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (codxefusion .top in TLS SNI) : 192.168.2.11:49709 -> 172.67.212.102:443
Source: Network traffic	Suricata IDS: 2060530 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (codxefusion .top) : 192.168.2.11:51181 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2060531 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (codxefusion .top in TLS SNI) : 192.168.2.11:49708 -> 172.67.212.102:443
Source: Network traffic	Suricata IDS: 2060412 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (earthsymphzony .today) : 192.168.2.11:55320 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2060570 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (techspherxe .top in TLS SNI) : 192.168.2.11:49713 -> 172.67.214.226:443
Source: Network traffic	Suricata IDS: 2060570 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (techspherxe .top in TLS SNI) : 192.168.2.11:49716 -> 172.67.214.226:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: techvkortex.bet
Source: Malware configuration extractor	URLs: explorebieology.run
Source: Malware configuration extractor	URLs: gadgethgfub.icu
Source: Malware configuration extractor	URLs: moderzysics.top
Source: Malware configuration extractor	URLs: techmindzs.live
Source: Malware configuration extractor	URLs: codxefusion.top
Source: Malware configuration extractor	URLs: phygcsforum.life
Source: Malware configuration extractor	URLs: techspherxe.top

Source: global traffic

TCP traffic: 192.168.2.11:53668 -> 162.159.36.2:53

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49705 -> 172.67.189.66:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49713 -> 172.67.214.226:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49720 -> 23.197.127.21:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49708 -> 172.67.212.102:443

Source: global traffic

HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

Source: nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/;X-Frame-OptionsSAMEORIGINPersistent-AuthWWW-AuthenticateVarysteamCountry=US%7C852cc335c9bfa05f5431530e9c06e47f; path=/; secure; HttpOnly; SameSite=Nonesessionid=cdc58bc6584e3f08d97eef49; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type35725Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveTue, 11 Mar 2025 16:45:33 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: techvkortex.bet
Source: global traffic	DNS traffic detected: DNS query: explorebieology.run
Source: global traffic	DNS traffic detected: DNS query: gadgethgfub.icu
Source: global traffic	DNS traffic detected: DNS query: moderzysics.top
Source: global traffic	DNS traffic detected: DNS query: techmindzs.live
Source: global traffic	DNS traffic detected: DNS query: codxefusion.top
Source: global traffic	DNS traffic detected: DNS query: phygcsforum.life
Source: global traffic	DNS traffic detected: DNS query: techspherxe.top
Source: global traffic	DNS traffic detected: DNS query: earthsymphzony.today
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com

Source: nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306231967.000000000124E000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306231967.000000000124E000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306231967.000000000124E000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: nogtpjadthaw.exe, 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, nogtpjadthaw.exe, 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.enigmaprotector.com/
Source: nogtpjadthaw.exe, 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.enigmaprotector.com/openU
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011AC000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://codxefusion.top:443/api
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fa
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.stea
Source: nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Gzg8NS4HKwGo&a
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=GlKQ1cghJWE2&l=english&_c
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=1VeaVEsE
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=Bdoh
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=cMt-H-zOgNUp&l=english&am
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=LrC2xWhJTNZp&l=e
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=Eq36AUaEgab8&l=en
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=PCCoCNLxwF4M&am
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011AC000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://earthsymphzony.today:443/api
Source: nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011AC000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://explorebieology.run:443/api
Source: nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011AC000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://moderzysics.top:443/api
Source: nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011AC000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://phygcsforum.life:443/api
Source: nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306231967.000000000124E000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199822375128
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011A4000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199822375128
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199822375128/badges
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199822375128/inventory/
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011AC000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199822375128W0
Source: nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamloopback.host
Source: nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1305015715.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;X-Frame-OptionsSAMEORIGINPersistent-AuthWWW-AuthenticateVarysteamCou
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306231967.000000000124E000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011AC000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://techmindzs.live:443/api
Source: nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011AC000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://techspherxe.top:443/apiv0?a
Source: nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

Source: unknown

HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.11:49720 version: TLS 1.2

System Summary

PE file has nameless sections

Source: nogtpjadthaw.exe	Static PE information: section name:
Source: nogtpjadthaw.exe	Static PE information: section name:
Source: nogtpjadthaw.exe	Static PE information: section name:
Source: nogtpjadthaw.exe	Static PE information: section name:
Source: nogtpjadthaw.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0084A6B8 NtReadFile,	0_2_0084A6B8
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0084A634 NtClose,	0_2_0084A634
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0084A650 NtSetInformationFile,	0_2_0084A650
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0084A7F0 NtProtectVirtualMemory,	0_2_0084A7F0
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0084A710 NtCreateFile,	0_2_0084A710
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0084A0B0 NtSetValueKey,	0_2_0084A0B0
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0084A028 NtCreateKey,	0_2_0084A028
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0084A070 NtEnumerateKey,	0_2_0084A070
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0084A180 NtNotifyChangeKey,	0_2_0084A180
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0084A1E0 NtQueryMultipleValueKey,	0_2_0084A1E0
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0084A2C4 NtTerminateProcess,	0_2_0084A2C4
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0084A2E0 NtWriteFile,	0_2_0084A2E0
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0084A27C NtSetInformationKey,	0_2_0084A27C
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0084A3F4 NtDuplicateObject,	0_2_0084A3F4
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0084A338 NtQueryObject,	0_2_0084A338
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0084A36C NtQueryDirectoryFile,	0_2_0084A36C
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0084A48C NtLockFile,	0_2_0084A48C
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0084A4EC NtUnlockFile,	0_2_0084A4EC
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0084A43C NtQueryVolumeInformationFile,	0_2_0084A43C
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0084A58C NtMapViewOfSection,	0_2_0084A58C
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0084A5EC NtCreateSection,	0_2_0084A5EC
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0084A53C NtUnmapViewOfSection,	0_2_0084A53C
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0084A558 NtQuerySection,	0_2_0084A558
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0084A684 NtQueryInformationFile,	0_2_0084A684
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0084A778 NtOpenFile,	0_2_0084A778
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_00849BB0 NtQueryInformationProcess,	0_2_00849BB0
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_00849BE4 NtCreateThread,	0_2_00849BE4
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_00849B50 NtDeviceIoControlFile,	0_2_00849B50
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_00849CA0 NtCreateProcessEx,	0_2_00849CA0
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_00849CF8 NtCreateUserProcess,	0_2_00849CF8
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_00849C50 NtCreateProcess,	0_2_00849C50
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_00849D8C NtSetVolumeInformationFile,	0_2_00849D8C
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_00849DE0 NtQuerySecurityObject,	0_2_00849DE0
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_00849D60 NtOpenKeyEx,	0_2_00849D60
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_00849E14 NtNotifyChangeDirectoryFile,	0_2_00849E14
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_00849E6C NtFsControlFile,	0_2_00849E6C
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_00849FB4 NtQueryKey,	0_2_00849FB4
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_00849FE8 NtQueryValueKey,	0_2_00849FE8
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_00849F04 NtAccessCheck,	0_2_00849F04
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_00849F54 NtOpenKey,	0_2_00849F54
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_00849F74 NtEnumerateValueKey,	0_2_00849F74

Source: C:\Users\user\Desktop\nogtpjadthaw.exe

Code function: 0_2_008A8CA4: CreateFileA,DeviceIoControl,

0_2_008A8CA4

Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0079ED50	0_2_0079ED50
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_007DA050	0_2_007DA050
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_007A8120	0_2_007A8120
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_007B6230	0_2_007B6230
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0079A2B0	0_2_0079A2B0
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_008A8264	0_2_008A8264
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_007B6520	0_2_007B6520
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_008A8600	0_2_008A8600
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_007CA6E0	0_2_007CA6E0
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0087682C	0_2_0087682C
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_008C8A04	0_2_008C8A04
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_00798AF0	0_2_00798AF0
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_008A8A40	0_2_008A8A40
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0085ABB0	0_2_0085ABB0
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_00792B30	0_2_00792B30
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_00864C0C	0_2_00864C0C
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_007D6F50	0_2_007D6F50
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_00832FF0	0_2_00832FF0
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_00796FE6	0_2_00796FE6
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_007D5270	0_2_007D5270
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_008C3498	0_2_008C3498
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_007994E0	0_2_007994E0
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_00793560	0_2_00793560
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_007D76D0	0_2_007D76D0
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_007C7720	0_2_007C7720
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_007DD840	0_2_007DD840
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_007B5800	0_2_007B5800
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_007DD8C0	0_2_007DD8C0
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0083D97C	0_2_0083D97C
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_008A5AC8	0_2_008A5AC8
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_008C7AC8	0_2_008C7AC8
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_008CBA18	0_2_008CBA18
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_007B5B70	0_2_007B5B70
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_007B7C30	0_2_007B7C30
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_00885C28	0_2_00885C28
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_008A5D94	0_2_008A5D94
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_007A3D00	0_2_007A3D00
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_007CDDF0	0_2_007CDDF0
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_008CFEB0	0_2_008CFEB0
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_00797E10	0_2_00797E10
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_007D5ED0	0_2_007D5ED0
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_007CFFF0	0_2_007CFFF0
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_008A5F24	0_2_008A5F24
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_008CBF48	0_2_008CBF48
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_02F14FD7	0_2_02F14FD7
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_02F138E8	0_2_02F138E8

Source: C:\Users\user\Desktop\nogtpjadthaw.exe

Code function: String function: 007FBD9C appears 119 times

Source: nogtpjadthaw.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: nogtpjadthaw.exe	Static PE information: Section: ZLIB complexity 0.9987076627994012
Source: nogtpjadthaw.exe	Static PE information: Section: ZLIB complexity 0.9912109375
Source: nogtpjadthaw.exe	Static PE information: Section: ZLIB complexity 0.9894301470588235
Source: nogtpjadthaw.exe	Static PE information: Section: .data ZLIB complexity 0.9964277811819172

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@10/4

Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Users\user\Desktop\nogtpjadthaw.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: nogtpjadthaw.exe	Virustotal: Detection: 75%
Source: nogtpjadthaw.exe	ReversingLabs: Detection: 89%

Source: C:\Users\user\Desktop\nogtpjadthaw.exe

File read: C:\Users\user\Desktop\nogtpjadthaw.exe

Jump to behavior

Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: nogtpjadthaw.exe

Static file information: File size 1315840 > 1048576

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\nogtpjadthaw.exe

Unpacked PE file: 0.2.nogtpjadthaw.exe.790000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:EW;.data:EW;

Source: nogtpjadthaw.exe	Static PE information: section name:
Source: nogtpjadthaw.exe	Static PE information: section name:
Source: nogtpjadthaw.exe	Static PE information: section name:
Source: nogtpjadthaw.exe	Static PE information: section name:
Source: nogtpjadthaw.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_008979C4 push 00897A51h; ret	0_2_00897A49
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0083A0BC push 0083A0E8h; ret	0_2_0083A0E0
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_008A20FC push 008A2134h; ret	0_2_008A212C
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0083A0F4 push 0083A120h; ret	0_2_0083A118
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_00806054 push 00806080h; ret	0_2_00806078
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_00872194 push 008721C0h; ret	0_2_008721B8
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0083E194 push 0083E1CCh; ret	0_2_0083E1C4
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0081C1DC push 0081C26Ch; ret	0_2_0081C264
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0081C12C push 0081C1D7h; ret	0_2_0081C1CF
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_00880160 push 0088018Ch; ret	0_2_00880184
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0085E290 push 0085E2C3h; ret	0_2_0085E2BB
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0085E2F0 push 0085E31Ch; ret	0_2_0085E314
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0085E394 push 0085E3DFh; ret	0_2_0085E3D7
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_008A6394 push 008A63C0h; ret	0_2_008A63B8
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0080E3A0 push 0080E400h; ret	0_2_0080E3F8
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0085E33C push 0085E388h; ret	0_2_0085E380
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_008A047C push 008A04C8h; ret	0_2_008A04C0
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_008205C4 push 008205F0h; ret	0_2_008205E8
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0087E55C push 0087E5B6h; ret	0_2_0087E5AE
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0080E578 push 0080E5A4h; ret	0_2_0080E59C
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0085C578 push ecx; mov dword ptr [esp], ecx	0_2_0085C57D
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0080E684 push ecx; mov dword ptr [esp], ecx	0_2_0080E687
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0080C6A4 push 0080C74Ch; ret	0_2_0080C744
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_008866DC push 00886747h; ret	0_2_0088673F
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0080C62C push 0080C6A2h; ret	0_2_0080C69A
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0080E664 push ecx; mov dword ptr [esp], ecx	0_2_0080E667
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0081C784 push 0081C7B0h; ret	0_2_0081C7A8
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_0081C7D4 push 0081C817h; ret	0_2_0081C80F
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_008A6730 push 008A675Ch; ret	0_2_008A6754
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_008A6768 push 008A6794h; ret	0_2_008A678C
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_008BA76C push 008BA7AFh; ret	0_2_008BA7A7

Source: nogtpjadthaw.exe	Static PE information: section name: entropy: 7.998324079794281
Source: nogtpjadthaw.exe	Static PE information: section name: entropy: 7.916236118328118
Source: nogtpjadthaw.exe	Static PE information: section name: entropy: 7.957363561867478
Source: nogtpjadthaw.exe	Static PE information: section name: entropy: 7.957657869647251
Source: nogtpjadthaw.exe	Static PE information: section name: .data entropy: 7.976016703101532

Source: C:\Users\user\Desktop\nogtpjadthaw.exe TID: 7260	Thread sleep count: 259 > 30	Jump to behavior
Source: C:\Users\user\Desktop\nogtpjadthaw.exe TID: 7260	Thread sleep count: 53 > 30	Jump to behavior
Source: C:\Users\user\Desktop\nogtpjadthaw.exe TID: 7280	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nogtpjadthaw.exe TID: 7296	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\nogtpjadthaw.exe

Code function: 0_2_00822490 FindFirstFileW,

0_2_00822490

Source: nogtpjadthaw.exe, 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VBoxService.exe
Source: nogtpjadthaw.exe, 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: ~VirtualMachineTypes
Source: nogtpjadthaw.exe, 00000000.00000002.1305890319.000000000116E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX(
Source: nogtpjadthaw.exe, 00000000.00000003.1305048575.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306106393.00000000011DF000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011DD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: nogtpjadthaw.exe, 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: ]DLL_Loader_VirtualMachine
Source: nogtpjadthaw.exe, 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VMWare
Source: nogtpjadthaw.exe, 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: DLL_Loader_Marker]DLL_Loader_VirtualMachineZDLL_Loader_Reloc_Unit
Source: nogtpjadthaw.exe, 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: &VBoxService.exe

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Thread information set: HideFromDebugger			Jump to behavior

Source: C:\Users\user\Desktop\nogtpjadthaw.exe

Code function: 0_2_007DB8C0 LdrInitializeThunk,

0_2_007DB8C0

Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_02F17F4A mov eax, dword ptr fs:[00000030h]		0_2_02F17F4A
Source: C:\Users\user\Desktop\nogtpjadthaw.exe	Code function: 0_2_02F17C78 mov eax, dword ptr fs:[00000030h]		0_2_02F17C78

Source: C:\Users\user\Desktop\nogtpjadthaw.exe

Code function: 0_2_008A7268 cpuid

0_2_008A7268

Source: C:\Users\user\Desktop\nogtpjadthaw.exe

Code function: 0_2_00848CC0 GetTimeZoneInformation,

0_2_00848CC0

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: 0.2.nogtpjadthaw.exe.790000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: 0.2.nogtpjadthaw.exe.790000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Deobfuscate/Decode Files or Information	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	4 Obfuscated Files or Information	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	11 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
nogtpjadthaw.exe	75%	Virustotal		Browse
nogtpjadthaw.exe	89%	ReversingLabs	Win32.Trojan.LummaStealer
nogtpjadthaw.exe	100%	Avira	HEUR/AGEN.1314134

Source	Detection	Scanner	Label
https://community.fa	0%	Avira URL Cloud	safe
https://phygcsforum.life:443/api	100%	Avira URL Cloud	malware
https://moderzysics.top:443/api	100%	Avira URL Cloud	malware
https://earthsymphzony.today:443/api	100%	Avira URL Cloud	malware
https://techmindzs.live:443/api	100%	Avira URL Cloud	malware
techvkortex.bet	100%	Avira URL Cloud	malware
https://techspherxe.top:443/apiv0?a	100%	Avira URL Cloud	malware
https://community.fastly.stea	0%	Avira URL Cloud	safe
https://codxefusion.top:443/api	100%	Avira URL Cloud	malware

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
moderzysics.top	172.67.189.66	true	false	high
techspherxe.top	172.67.214.226	true	false	high
codxefusion.top	172.67.212.102	true	false	high
steamcommunity.com	23.197.127.21	true	false	high
explorebieology.run	unknown	unknown	false	high
techvkortex.bet	unknown	unknown	true	unknown
earthsymphzony.today	unknown	unknown	false	high
phygcsforum.life	unknown	unknown	true	unknown
techmindzs.live	unknown	unknown	true	unknown
gadgethgfub.icu	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
phygcsforum.life	false		high
techspherxe.top	false		high
https://steamcommunity.com/profiles/76561199822375128	false		high
gadgethgfub.icu	false		high
moderzysics.top	false		high
techvkortex.bet	true	Avira URL Cloud: malware	unknown
techmindzs.live	false		high
codxefusion.top	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://player.vimeo.com	nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp	nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/?subsection=broadcasts	nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/subscriber_agreement/	nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.gstatic.cn/recaptcha/	nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199822375128/badges	nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011A4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199822375128/inventory/	nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011A4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.valvesoftware.com/legal.htm	nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com	nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/login/home/?goto=profiles%2F76561199822375128	nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com	nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011A4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/	nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/global.js?v=cMt-H-zOgNUp&l=english&am	nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=PCCoCNLxwF4M&am	nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl	nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com:443/profiles/76561199822375128W0	nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011AC000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis	nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s.ytimg.com;	nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011A4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&	nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/	nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steam.tv/	nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en	nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/privacy_agreement/	nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306231967.000000000124E000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011A4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/points/shop/	nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a	nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sketchfab.com	nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lv.queniujq.cn	nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com/	nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/privacy_agreement/	nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng	nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://phygcsforum.life:443/api	nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011AC000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011AC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fa	nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/recaptcha/	nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://checkout.steampowered.com/	nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.enigmaprotector.com/	nogtpjadthaw.exe, 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, nogtpjadthaw.exe, 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmp	false		high
https://moderzysics.top:443/api	nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011AC000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011AC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://store.steampowered.com/;	nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1305015715.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/about/	nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/my/wishlist/	nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&	nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamloopback.host	nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.steampowered.com/en/	nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/market/	nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/news/	nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.enigmaprotector.com/openU	nogtpjadthaw.exe, 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=1VeaVEsE	nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011A4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://earthsymphzony.today:443/api	nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011AC000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011AC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://store.steampowered.com/subscriber_agreement/	nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306231967.000000000124E000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011A4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306231967.000000000124E000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011A4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://recaptcha.net/recaptcha/;	nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=Eq36AUaEgab8&l=en	nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=Bdoh	nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011A4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/discussions/	nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/stats/	nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/globalv2.css?v=GlKQ1cghJWE2&l=english&_c	nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://medal.tv	nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://broadcast.st.dl.eccdnx.com	nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a	nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/steam_refunds/	nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://techmindzs.live:443/api	nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011AC000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011AC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Gzg8NS4HKwGo&a	nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011A4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=LrC2xWhJTNZp&l=e	nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e	nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/workshop/	nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.steampowered.com/	nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/legal/	nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306231967.000000000124E000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011A4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en	nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng	nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.stea	nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a	nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl	nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://recaptcha.net	nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/	nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://techspherxe.top:443/apiv0?a	nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011AC000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011AC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png	nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://127.0.0.1:27060	nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011A4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011A4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://codxefusion.top:443/api	nogtpjadthaw.exe, 00000000.00000002.1305990331.00000000011AC000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011AC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ	nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp	nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.steampowered.com/	nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.steampowered.com/	nogtpjadthaw.exe, 00000000.00000002.1306188919.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/account/cookiepreferences/	nogtpjadthaw.exe, 00000000.00000003.1304809247.0000000001236000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000002.1306231967.000000000124E000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp, nogtpjadthaw.exe, 00000000.00000003.1304848712.00000000011A4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/mobile	nogtpjadthaw.exe, 00000000.00000003.1304809247.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.189.66	moderzysics.top	United States	13335	CLOUDFLARENETUS	false
172.67.214.226	techspherxe.top	United States	13335	CLOUDFLARENETUS	false
23.197.127.21	steamcommunity.com	United States	20940	AKAMAI-ASN1EU	false
172.67.212.102	codxefusion.top	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1635475
Start date and time:	2025-03-11 17:44:17 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	nogtpjadthaw.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@10/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 55% Number of executed functions: 14 Number of non-executed functions: 93
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.149.20.212, 23.199.214.10
Excluded domains from analysis (whitelisted): fs.microsoft.com, 6.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.0.3.0.1.3.0.6.2.ip6.arpa, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
12:45:07	API Interceptor	6x Sleep call for process: nogtpjadthaw.exe modified

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.986910818807632
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	nogtpjadthaw.exe
File size:	1'315'840 bytes
MD5:	2e070594f72d17abe15d822aca9f7d40
SHA1:	4d9ed6638bcf8749e2de2a42f379c81781e63e77
SHA256:	f4aa315f8ff0c107dce56c88112e061f4e6260682eaf0ffc42a5bcf0d5fd6b8d
SHA512:	1f5251136f144d95da7578ae02f896c11dd7d59b2abb485ffe896a899044d2140e9609326ccfeafabf3f0c2d14adf562c72af03923bbe59a631865fdd9f5dc2e
SSDEEP:	24576:1jASJswj6381I/N9/hhgfzDoTxrp6TFwu2kBL3ryop:1cSw81I/oHgxrp6BwuH+o
TLSH:	4B5533E41BE9A23DC95F35B1C9A23FAD272F90D3C764F0EE8A8316C44A72476745E058
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...#..g.............................Q............@...........................<...........@................................. 0.....

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x42519d
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67C0CB23 [Thu Feb 27 20:29:23 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	71cc5af9daad65e58c6f29c42cdf9201

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 00401000h
call 00007F6134C38356h
call far 5DE5h : 8B10C483h
jmp 00007F6134FDA33Ch
loop 00007F6134C382DCh
cmpsd
out ABh, al
mov dh, 93h
adc al, 10h
inc edx
xor byte ptr [edi+2Eh], bh
jns 00007F6134C38364h
mov dh, 19h
mov byte ptr [6B6E7140h], al
inc esp
pop edi
call far F2BAh : 45693904h
lds edi, fword ptr [F159CF67h]
jne 00007F6134C383A7h
out dx, al
adc ch, byte ptr [ebp-76D2897Fh]
add al, 68h
xchg byte ptr [D579E1FCh], ah
je 00007F6134C3832Eh
pop es
xor esp, dword ptr [ecx+062726A7h]
dec esi
and bl, byte ptr [ebp+54FA7181h]
inc eax
adc eax, 041C9FF9h
fdiv qword ptr [edi]
mov word ptr [edi-61h], fs
js 00007F6134C38392h
cmc
fxch4 st(7)
sub eax, 7D911F91h
imul eax, esp, 5F948185h
rcl byte ptr [esi-31h], cl
int 7Bh
and dh, bh
dec edx
push ds
lahf
xor eax, 36766607h
cmp byte ptr [edx+3F66C23Bh], dh
outsd
pop esp
cmp al, 28h
mov ch, 83h
push ds
dec edx
push 6C8CCA48h
shr dword ptr [esi-4Dh], cl
mov dword ptr [CFB6A10Dh], eax
mov byte ptr [22122812h], al
mov dh, 9Ch
out dx, eax
and ebx, dword ptr [esi+74D3FE07h]
les esp, fword ptr [eax+02903E27h]
cmc
pop es
mov bl, 91h
cmp edi, dword ptr [eax]
dec esp
mov al, byte ptr [E43A4DBCh]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e3020	0x214	.data
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2e3000	0xc	.data
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x50000	0x29c00	5630f07b6fe0e3cb5dd6aff0050c7e75	False	0.9987076627994012	data	7.998324079794281	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x51000	0x3000	0x1000	fce23146a4ae9fd9db3db73272c6e86f	False	0.9912109375	data	7.916236118328118	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x54000	0xd000	0x3000	396d698fe97147a0bcc1d3a498294e5b	False	0.9873860677083334	data	7.957363561867478	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x61000	0x4000	0x2200	3e474e0a4078346c5d070fdfdc99c68d	False	0.9894301470588235	data	7.957657869647251	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x65000	0x27e000	0x2ba00	914bd2e21914d0ffb45580a1d8934650	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.data	0x2e3000	0xe6000	0xe5800	a3de2bdc5ab98ae2c58a7f99033fa779	False	0.9964277811819172	MacBinary, char. code 0x2e, Mon Feb 6 07:28:16 2040 INVALID date, modified Mon Feb 6 07:28:16 2040, creator ' 0.', type ' 1.', 3682606 bytes "." , at 0x3831ae 15740974 bytes resource dBase III DBT, version number 0, next free block index 3027316, 1st item "\343x\275y1\265\306\372\231\001U\004\207\260,g\271\313B\271\0336\315\/\2206\206?\014O^\211\257\031\242\244YR1J]"	7.976016703101532	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	GetModuleHandleA, GetProcAddress, ExitProcess, LoadLibraryA
user32.dll	MessageBoxA
advapi32.dll	RegCloseKey
oleaut32.dll	SysFreeString
gdi32.dll	CreateFontA
shell32.dll	ShellExecuteA
version.dll	GetFileVersionInfoA
ole32.dll	CoCreateInstance

Network Behavior

Download Network PCAP: filtered – full

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-11T17:45:09.100686+0100	2060536	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (explorebieology .run)	1	192.168.2.11	60211	1.1.1.1	53	UDP
2025-03-11T17:45:09.111047+0100	2060538	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (gadgethgfub .icu)	1	192.168.2.11	52188	1.1.1.1	53	UDP
2025-03-11T17:45:09.123970+0100	2060551	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (moderzysics .top)	1	192.168.2.11	64439	1.1.1.1	53	UDP
2025-03-11T17:45:12.974708+0100	2060553	ET MALWARE Observed Win32/Lumma Stealer Related Domain (moderzysics .top in TLS SNI)	1	192.168.2.11	49705	172.67.189.66	443	TCP
2025-03-11T17:45:12.974708+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49705	172.67.189.66	443	TCP
2025-03-11T17:45:16.200011+0100	2060553	ET MALWARE Observed Win32/Lumma Stealer Related Domain (moderzysics .top in TLS SNI)	1	192.168.2.11	49706	172.67.189.66	443	TCP
2025-03-11T17:45:16.204521+0100	2060565	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (techmindzs .live)	1	192.168.2.11	51654	1.1.1.1	53	UDP
2025-03-11T17:45:16.217185+0100	2060530	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (codxefusion .top)	1	192.168.2.11	51181	1.1.1.1	53	UDP
2025-03-11T17:45:20.249893+0100	2060531	ET MALWARE Observed Win32/Lumma Stealer Related Domain (codxefusion .top in TLS SNI)	1	192.168.2.11	49708	172.67.212.102	443	TCP
2025-03-11T17:45:20.249893+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49708	172.67.212.102	443	TCP
2025-03-11T17:45:23.424801+0100	2060531	ET MALWARE Observed Win32/Lumma Stealer Related Domain (codxefusion .top in TLS SNI)	1	192.168.2.11	49709	172.67.212.102	443	TCP
2025-03-11T17:45:23.579968+0100	2060554	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (phygcsforum .life)	1	192.168.2.11	49398	1.1.1.1	53	UDP
2025-03-11T17:45:23.620425+0100	2060568	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (techspherxe .top)	1	192.168.2.11	61075	1.1.1.1	53	UDP
2025-03-11T17:45:27.325064+0100	2060570	ET MALWARE Observed Win32/Lumma Stealer Related Domain (techspherxe .top in TLS SNI)	1	192.168.2.11	49713	172.67.214.226	443	TCP
2025-03-11T17:45:27.325064+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49713	172.67.214.226	443	TCP
2025-03-11T17:45:30.519445+0100	2060570	ET MALWARE Observed Win32/Lumma Stealer Related Domain (techspherxe .top in TLS SNI)	1	192.168.2.11	49716	172.67.214.226	443	TCP
2025-03-11T17:45:30.525377+0100	2060412	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (earthsymphzony .today)	1	192.168.2.11	55320	1.1.1.1	53	UDP
2025-03-11T17:45:32.444264+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49720	23.197.127.21	443	TCP

Network Port Distribution

Total Packets: 75
• 443 (HTTPS)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 11, 2025 17:45:09.281368971 CET	49705	443	192.168.2.11	172.67.189.66
Mar 11, 2025 17:45:09.281407118 CET	443	49705	172.67.189.66	192.168.2.11
Mar 11, 2025 17:45:09.281478882 CET	49705	443	192.168.2.11	172.67.189.66
Mar 11, 2025 17:45:09.284681082 CET	49705	443	192.168.2.11	172.67.189.66
Mar 11, 2025 17:45:09.284703016 CET	443	49705	172.67.189.66	192.168.2.11
Mar 11, 2025 17:45:12.973304987 CET	443	49705	172.67.189.66	192.168.2.11
Mar 11, 2025 17:45:12.974708080 CET	49705	443	192.168.2.11	172.67.189.66
Mar 11, 2025 17:45:12.974801064 CET	443	49705	172.67.189.66	192.168.2.11
Mar 11, 2025 17:45:12.974855900 CET	49705	443	192.168.2.11	172.67.189.66
Mar 11, 2025 17:45:12.975375891 CET	49706	443	192.168.2.11	172.67.189.66
Mar 11, 2025 17:45:12.975402117 CET	443	49706	172.67.189.66	192.168.2.11
Mar 11, 2025 17:45:12.975470066 CET	49706	443	192.168.2.11	172.67.189.66
Mar 11, 2025 17:45:12.975898981 CET	49706	443	192.168.2.11	172.67.189.66
Mar 11, 2025 17:45:12.975908041 CET	443	49706	172.67.189.66	192.168.2.11
Mar 11, 2025 17:45:16.199599028 CET	443	49706	172.67.189.66	192.168.2.11
Mar 11, 2025 17:45:16.200011015 CET	49706	443	192.168.2.11	172.67.189.66
Mar 11, 2025 17:45:16.200226068 CET	443	49706	172.67.189.66	192.168.2.11
Mar 11, 2025 17:45:16.200279951 CET	49706	443	192.168.2.11	172.67.189.66
Mar 11, 2025 17:45:16.200331926 CET	49707	443	192.168.2.11	172.67.189.66
Mar 11, 2025 17:45:16.200373888 CET	443	49707	172.67.189.66	192.168.2.11
Mar 11, 2025 17:45:16.200433016 CET	49707	443	192.168.2.11	172.67.189.66
Mar 11, 2025 17:45:16.201052904 CET	49707	443	192.168.2.11	172.67.189.66
Mar 11, 2025 17:45:16.201105118 CET	443	49707	172.67.189.66	192.168.2.11
Mar 11, 2025 17:45:16.201158047 CET	49707	443	192.168.2.11	172.67.189.66
Mar 11, 2025 17:45:16.714281082 CET	49708	443	192.168.2.11	172.67.212.102
Mar 11, 2025 17:45:16.714318991 CET	443	49708	172.67.212.102	192.168.2.11
Mar 11, 2025 17:45:16.714405060 CET	49708	443	192.168.2.11	172.67.212.102
Mar 11, 2025 17:45:16.714808941 CET	49708	443	192.168.2.11	172.67.212.102
Mar 11, 2025 17:45:16.714826107 CET	443	49708	172.67.212.102	192.168.2.11
Mar 11, 2025 17:45:20.249363899 CET	443	49708	172.67.212.102	192.168.2.11
Mar 11, 2025 17:45:20.249892950 CET	49708	443	192.168.2.11	172.67.212.102
Mar 11, 2025 17:45:20.250049114 CET	443	49708	172.67.212.102	192.168.2.11
Mar 11, 2025 17:45:20.250122070 CET	49708	443	192.168.2.11	172.67.212.102
Mar 11, 2025 17:45:20.250406027 CET	49709	443	192.168.2.11	172.67.212.102
Mar 11, 2025 17:45:20.250452042 CET	443	49709	172.67.212.102	192.168.2.11
Mar 11, 2025 17:45:20.250525951 CET	49709	443	192.168.2.11	172.67.212.102
Mar 11, 2025 17:45:20.251104116 CET	49709	443	192.168.2.11	172.67.212.102
Mar 11, 2025 17:45:20.251120090 CET	443	49709	172.67.212.102	192.168.2.11
Mar 11, 2025 17:45:23.421183109 CET	443	49709	172.67.212.102	192.168.2.11
Mar 11, 2025 17:45:23.424748898 CET	443	49709	172.67.212.102	192.168.2.11
Mar 11, 2025 17:45:23.424801111 CET	49709	443	192.168.2.11	172.67.212.102
Mar 11, 2025 17:45:23.454194069 CET	49709	443	192.168.2.11	172.67.212.102
Mar 11, 2025 17:45:23.454212904 CET	443	49709	172.67.212.102	192.168.2.11
Mar 11, 2025 17:45:23.454535961 CET	49710	443	192.168.2.11	172.67.212.102
Mar 11, 2025 17:45:23.454565048 CET	443	49710	172.67.212.102	192.168.2.11
Mar 11, 2025 17:45:23.454638958 CET	49710	443	192.168.2.11	172.67.212.102
Mar 11, 2025 17:45:23.569674015 CET	49710	443	192.168.2.11	172.67.212.102
Mar 11, 2025 17:45:23.569729090 CET	443	49710	172.67.212.102	192.168.2.11
Mar 11, 2025 17:45:23.569773912 CET	49710	443	192.168.2.11	172.67.212.102
Mar 11, 2025 17:45:23.988569021 CET	49713	443	192.168.2.11	172.67.214.226
Mar 11, 2025 17:45:23.988616943 CET	443	49713	172.67.214.226	192.168.2.11
Mar 11, 2025 17:45:23.988723040 CET	49713	443	192.168.2.11	172.67.214.226
Mar 11, 2025 17:45:23.989022970 CET	49713	443	192.168.2.11	172.67.214.226
Mar 11, 2025 17:45:23.989041090 CET	443	49713	172.67.214.226	192.168.2.11
Mar 11, 2025 17:45:27.324580908 CET	443	49713	172.67.214.226	192.168.2.11
Mar 11, 2025 17:45:27.325063944 CET	49713	443	192.168.2.11	172.67.214.226
Mar 11, 2025 17:45:27.325293064 CET	443	49713	172.67.214.226	192.168.2.11
Mar 11, 2025 17:45:27.325351000 CET	49713	443	192.168.2.11	172.67.214.226
Mar 11, 2025 17:45:27.325529099 CET	49716	443	192.168.2.11	172.67.214.226
Mar 11, 2025 17:45:27.325565100 CET	443	49716	172.67.214.226	192.168.2.11
Mar 11, 2025 17:45:27.325640917 CET	49716	443	192.168.2.11	172.67.214.226
Mar 11, 2025 17:45:27.326008081 CET	49716	443	192.168.2.11	172.67.214.226
Mar 11, 2025 17:45:27.326023102 CET	443	49716	172.67.214.226	192.168.2.11
Mar 11, 2025 17:45:30.518995047 CET	443	49716	172.67.214.226	192.168.2.11
Mar 11, 2025 17:45:30.519444942 CET	49716	443	192.168.2.11	172.67.214.226
Mar 11, 2025 17:45:30.519541979 CET	443	49716	172.67.214.226	192.168.2.11
Mar 11, 2025 17:45:30.519592047 CET	49716	443	192.168.2.11	172.67.214.226
Mar 11, 2025 17:45:30.520390034 CET	49719	443	192.168.2.11	172.67.214.226
Mar 11, 2025 17:45:30.520427942 CET	443	49719	172.67.214.226	192.168.2.11
Mar 11, 2025 17:45:30.520494938 CET	49719	443	192.168.2.11	172.67.214.226
Mar 11, 2025 17:45:30.521153927 CET	49719	443	192.168.2.11	172.67.214.226
Mar 11, 2025 17:45:30.521182060 CET	443	49719	172.67.214.226	192.168.2.11
Mar 11, 2025 17:45:30.521235943 CET	49719	443	192.168.2.11	172.67.214.226
Mar 11, 2025 17:45:30.545737982 CET	49720	443	192.168.2.11	23.197.127.21
Mar 11, 2025 17:45:30.545769930 CET	443	49720	23.197.127.21	192.168.2.11
Mar 11, 2025 17:45:30.545829058 CET	49720	443	192.168.2.11	23.197.127.21
Mar 11, 2025 17:45:30.546338081 CET	49720	443	192.168.2.11	23.197.127.21
Mar 11, 2025 17:45:30.546350002 CET	443	49720	23.197.127.21	192.168.2.11
Mar 11, 2025 17:45:32.444184065 CET	443	49720	23.197.127.21	192.168.2.11
Mar 11, 2025 17:45:32.444263935 CET	49720	443	192.168.2.11	23.197.127.21
Mar 11, 2025 17:45:32.493063927 CET	49720	443	192.168.2.11	23.197.127.21
Mar 11, 2025 17:45:32.493084908 CET	443	49720	23.197.127.21	192.168.2.11
Mar 11, 2025 17:45:32.493341923 CET	443	49720	23.197.127.21	192.168.2.11
Mar 11, 2025 17:45:32.535600901 CET	49720	443	192.168.2.11	23.197.127.21
Mar 11, 2025 17:45:33.023052931 CET	49720	443	192.168.2.11	23.197.127.21
Mar 11, 2025 17:45:33.064330101 CET	443	49720	23.197.127.21	192.168.2.11
Mar 11, 2025 17:45:33.758425951 CET	443	49720	23.197.127.21	192.168.2.11
Mar 11, 2025 17:45:33.758450985 CET	443	49720	23.197.127.21	192.168.2.11
Mar 11, 2025 17:45:33.758477926 CET	49720	443	192.168.2.11	23.197.127.21
Mar 11, 2025 17:45:33.758502007 CET	443	49720	23.197.127.21	192.168.2.11
Mar 11, 2025 17:45:33.758514881 CET	443	49720	23.197.127.21	192.168.2.11
Mar 11, 2025 17:45:33.758526087 CET	49720	443	192.168.2.11	23.197.127.21
Mar 11, 2025 17:45:33.758531094 CET	443	49720	23.197.127.21	192.168.2.11
Mar 11, 2025 17:45:33.758543015 CET	49720	443	192.168.2.11	23.197.127.21
Mar 11, 2025 17:45:33.758563042 CET	49720	443	192.168.2.11	23.197.127.21
Mar 11, 2025 17:45:33.758580923 CET	49720	443	192.168.2.11	23.197.127.21
Mar 11, 2025 17:45:33.855521917 CET	443	49720	23.197.127.21	192.168.2.11
Mar 11, 2025 17:45:33.855556965 CET	443	49720	23.197.127.21	192.168.2.11
Mar 11, 2025 17:45:33.855597019 CET	49720	443	192.168.2.11	23.197.127.21
Mar 11, 2025 17:45:33.855602980 CET	443	49720	23.197.127.21	192.168.2.11
Mar 11, 2025 17:45:33.855644941 CET	49720	443	192.168.2.11	23.197.127.21
Mar 11, 2025 17:45:33.897552967 CET	443	49720	23.197.127.21	192.168.2.11
Mar 11, 2025 17:45:33.897594929 CET	443	49720	23.197.127.21	192.168.2.11
Mar 11, 2025 17:45:33.897655010 CET	443	49720	23.197.127.21	192.168.2.11
Mar 11, 2025 17:45:33.897685051 CET	49720	443	192.168.2.11	23.197.127.21
Mar 11, 2025 17:45:33.897711992 CET	49720	443	192.168.2.11	23.197.127.21
Mar 11, 2025 17:45:33.897711992 CET	49720	443	192.168.2.11	23.197.127.21
Mar 11, 2025 17:45:33.898586035 CET	49720	443	192.168.2.11	23.197.127.21
Mar 11, 2025 17:45:33.898586035 CET	49720	443	192.168.2.11	23.197.127.21
Mar 11, 2025 17:45:33.898603916 CET	443	49720	23.197.127.21	192.168.2.11
Mar 11, 2025 17:45:33.898611069 CET	443	49720	23.197.127.21	192.168.2.11
Mar 11, 2025 17:45:56.012109995 CET	53668	53	192.168.2.11	162.159.36.2
Mar 11, 2025 17:45:56.016891956 CET	53	53668	162.159.36.2	192.168.2.11
Mar 11, 2025 17:45:56.017014980 CET	53668	53	192.168.2.11	162.159.36.2
Mar 11, 2025 17:45:56.021795034 CET	53	53668	162.159.36.2	192.168.2.11
Mar 11, 2025 17:45:56.470649958 CET	53668	53	192.168.2.11	162.159.36.2
Mar 11, 2025 17:45:56.475578070 CET	53	53668	162.159.36.2	192.168.2.11
Mar 11, 2025 17:45:56.475636959 CET	53668	53	192.168.2.11	162.159.36.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 11, 2025 17:45:09.085969925 CET	51222	53	192.168.2.11	1.1.1.1
Mar 11, 2025 17:45:09.096380949 CET	53	51222	1.1.1.1	192.168.2.11
Mar 11, 2025 17:45:09.100686073 CET	60211	53	192.168.2.11	1.1.1.1
Mar 11, 2025 17:45:09.109569073 CET	53	60211	1.1.1.1	192.168.2.11
Mar 11, 2025 17:45:09.111047029 CET	52188	53	192.168.2.11	1.1.1.1
Mar 11, 2025 17:45:09.120295048 CET	53	52188	1.1.1.1	192.168.2.11
Mar 11, 2025 17:45:09.123970032 CET	64439	53	192.168.2.11	1.1.1.1
Mar 11, 2025 17:45:09.274276018 CET	53	64439	1.1.1.1	192.168.2.11
Mar 11, 2025 17:45:16.204520941 CET	51654	53	192.168.2.11	1.1.1.1
Mar 11, 2025 17:45:16.214541912 CET	53	51654	1.1.1.1	192.168.2.11
Mar 11, 2025 17:45:16.217185020 CET	51181	53	192.168.2.11	1.1.1.1
Mar 11, 2025 17:45:16.713233948 CET	53	51181	1.1.1.1	192.168.2.11
Mar 11, 2025 17:45:23.579967976 CET	49398	53	192.168.2.11	1.1.1.1
Mar 11, 2025 17:45:23.588974953 CET	53	49398	1.1.1.1	192.168.2.11
Mar 11, 2025 17:45:23.620424986 CET	61075	53	192.168.2.11	1.1.1.1
Mar 11, 2025 17:45:23.987797022 CET	53	61075	1.1.1.1	192.168.2.11
Mar 11, 2025 17:45:30.525377035 CET	55320	53	192.168.2.11	1.1.1.1
Mar 11, 2025 17:45:30.534751892 CET	53	55320	1.1.1.1	192.168.2.11
Mar 11, 2025 17:45:30.536889076 CET	52836	53	192.168.2.11	1.1.1.1
Mar 11, 2025 17:45:30.544462919 CET	53	52836	1.1.1.1	192.168.2.11
Mar 11, 2025 17:45:56.011456013 CET	53	57126	162.159.36.2	192.168.2.11
Mar 11, 2025 17:45:56.501111031 CET	53	50163	1.1.1.1	192.168.2.11

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 11, 2025 17:45:09.085969925 CET	192.168.2.11	1.1.1.1	0x3e70	Standard query (0)	techvkortex.bet	A (IP address)	IN (0x0001)	false
Mar 11, 2025 17:45:09.100686073 CET	192.168.2.11	1.1.1.1	0xa174	Standard query (0)	explorebieology.run	A (IP address)	IN (0x0001)	false
Mar 11, 2025 17:45:09.111047029 CET	192.168.2.11	1.1.1.1	0xf696	Standard query (0)	gadgethgfub.icu	A (IP address)	IN (0x0001)	false
Mar 11, 2025 17:45:09.123970032 CET	192.168.2.11	1.1.1.1	0xc1c3	Standard query (0)	moderzysics.top	A (IP address)	IN (0x0001)	false
Mar 11, 2025 17:45:16.204520941 CET	192.168.2.11	1.1.1.1	0xe310	Standard query (0)	techmindzs.live	A (IP address)	IN (0x0001)	false
Mar 11, 2025 17:45:16.217185020 CET	192.168.2.11	1.1.1.1	0xbf8a	Standard query (0)	codxefusion.top	A (IP address)	IN (0x0001)	false
Mar 11, 2025 17:45:23.579967976 CET	192.168.2.11	1.1.1.1	0xd3ba	Standard query (0)	phygcsforum.life	A (IP address)	IN (0x0001)	false
Mar 11, 2025 17:45:23.620424986 CET	192.168.2.11	1.1.1.1	0xed61	Standard query (0)	techspherxe.top	A (IP address)	IN (0x0001)	false
Mar 11, 2025 17:45:30.525377035 CET	192.168.2.11	1.1.1.1	0xbe06	Standard query (0)	earthsymphzony.today	A (IP address)	IN (0x0001)	false
Mar 11, 2025 17:45:30.536889076 CET	192.168.2.11	1.1.1.1	0x4db4	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 11, 2025 17:45:09.096380949 CET	1.1.1.1	192.168.2.11	0x3e70	Name error (3)	techvkortex.bet	none	none	A (IP address)	IN (0x0001)	false
Mar 11, 2025 17:45:09.109569073 CET	1.1.1.1	192.168.2.11	0xa174	Name error (3)	explorebieology.run	none	none	A (IP address)	IN (0x0001)	false
Mar 11, 2025 17:45:09.120295048 CET	1.1.1.1	192.168.2.11	0xf696	Name error (3)	gadgethgfub.icu	none	none	A (IP address)	IN (0x0001)	false
Mar 11, 2025 17:45:09.274276018 CET	1.1.1.1	192.168.2.11	0xc1c3	No error (0)	moderzysics.top		172.67.189.66	A (IP address)	IN (0x0001)	false
Mar 11, 2025 17:45:09.274276018 CET	1.1.1.1	192.168.2.11	0xc1c3	No error (0)	moderzysics.top		104.21.9.123	A (IP address)	IN (0x0001)	false
Mar 11, 2025 17:45:16.214541912 CET	1.1.1.1	192.168.2.11	0xe310	Name error (3)	techmindzs.live	none	none	A (IP address)	IN (0x0001)	false
Mar 11, 2025 17:45:16.713233948 CET	1.1.1.1	192.168.2.11	0xbf8a	No error (0)	codxefusion.top		172.67.212.102	A (IP address)	IN (0x0001)	false
Mar 11, 2025 17:45:16.713233948 CET	1.1.1.1	192.168.2.11	0xbf8a	No error (0)	codxefusion.top		104.21.69.194	A (IP address)	IN (0x0001)	false
Mar 11, 2025 17:45:23.588974953 CET	1.1.1.1	192.168.2.11	0xd3ba	Name error (3)	phygcsforum.life	none	none	A (IP address)	IN (0x0001)	false
Mar 11, 2025 17:45:23.987797022 CET	1.1.1.1	192.168.2.11	0xed61	No error (0)	techspherxe.top		172.67.214.226	A (IP address)	IN (0x0001)	false
Mar 11, 2025 17:45:23.987797022 CET	1.1.1.1	192.168.2.11	0xed61	No error (0)	techspherxe.top		104.21.16.172	A (IP address)	IN (0x0001)	false
Mar 11, 2025 17:45:30.534751892 CET	1.1.1.1	192.168.2.11	0xbe06	Name error (3)	earthsymphzony.today	none	none	A (IP address)	IN (0x0001)	false
Mar 11, 2025 17:45:30.544462919 CET	1.1.1.1	192.168.2.11	0x4db4	No error (0)	steamcommunity.com		23.197.127.21	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49720	23.197.127.21	443	7256	C:\Users\user\Desktop\nogtpjadthaw.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-11 16:45:33 UTC	219	OUT	GET /profiles/76561199822375128 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2025-03-11 16:45:33 UTC	1962	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Tue, 11 Mar 2025 16:45:33 GMT Content-Length: 35725 Connection: close Set-Cookie: sessionid=cdc58bc6584e3f08d97eef49; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C852cc335c9bfa05f5431530e9c06e47f; path=/; secure; HttpOnly; SameSite=None
2025-03-11 16:45:33 UTC	14422	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 20 44 65 73 6b 74 6f 70 55 49 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e Data Ascii: <!DOCTYPE html><html class=" responsive DesktopUI" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21">
2025-03-11 16:45:33 UTC	10154	IN	Data Raw: 79 70 65 3d 22 73 65 6c 65 63 74 6f 72 22 20 64 61 74 61 2d 74 6f 6f 6c 74 69 70 2d 63 6f 6e 74 65 6e 74 3d 22 2e 73 75 62 6d 65 6e 75 5f 43 6f 6d 6d 75 6e 69 74 79 22 3e 0a 09 09 09 09 43 4f 4d 4d 55 4e 49 54 59 09 09 09 3c 2f 61 3e 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 5f 43 6f 6d 6d 75 6e 69 74 79 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 22 20 64 61 74 61 2d 73 75 62 6d 65 6e 75 69 64 3d 22 43 6f 6d 6d 75 6e 69 74 79 22 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 22 3e 0a 09 09 09 09 09 09 48 6f 6d 65 09 09 09 09 09 09 09 09 Data Ascii: ype="selector" data-tooltip-content=".submenu_Community">COMMUNITY</a><div class="submenu_Community" style="display: none;" data-submenuid="Community"><a class="submenuitem" href="https://steamcommunity.com/">Home
2025-03-11 16:45:33 UTC	11149	IN	Data Raw: 75 6f 74 3b 45 52 45 41 4c 4d 26 71 75 6f 74 3b 3a 31 2c 26 71 75 6f 74 3b 4c 4f 47 49 4e 5f 42 41 53 45 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 6c 6f 67 69 6e 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 41 56 41 54 41 52 5f 42 41 53 45 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 61 76 61 74 61 72 73 2e 66 61 73 74 6c 79 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 46 52 4f 4d 5f 57 45 42 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 57 45 42 53 49 54 45 5f 49 44 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 43 6f 6d 6d 75 6e 69 74 79 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 42 41 Data Ascii: uot;EREALM":1,"LOGIN_BASE_URL":"https:\/\/login.steampowered.com\/","AVATAR_BASE_URL":"https:\/\/avatars.fastly.steamstatic.com\/","FROM_WEB":true,"WEBSITE_ID":"Community","BA

Statistics

CPU Usage

• nogtpjadthaw.exe

Click to jump to process

Memory Usage

• nogtpjadthaw.exe

Click to jump to process

High Level Behavior Distribution

• File
• Registry

Click to dive into process behavior distribution

Target ID:	0
Start time:	12:45:07
Start date:	11/03/2025
Path:	C:\Users\user\Desktop\nogtpjadthaw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\nogtpjadthaw.exe"
Imagebase:	0x790000
File size:	1'315'840 bytes
MD5 hash:	2E070594F72D17ABE15D822ACA9F7D40
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage

Dynamic/Packed Code Coverage

Signature Coverage

Execution Coverage:	1.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	33.3%
Total number of Nodes:	30
Total number of Limit Nodes:	1

Executed Functions

Function 0079ED50 Relevance: 14.2, Strings: 11, Instructions: 483
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

m!M#, xrefs: 0079EE21
8MnO, xrefs: 0079EE77
$A-C, xrefs: 0079EE59
:m:o, xrefs: 0079EEC7
#yZ{, xrefs: 0079EE95
0e=g, xrefs: 0079EEB3
Zu&w, xrefs: 0079EE8B
5]0_, xrefs: 0079EE52
pY-[, xrefs: 0079EE4B
D)F+, xrefs: 0079EE2F
!q"s, xrefs: 0079EE81

Memory Dump Source

Source File: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID: !q"s$#yZ{$$A-C$0e=g$5]0_$8MnO$:m:o$D)F+$Zu&w$m!M#$pY-[
API String ID: 0-2169353099
Opcode ID: 5fc71818db6265832e9f4f26af54fada664ace97644ca28ba5245e9bde030b15
Instruction ID: de9873114a43fb55e5046959f3bd0429532970c2180077a30a38f6d463f8597e
Opcode Fuzzy Hash: 5fc71818db6265832e9f4f26af54fada664ace97644ca28ba5245e9bde030b15
Instruction Fuzzy Hash: CF0289B1201B41CFD3248F69DC95797BBF6FB89314F158A2DD4AA8BB90DB78A405CB40

Function 0084A710 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateFile.NTDLL(?,?,?,?,?,?,?,?,?,?,?), ref: 0084A768

Strings

/?w, xrefs: 0084A768

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID: /?w
API String ID: 823142352-2398211592
Opcode ID: 4793a65bd7cf3e281705f042eb74e304fe6e69a117ee8ebb8595ea7e9ae098ca
Instruction ID: a4499483b73316d4abbc93c7531c5f5b3e5f8b1655660be9113bb19beb4e36e1
Opcode Fuzzy Hash: 4793a65bd7cf3e281705f042eb74e304fe6e69a117ee8ebb8595ea7e9ae098ca
Instruction Fuzzy Hash: DA0188B6204249BF9B14CE8ADCC5DEBBBACFB8D754B444004BB1997202C230AC51CBB0

Function 0084A634 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtClose.NTDLL(?), ref: 0084A647

Strings

`+?w, xrefs: 0084A647

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: Close
String ID: `+?w
API String ID: 3535843008-3099938749
Opcode ID: bd20c40532355a8ff1a9874febf1e3c553eb0bd3fb95e2fd401614a4e5b12531
Instruction ID: 48894fa358cdfe005c539f30c0b9c811a7a2abb60513814c852c03f0ee7d812f
Opcode Fuzzy Hash: bd20c40532355a8ff1a9874febf1e3c553eb0bd3fb95e2fd401614a4e5b12531
Instruction Fuzzy Hash: 2AB09290E5A3482EDF25D7AA5D0C7D5298DAB88346F08C0847001C2060CB248580F665

Function 0084A6B8 Relevance: 1.5, APIs: 1, Instructions: 44
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtReadFile.NTDLL(?,?,?,?,?,?,?,?,?), ref: 0084A700

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 685541bd0a9cc8bc5dc73ed226842128c493012b85d91432e19ee889d45f9919
Instruction ID: 63202fad8997c2bfdbf50d114b15cb2a759bdd2e9792a6b8d14d48228d4ca092
Opcode Fuzzy Hash: 685541bd0a9cc8bc5dc73ed226842128c493012b85d91432e19ee889d45f9919
Instruction Fuzzy Hash: 0DF0AFB660425DBF9B10CE9ADDC4DEB7B6CFB9D764B448005FA1997202C270AD50CBB1

Function 0084A650 Relevance: 1.5, APIs: 1, Instructions: 26
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSetInformationFile.NTDLL(?,?,?,?,?), ref: 0084A677

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: FileInformation
String ID:
API String ID: 4253254148-0
Opcode ID: b290eab9ba82601d1bc35a709d6f40c39aadf2b94c0d87534d93e206f61571bf
Instruction ID: ee85c1d1e7bc9ba799c19aa3a3c22769e46816367f84d2037ab5aee9b160b33f
Opcode Fuzzy Hash: b290eab9ba82601d1bc35a709d6f40c39aadf2b94c0d87534d93e206f61571bf
Instruction Fuzzy Hash: 2CE0C2A16241187EE724576BDC0CDE77F7CEBDA7B0B058019B408D7100C260AC00C2B0

Function 007DB8C0 Relevance: 1.5, APIs: 1, Instructions: 12
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(007DF7A3,011A3ED0,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 007DB8E6

Memory Dump Source

Source File: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1bd4fc5ecdf777846d4c2a75aad9f9b4c83d5fcb34c3ccd9b36bd66a00fc2bcd
Instruction ID: a8ccfea638103c11df03cfaac6ceaae75cd880d94a5b697ca386048228502289
Opcode Fuzzy Hash: 1bd4fc5ecdf777846d4c2a75aad9f9b4c83d5fcb34c3ccd9b36bd66a00fc2bcd
Instruction Fuzzy Hash: 71E02D71908216EF9E04CF45C64445EFBE5AB84718F11888DA48863220C3B0BE4AEB82

Function 008A8CA4 Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

\\.\, xrefs: 008A8D72

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID: \\.\
API String ID: 0-2900601889
Opcode ID: 48ba45aeff8bcbd7c1374a12482a26cb7f93b9c0e4e9092606bf1a44b7d89e36
Instruction ID: 8b80b7d9fecfa5ff6efc5d9eee02c2a260b0a4b217eb304bbc8cf5ce8c214f87
Opcode Fuzzy Hash: 48ba45aeff8bcbd7c1374a12482a26cb7f93b9c0e4e9092606bf1a44b7d89e36
Instruction Fuzzy Hash: C1512A70A0021CDBDB25EB24CC85BEEB7B9AF49700F1045A1E608E7791DB74AE95CF51

Function 00848CC0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dbabf60b5e3105b81204478276134a213c02ca571a08b05bf5f67d7f9755667
Instruction ID: 7385f66a5cd23ef333d8a0f6ad71defe46b58d0a0828d8152f929cc9e2b0821a
Opcode Fuzzy Hash: 5dbabf60b5e3105b81204478276134a213c02ca571a08b05bf5f67d7f9755667
Instruction Fuzzy Hash: 28113975D0160CFBCF41AB98C8849EDBBBAFF58720F1049C1B554A7291DB318A509B51

Function 00822490 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07a2b4f9a2af926504e180ffd17602e6afbcc797d04cbc82085d4e67e840ea34
Instruction ID: 499589eefa48270b4d0a9cc8e6b8141e7cb605e5c5fa3a19159486f0abdf9332
Opcode Fuzzy Hash: 07a2b4f9a2af926504e180ffd17602e6afbcc797d04cbc82085d4e67e840ea34
Instruction Fuzzy Hash: 4B01FC70604228ABC715EB38DD55AEA77ECFB4C310F4045B1B61DD7362D6345E408950

Function 0084A7F0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09b5d102a133842556b193053f5de286db46d1de97e982ea93665c7b990029db
Instruction ID: 6be3435a1c8ce3eda651fb14365958fd103a519f511669aa4717fe6fbd1b6456
Opcode Fuzzy Hash: 09b5d102a133842556b193053f5de286db46d1de97e982ea93665c7b990029db
Instruction Fuzzy Hash: EBD0C9B310020DAB8B11EEFCDD45DDB33DCEA18610B00892ABE15C7242EF34E9248BB1

Function 02F17931 Relevance: 1.6, APIs: 1, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExitUserProcess.NTDLL(?,77E8F3B0,000000FF), ref: 02F17940

Memory Dump Source

Source File: 00000000.00000002.1306676816.0000000002F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f10000_nogtpjadthaw.jbxd

Similarity

API ID: ExitProcessUser
String ID:
API String ID: 3902816426-0
Opcode ID: 1eca6f29a6a5f21940fdae875352023f3ffd182e9330f1bfd6c8504702f08d53
Instruction ID: 545e2dda52c739090c86af2847dbefc522692a35a2139bd19823a56550ac6983
Opcode Fuzzy Hash: 1eca6f29a6a5f21940fdae875352023f3ffd182e9330f1bfd6c8504702f08d53
Instruction Fuzzy Hash: 6931F6B6D1060CEFDB01CFD1C844BEEBBB8FB14336F20861AE525A6190D7785A098F60

Function 007DB860 Relevance: 1.5, APIs: 1, Instructions: 30
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,00000000,?,00000000,0079F3E6,00000000,00000001), ref: 007DB892

Memory Dump Source

Source File: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: da77c0fcb001e89f0beee6108c26391e48fc32230f33d40992d18d488698a120
Instruction ID: ba46d9bc003a1ef9874a1c9ab688d6dd5c8786c04d9f2759bc6a681c285aa187
Opcode Fuzzy Hash: da77c0fcb001e89f0beee6108c26391e48fc32230f33d40992d18d488698a120
Instruction Fuzzy Hash: C8E0E5365141A1EBD2101F38BC0AA273A78DFC6710F068436F80956251DB3DE801C2EA

Function 007D9A70 Relevance: 1.5, APIs: 1, Instructions: 13
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000,?,007DB8AB,?,0079F3E6,00000000,00000001), ref: 007D9A8E

Memory Dump Source

Source File: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: c91abace2d552d7380079c95985a3ebeef75ab59c9b5fb0f3acde6c53526da81
Instruction ID: 5e19f64b24d8c54f95f5b6d60914bcd974baa01b8fb4e758925d2fb1b0f4d66e
Opcode Fuzzy Hash: c91abace2d552d7380079c95985a3ebeef75ab59c9b5fb0f3acde6c53526da81
Instruction Fuzzy Hash: 63D01231445122EBC6201F18FC0AB9F3BB4EF09720F078451B4086F175C639EC51C6D4

Function 007D9A50 Relevance: 1.5, APIs: 1, Instructions: 9
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,007DB8A0), ref: 007D9A60

Memory Dump Source

Source File: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a3722e9d66e27cf02827f24bc5037601499bba43e74342163d2057096fc393e9
Instruction ID: 93032546e4bba92ed98f78967f47a65bcab33f4be9a3a6edb3d7ed1da2b27faf
Opcode Fuzzy Hash: a3722e9d66e27cf02827f24bc5037601499bba43e74342163d2057096fc393e9
Instruction Fuzzy Hash: 79C09B31055120EBC5602B14FC09FCE3F74DF45361F014091B408671B1C7747C82C6D4

Non-executed Functions

Function 008C3498 Relevance: 38.2, Strings: 30, Instructions: 740COMMON

Download Yara Rule

Strings

%TrialExecsTotal%, xrefs: 008C3853
%TrialExecsLeft%, xrefs: 008C38A5
%CU_EXECPR%, xrefs: 008C375E
%DaysToKeyExp%, xrefs: 008C3575
%CU_EXTFILES%, xrefs: 008C3734
%CU_WINVER%, xrefs: 008C37C8
%TrialStartDay%, xrefs: 008C3BE4
%TrialStartMonth%, xrefs: 008C3B72
%TrialExpMonth%, xrefs: 008C3A2E
%TrialDaysTotal%, xrefs: 008C38F8
%TrialEndDay%, xrefs: 008C3D28
%TrialExpDay%, xrefs: 008C3AA0
%HardwareID%, xrefs: 008C36FF
%TrialStartYear%, xrefs: 008C3B00
%RegName%, xrefs: 008C359F
%AppName%, xrefs: 008C3500
%CU_VIRTTOOLS%, xrefs: 008C3803
%TrialExecMinsTotal%, xrefs: 008C3D7E
%TrialExpYear%, xrefs: 008C39BC
%RegKey%, xrefs: 008C35C9
%TrialEndMonth%, xrefs: 008C3CB6
%TrialEndYear%, xrefs: 008C3C44
%KeyExpYear%, xrefs: 008C3613
%AppVers%, xrefs: 008C3540
%.2d, xrefs: 008C3655, 008C36B1, 008C3A0B, 008C3A7D, 008C3B4F, 008C3BC1, 008C3C93, 008C3D05
%TrialDaysLeft%, xrefs: 008C394A
%TrialExecMinsLeft%, xrefs: 008C3DD3
%KeyExpMonth%, xrefs: 008C366F
%CU_INSTSERV%, xrefs: 008C3793
%KeyExpDay%, xrefs: 008C36CB

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID: %.2d$%AppName%$%AppVers%$%CU_EXECPR%$%CU_EXTFILES%$%CU_INSTSERV%$%CU_VIRTTOOLS%$%CU_WINVER%$%DaysToKeyExp%$%HardwareID%$%KeyExpDay%$%KeyExpMonth%$%KeyExpYear%$%RegKey%$%RegName%$%TrialDaysLeft%$%TrialDaysTotal%$%TrialEndDay%$%TrialEndMonth%$%TrialEndYear%$%TrialExecMinsLeft%$%TrialExecMinsTotal%$%TrialExecsLeft%$%TrialExecsTotal%$%TrialExpDay%$%TrialExpMonth%$%TrialExpYear%$%TrialStartDay%$%TrialStartMonth%$%TrialStartYear%
API String ID: 0-4160824473
Opcode ID: e281366c981add358b251b998fb9393ba20b1b3cf39105e26343d85773303715
Instruction ID: a3aa924814b5d126d563de45ce2ed25b84999980608fa102a3da0b28d02d5171
Opcode Fuzzy Hash: e281366c981add358b251b998fb9393ba20b1b3cf39105e26343d85773303715
Instruction Fuzzy Hash: 0C62E934A00158DFDB10EB94D895FEDB7B9FF88300F1050A9A658D7356DA34AE8ACF61

Function 007D5ED0 Relevance: 11.1, Strings: 8, Instructions: 1071COMMON

Download Yara Rule

Strings

aurs, xrefs: 007D5FA3, 007D6038
, xrefs: 007D5F00, 007D5F44, 007D61F4, 007D6359, 007D6048, 007D6036, 007D6363
0e;g, xrefs: 007D6505
XY, xrefs: 007D655D
6EG, xrefs: 007D6545
;i7k, xrefs: 007D6570
I, xrefs: 007D611E
&u!w, xrefs: 007D6525

Memory Dump Source

Source File: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID: &u!w$0e;g$6EG$;i7k$XY$aurs$I$
API String ID: 0-2717712644
Opcode ID: 5ff63e602d408999a413a8e73c59cd627b1e9aad4a5c0d9794e5176dce62c8e4
Instruction ID: 5e4411b361e3e15c49f9c4a807026c041a49dd96d04719ea077946572ba66728
Opcode Fuzzy Hash: 5ff63e602d408999a413a8e73c59cd627b1e9aad4a5c0d9794e5176dce62c8e4
Instruction Fuzzy Hash: 7672CF72A183518FE314CF29C88175BFBE2EFC9310F19892EE5999B351D678D805CB92

Function 007A8120 Relevance: 8.3, Strings: 4, Instructions: 3286COMMON

Download Yara Rule

Strings

px}, xrefs: 007A8C77, 007A8F14
!@ , xrefs: 007A9130
!_(i, xrefs: 007AA0C8
`, xrefs: 007A9BB3

Memory Dump Source

Source File: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID: !@ $!_(i$`$px}
API String ID: 0-2619104984
Opcode ID: e6bbf184608d654dabd94cde355ecf3f202128866bafc5e47304b3824012f9bd
Instruction ID: b381c3b7a19f8e3969800f82345f8c9d5994d4b56fa91f72bb9e8c59c074860a
Opcode Fuzzy Hash: e6bbf184608d654dabd94cde355ecf3f202128866bafc5e47304b3824012f9bd
Instruction Fuzzy Hash: E553D375608B40CFD324DF38C585756BBE1AF9A310F098A6DD5EA8B3A2D738E405CB52

Function 007B5B70 Relevance: 6.7, Strings: 5, Instructions: 420COMMON

Download Yara Rule

Strings

?m2y, xrefs: 007B6039
:m2y, xrefs: 007B6003
$%"#, xrefs: 007B6040, 007B6048
}, xrefs: 007B5FEB
, xrefs: 007B5FFE

Memory Dump Source

Source File: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID: $$%"#$:m2y$?m2y$}
API String ID: 0-169198592
Opcode ID: fb06aa3c88cec674983223f926c473fb5d08356e9a47bef9fad3311e8c07365c
Instruction ID: fc605ed423acae365adb33fd180fe4371ba01028e6a8011ff936adfa886c577e
Opcode Fuzzy Hash: fb06aa3c88cec674983223f926c473fb5d08356e9a47bef9fad3311e8c07365c
Instruction Fuzzy Hash: BDE10371608301EFD711DF24CC85B9ABBE2AF99354F148A2DF4D89B2A1D73AD944CB42

Function 007C7720 Relevance: 4.0, Strings: 3, Instructions: 274COMMON

Download Yara Rule

Strings

A, xrefs: 007C774C
),~, xrefs: 007C77D8
S7C, xrefs: 007C7923

Memory Dump Source

Source File: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID: A$),~$S7C
API String ID: 0-4288236831
Opcode ID: ce8902d42f0633d2799f9164c9257db1e21ac5d54d5b01ed0daa3b4fa4e534b0
Instruction ID: bd36473ba66d18078d07d238248c28efc88f7fb82309224a3ada1ba0480ce889
Opcode Fuzzy Hash: ce8902d42f0633d2799f9164c9257db1e21ac5d54d5b01ed0daa3b4fa4e534b0
Instruction Fuzzy Hash: 8CA19BB550D3918BE338CF2A889179BFBE2AFD6314F18895DC4C88B345DB754906CB82

Function 007B6230 Relevance: 4.0, Strings: 3, Instructions: 256COMMON

Download Yara Rule

Strings

B, xrefs: 007B62AB
E, xrefs: 007B62A6
C, xrefs: 007B62B0

Memory Dump Source

Source File: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID: B$C$E
API String ID: 0-1321444221
Opcode ID: 493ad6c1052eddc00e480e77169bb5e84ca7ce19062fbf639d22605e7bcf88f0
Instruction ID: d3fb7f1375f3dea0948cec98bf8b0b807e1d781925d1774c77def3bc33d004bf
Opcode Fuzzy Hash: 493ad6c1052eddc00e480e77169bb5e84ca7ce19062fbf639d22605e7bcf88f0
Instruction Fuzzy Hash: 37812B33B59AD047D3188D3C8C913AAAA835BD6230B2EC77DEAB58B3E6D56C4C064351

Function 0084A36C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52filenativeCOMMON

Download Yara Rule

APIs

NtQueryDirectoryFile.NTDLL(?,?,?,?,?,?,?,?,?,?,?), ref: 0084A3C4

Strings

-?w, xrefs: 0084A3C4

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: DirectoryFileQuery
String ID: -?w
API String ID: 3295332484-2373261926
Opcode ID: e9e361560e22ae23366a3139761306b5c5cd0e6c803a20a98ac581e3f8703d0d
Instruction ID: dc2a72726e81c7b2f3b2f82b76ea330b671bf0f04ded377eeb1a7a52c866c8b5
Opcode Fuzzy Hash: e9e361560e22ae23366a3139761306b5c5cd0e6c803a20a98ac581e3f8703d0d
Instruction Fuzzy Hash: 7F019AB265529D7F9B10CE9ADCC4DEBBBADFB9E254B484444BA58D7202C230AC51C770

Function 0084A180 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48nativeCOMMON

Download Yara Rule

APIs

NtNotifyChangeKey.NTDLL(?,?,?,?,?,?,?,?,?,?), ref: 0084A1D0

Strings

<?w, xrefs: 0084A1D0

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: ChangeNotify
String ID: <?w
API String ID: 3893256919-985178741
Opcode ID: 87fa64820a348acd44d7cd2a7bdc790671bddd10c38f87b8a644f35e90ec64c4
Instruction ID: cbabe38d446381be34e91f4ab3f263dfa91d225a01a4167383b1d176b465a6a6
Opcode Fuzzy Hash: 87fa64820a348acd44d7cd2a7bdc790671bddd10c38f87b8a644f35e90ec64c4
Instruction Fuzzy Hash: C401CDF624518D7F9B11CE9ADCC5DEBBF6DFB9E254B484045BA5987201C130AC50C7B0

Function 0084A48C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48filenativeCOMMON

Download Yara Rule

APIs

NtLockFile.NTDLL(?,?,?,?,?,?,?,?,?,?), ref: 0084A4DC

Strings

0;?w, xrefs: 0084A4DC

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: FileLock
String ID: 0;?w
API String ID: 3169042693-1877926767
Opcode ID: 2a8fbd76f6e8a80da75fa99f8a3a8aef2638b6548a6f0638a36413f4f449b98b
Instruction ID: 4f5e46d26de2fca642ce7f216c3204ef3ec324171226bd8addd9621be1f9425a
Opcode Fuzzy Hash: 2a8fbd76f6e8a80da75fa99f8a3a8aef2638b6548a6f0638a36413f4f449b98b
Instruction Fuzzy Hash: 2301C2A664518D7F9B118E9ADCC8DEBBFACFB5E294B444005BA5887201C170AC51C7B0

Function 00849B50 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48filenativeCOMMON

Download Yara Rule

APIs

NtDeviceIoControlFile.NTDLL(?,?,?,?,?,?,?,?,?,?), ref: 00849BA0

Strings

*?w, xrefs: 00849BA0

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: ControlDeviceFile
String ID: *?w
API String ID: 3512290074-2285505763
Opcode ID: 672496331ef4a9952e6653b6961cfe63280c657d88c8c24e32bd674f17d058e8
Instruction ID: e4e45fa16a0d0dd8facab394789edfa556311a689ac8ca5e601afefa33ff4b36
Opcode Fuzzy Hash: 672496331ef4a9952e6653b6961cfe63280c657d88c8c24e32bd674f17d058e8
Instruction Fuzzy Hash: DA016BB660425DBF9B10CE8ADCC4DEBBBACFB9D664B444005BB1897201C230AC50D7B0

Function 00849E6C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48filenativeCOMMON

Download Yara Rule

APIs

NtFsControlFile.NTDLL(?,?,?,?,?,?,?,?,?,?), ref: 00849EBC

Strings

.?w, xrefs: 00849EBC

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: ControlFile
String ID: .?w
API String ID: 1795486800-622515563
Opcode ID: 083758f4784a5d0d550a847c267ce13e1f363d7bd844bf3e58dc76613df59330
Instruction ID: 3d447695fbfd499b41cb637700588487f1d2e9cea483923550a47f53da78cf0b
Opcode Fuzzy Hash: 083758f4784a5d0d550a847c267ce13e1f363d7bd844bf3e58dc76613df59330
Instruction Fuzzy Hash: 2B016FB660425DBF9710CE8ADCC4DEBBB6CFB8D694B444415BB5897211C270AC50C7B0

Function 00849CA0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44nativeCOMMON

Download Yara Rule

APIs

NtCreateProcessEx.NTDLL(?,?,?,?,?,?,?,?,?), ref: 00849CE8

Strings

`/?w, xrefs: 00849CE8

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: `/?w
API String ID: 963392458-3217876833
Opcode ID: 16c9471c0184fd4ab4c2a15c6bb1c1c7e0a2ec072c2fe1fea479cefd24dddb1f
Instruction ID: 05d5080c2514efaac0ca678a9eb275dc5c7f16124d8c79d99da3b87a82a38e32
Opcode Fuzzy Hash: 16c9471c0184fd4ab4c2a15c6bb1c1c7e0a2ec072c2fe1fea479cefd24dddb1f
Instruction Fuzzy Hash: BAF09CB660435DBF9B10CE8ADCC8DEB7BACFB8D7A4B448005BA1887241C270AD50D7B0

Function 00849BE4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40nativethreadCOMMON

Download Yara Rule

APIs

NtCreateThread.NTDLL(?,?,?,?,?,?,?,?), ref: 00849C24

Strings

p/?w, xrefs: 00849C24

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID: p/?w
API String ID: 2422867632-4023759102
Opcode ID: 394c3146ffe156c7d3566a7de59590d38c8d1fdfa1008a8c7f4a14f088ec331d
Instruction ID: 2ae5af04635ccc0032a42f5231252dc85f17d47dbdba7066d88b3c9c2639f641
Opcode Fuzzy Hash: 394c3146ffe156c7d3566a7de59590d38c8d1fdfa1008a8c7f4a14f088ec331d
Instruction Fuzzy Hash: 97F0F4F661514C7F9B109E96DCC8DE77FACEB8E7A4B448459FA4987101C270AD50C7B0

Function 00849C50 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40nativeCOMMON

Download Yara Rule

APIs

NtCreateProcess.NTDLL(?,?,?,?,?,?,?,?), ref: 00849C90

Strings

6?w, xrefs: 00849C90

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: 6?w
API String ID: 963392458-925837219
Opcode ID: aa3efefba686f83b0b5241e88f5a9f58b6518d778c3540108484c36914f2d6f5
Instruction ID: db0593ac8e0c051a4ac8dc8129d390846ea873cef32624ae8f799628bb5676b9
Opcode Fuzzy Hash: aa3efefba686f83b0b5241e88f5a9f58b6518d778c3540108484c36914f2d6f5
Instruction Fuzzy Hash: 65F0D0B660424DBF9B10DE8ADCC8DE77BACFB8D7A4B444005FA0887151C230AC50D7B0

Function 00849F04 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40nativeCOMMON

Download Yara Rule

APIs

NtAccessCheck.NTDLL(?,?,?,?,?,?,?,?), ref: 00849F44

Strings

p*?w, xrefs: 00849F44

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: AccessCheck
String ID: p*?w
API String ID: 3492747997-3911086613
Opcode ID: 6698297d7d768b7d846aab572629e0c2e3272b9c31bd5db9822cd52f3925d073
Instruction ID: bbd40d4ac24e01f72521a35f7e2ffe191e200070c103547408f168cae7a1a6ec
Opcode Fuzzy Hash: 6698297d7d768b7d846aab572629e0c2e3272b9c31bd5db9822cd52f3925d073
Instruction Fuzzy Hash: CFF0B7B660525DBF9720CF8ADCC8DEB7BACEB8D6A4B448005FA0887201C270AC50D7B0

Function 0084A028 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36nativeCOMMON

Download Yara Rule

APIs

NtCreateKey.NTDLL(?,?,?,?,?,?,?), ref: 0084A060

Strings

`,?w, xrefs: 0084A060

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: Create
String ID: `,?w
API String ID: 2289755597-3179960632
Opcode ID: 29eb3bc5557408c54c868e8d14a9de610240ec8876e97fc5914a0efe9c017fdf
Instruction ID: 5255a451373eae98ccb926ed87b75421f7c5aab4489ca814b506bc40e1372efa
Opcode Fuzzy Hash: 29eb3bc5557408c54c868e8d14a9de610240ec8876e97fc5914a0efe9c017fdf
Instruction Fuzzy Hash: 64F01CB660420CBFA714CA86EC88DEB7F6CEB897A4F008009BA1887151C271AD40C7B1

Function 0084A3F4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36nativeCOMMON

Download Yara Rule

APIs

NtDuplicateObject.NTDLL(?,?,?,?,?,?,?), ref: 0084A42C

Strings

P.?w, xrefs: 0084A42C

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: DuplicateObject
String ID: P.?w
API String ID: 3677547684-1311077879
Opcode ID: 76471de057bbe39ffb6c5bbe4a46bd42a1c5f20341d14f8dc41937ce46c662ce
Instruction ID: cb2a7bae7b5af63a88b57a50fbe94b4f1e60ae44af07180e7236209b030a2a43
Opcode Fuzzy Hash: 76471de057bbe39ffb6c5bbe4a46bd42a1c5f20341d14f8dc41937ce46c662ce
Instruction Fuzzy Hash: 99F01CB660421C7FA7109A86DC8CDEB7B6CFB8A7A4B408415FA18C7101C270AD00C7B0

Function 0084A5EC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36nativeCOMMON

Download Yara Rule

APIs

NtCreateSection.NTDLL(?,?,?,?,?,?,?), ref: 0084A624

Strings

0/?w, xrefs: 0084A624

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: CreateSection
String ID: 0/?w
API String ID: 2449625523-1958865091
Opcode ID: 9ffa7ac38cf9f94c2dfc40916e7a8e7b6af21149d98928021047399e29469e3d
Instruction ID: fb82890ced8f5e3785fb4281a3b1fde0fd66e4777b247dc417225ff9139c871d
Opcode Fuzzy Hash: 9ffa7ac38cf9f94c2dfc40916e7a8e7b6af21149d98928021047399e29469e3d
Instruction Fuzzy Hash: 60F01CB660425C7FA7108F96DC88DE77B6CEB8A7A4B448005F60887102C270AC00C7B0

Function 00849FE8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32nativeCOMMON

Download Yara Rule

APIs

NtQueryValueKey.NTDLL(?,?,?,?,?,?), ref: 0084A018

Strings

+?w, xrefs: 0084A018

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: QueryValue
String ID: +?w
API String ID: 3660427363-2314757844
Opcode ID: 9d1f64317058f4ac17e3ad3e70e4e0adaea685583a52773f1c1ce6f9baaaad91
Instruction ID: 40bc716eae91d067e63f39ca0cc60a44c708ad2c3a54b0149989a87d3b4ad291
Opcode Fuzzy Hash: 9d1f64317058f4ac17e3ad3e70e4e0adaea685583a52773f1c1ce6f9baaaad91
Instruction Fuzzy Hash: FDE012B260515CBFA7149B46EC88DFB7F6CEBC97A4B148019F50587151D171AC40D7B1

Function 0084A338 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 26nativeCOMMON

Download Yara Rule

APIs

NtQueryObject.NTDLL(?,?,?,?,?), ref: 0084A35F

Strings

p+?w, xrefs: 0084A35F

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: ObjectQuery
String ID: p+?w
API String ID: 2748340528-3906738210
Opcode ID: 1a26385fe547b450c58bf505e1827c39f6cda17b03047bf97c28bb1f82e7204b
Instruction ID: d7ebda73745eab44d8d6247bfa0eb61a9f25abd11f3fef82d499c49ae212e2d5
Opcode Fuzzy Hash: 1a26385fe547b450c58bf505e1827c39f6cda17b03047bf97c28bb1f82e7204b
Instruction Fuzzy Hash: 79E0C2B2A051587ED7345B5AAC0CEE7BF6CEBE67B0B048419B418D3210D270AC00D2B0

Function 0084A4EC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 26filenativeCOMMON

Download Yara Rule

APIs

NtUnlockFile.NTDLL(?,?,?,?,?), ref: 0084A513

Strings

0G?w, xrefs: 0084A513

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: FileUnlock
String ID: 0G?w
API String ID: 45017762-839217755
Opcode ID: 903644e0521c45a548e831c45813e973c0aa5a6e19d16603b449a5f016383018
Instruction ID: 94a70dc045908b677b27737df39cfc4e9247e62dd54eb15edb20ddf34567f4dd
Opcode Fuzzy Hash: 903644e0521c45a548e831c45813e973c0aa5a6e19d16603b449a5f016383018
Instruction Fuzzy Hash: 00E08CA1A48258BAE724579A9C0CDF77F6CEBC27B0B088019B418D3100D260AD01D2B0

Function 0084A43C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 26filenativeCOMMON

Download Yara Rule

APIs

NtQueryVolumeInformationFile.NTDLL(?,?,?,?,?), ref: 0084A463

Strings

/?w, xrefs: 0084A463

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: FileInformationQueryVolume
String ID: /?w
API String ID: 634242254-618184540
Opcode ID: b8a545077a167f333e2dbdd611d86c11ab7401ce7f221593ba016f745b33f4c6
Instruction ID: d6abb346ba23ccb12bc5f7c290a97566f1bcbd229ccda5d695ef53df37f9ee42
Opcode Fuzzy Hash: b8a545077a167f333e2dbdd611d86c11ab7401ce7f221593ba016f745b33f4c6
Instruction Fuzzy Hash: 41E08CA16141187A9224578A9D0CEEB7F6CDBC27B0B008029B558E2101C2B1AD00C2B4

Function 00849DE0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 26nativeCOMMON

Download Yara Rule

APIs

NtQuerySecurityObject.NTDLL(?,?,?,?,?), ref: 00849E07

Strings

@@?w, xrefs: 00849E07

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: ObjectQuerySecurity
String ID: @@?w
API String ID: 718582247-1551221826
Opcode ID: d634f269bed3a29e185256f1998c8ce10018e59590e1de5a80e9aea37a2e2654
Instruction ID: c3906abca7ad9f46206ce2f4fa558a30a3122964c8d52e7bd686c85f82286d54
Opcode Fuzzy Hash: d634f269bed3a29e185256f1998c8ce10018e59590e1de5a80e9aea37a2e2654
Instruction Fuzzy Hash: F7E0C2B16042287EE320974AEC0CDE77FACDBC27B0B008069F449D3100D2A0AD80C2F0

Function 0084A2C4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 11nativeCOMMON

Download Yara Rule

APIs

NtTerminateProcess.NTDLL(?,00000000), ref: 0084A2D9

Strings

P-?w, xrefs: 0084A2D9

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: ProcessTerminate
String ID: P-?w
API String ID: 560597551-1281608622
Opcode ID: 8fd684f61145dbd4691ad85a322f7f1399000755fd081da308ef3dd90a72560e
Instruction ID: df91fb44cb75c35cd36a390e5a77c61b93031217b525e69e005b6992679d15a6
Opcode Fuzzy Hash: 8fd684f61145dbd4691ad85a322f7f1399000755fd081da308ef3dd90a72560e
Instruction Fuzzy Hash: 3BC048D0E592947AEE1993A85E0CBB629AC97C2712F04C08870A8C10A2DAA84842F621

Function 0084A53C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 11nativeCOMMON

Download Yara Rule

APIs

NtUnmapViewOfSection.NTDLL(00000000), ref: 0084A551

Strings

0-?w, xrefs: 0084A551

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: SectionUnmapView
String ID: 0-?w
API String ID: 498011366-2001026221
Opcode ID: 9e295d0d2622235da32fe712863e5e05f0439549de9f165cbd5fbe8d6a6a01ac
Instruction ID: 863382e19b239a62d0b8b677544fbb7a968b1730a38c00b43a03daf0e0184320
Opcode Fuzzy Hash: 9e295d0d2622235da32fe712863e5e05f0439549de9f165cbd5fbe8d6a6a01ac
Instruction Fuzzy Hash: 29C04CD0E1814439EE1693A85E0CBB6255E97C0B05F0584487050C1065C664DA44E321

Function 00797E10 Relevance: 3.3, Strings: 2, Instructions: 792COMMON

Download Yara Rule

Strings

8, xrefs: 00798723
0, xrefs: 0079872B

Memory Dump Source

Source File: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 02a6200c8b2449dd38a75b89d790011da218abbf87e142003d39d859e5145057
Instruction ID: e9a36a6675dd2b94edb3d57415a57e87e097ac02a5b9109ae85970df42d50d3a
Opcode Fuzzy Hash: 02a6200c8b2449dd38a75b89d790011da218abbf87e142003d39d859e5145057
Instruction Fuzzy Hash: FC7243711083409FDB54CF18D884BAABBE1BF89314F04892DF8998B392D779D959CB93

Function 007CA6E0 Relevance: 3.2, Strings: 2, Instructions: 727COMMON

Download Yara Rule

Strings

? , xrefs: 007CB043
\#, xrefs: 007CAE68

Memory Dump Source

Source File: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID: ? $\#
API String ID: 0-2480481878
Opcode ID: 477f6d63fb6292eef42ebd80aa39452923bd33246c569d7b342c363ebc280377
Instruction ID: 080845f5c99f100f6c68a4a483c7ae0d36082a44a9903f8cd6dcc5a0c6bc9fff
Opcode Fuzzy Hash: 477f6d63fb6292eef42ebd80aa39452923bd33246c569d7b342c363ebc280377
Instruction Fuzzy Hash: 457237B0616B808FD365CF39C8917A3BBE9AB59304F14486ED1EEC7342CB78A541CB56

Function 008C8A04 Relevance: 2.9, Strings: 2, Instructions: 390COMMON

Download Yara Rule

Strings

ZwQuerySection, Unsupported class %d, xrefs: 008C8EDF
0, xrefs: 008C8B7B

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID: 0$ZwQuerySection, Unsupported class %d
API String ID: 0-2380292483
Opcode ID: 372e837c3582d61d11dd4a0ff3b2395e5ed7eef2c1e104001701f89a2f5e8761
Instruction ID: 09ae19f45a992c9aaee7cbf2ffa37b828a611cd6b5e79a4e2e23b5b9f8a04fa3
Opcode Fuzzy Hash: 372e837c3582d61d11dd4a0ff3b2395e5ed7eef2c1e104001701f89a2f5e8761
Instruction Fuzzy Hash: 3AF1D0B4A40249DFDB04DF68C980AAAB7F1FF49304F2585A9E814EB351DB34ED41CB65

Function 008CBA18 Relevance: 2.8, Strings: 2, Instructions: 304COMMON

Download Yara Rule

Strings

#, xrefs: 008CBC96
ZwQueryValueKey, unsupported class %d, xrefs: 008CBD68

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID: #$ZwQueryValueKey, unsupported class %d
API String ID: 0-453009116
Opcode ID: f56de002ff7ec9cabf381918651432c9e83b221312d939dd9199c5e3f2b4cc05
Instruction ID: a812a21dc3716370dc55f5679d697f7e51a211c323b8bb6b10a7024899966e16
Opcode Fuzzy Hash: f56de002ff7ec9cabf381918651432c9e83b221312d939dd9199c5e3f2b4cc05
Instruction Fuzzy Hash: 7CB1C674A00509AFDB40EFA8C886AAEB7F5FF88314F14C169A914DB315DB74EE41CB91

Function 007B6520 Relevance: 2.6, Strings: 1, Instructions: 1397COMMON

Download Yara Rule

Strings

, xrefs: 007B65B1

Memory Dump Source

Source File: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 65fd4bac815d7df12c107934dc088f07f1081b9cf58d3441747d8e15189e9d42
Instruction ID: 5e9f1d734ebb048135859fe140f47631c4f4265758fc31fdf4f89f528da350f8
Opcode Fuzzy Hash: 65fd4bac815d7df12c107934dc088f07f1081b9cf58d3441747d8e15189e9d42
Instruction Fuzzy Hash: 09C2F671A086918FC719CB3CC89439DBFE1AB96324F1983ACD4A99B3D1D7789841CB91

Function 00864C0C Relevance: 2.2, Strings: 1, Instructions: 905COMMON

Download Yara Rule

Strings

, xrefs: 00865617

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: cdc6b0ac0583f73ff55a2437943e5d23bc6cb4bd592f5b03fc81500c2fb9aa22
Instruction ID: 2d91317b761e2604b64c836b050c117d95c673404ea2f7d3998fe9aa9ea5ba01
Opcode Fuzzy Hash: cdc6b0ac0583f73ff55a2437943e5d23bc6cb4bd592f5b03fc81500c2fb9aa22
Instruction Fuzzy Hash: E482E134A00608DFCB04DFA8C589AAEB7F1FF49310F2685A4E855DB366DB70AE41DB51

Function 008CFEB0 Relevance: 1.8, Strings: 1, Instructions: 518COMMON

Download Yara Rule

Strings

MZP, xrefs: 008CFF79

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID: MZP
API String ID: 0-2889622443
Opcode ID: 0e8d8ddb83c184bd7e8461b9246ff63f63c55d58a959126d0e016a669ac3a08e
Instruction ID: a91cd6685d9785496ee9020531cb78e985e128ab2d9e63be9a045855970518ed
Opcode Fuzzy Hash: 0e8d8ddb83c184bd7e8461b9246ff63f63c55d58a959126d0e016a669ac3a08e
Instruction Fuzzy Hash: 3112D374A00209DFDB14EFA8C885FAEB7B5FB48700F148165E604EB395DB74AD42CBA1

Function 00796FE6 Relevance: 1.6, Strings: 1, Instructions: 373COMMON

Download Yara Rule

Strings

a, xrefs: 00797098

Memory Dump Source

Source File: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID: a
API String ID: 0-3904355907
Opcode ID: 23bbc67ec9f2f440247ac80384d749b4914663c150ffd07948e5e144918d0d2b
Instruction ID: 5253a4456a539414856cdf870978094816ea57d4edc35407357bfee9dc87d535
Opcode Fuzzy Hash: 23bbc67ec9f2f440247ac80384d749b4914663c150ffd07948e5e144918d0d2b
Instruction Fuzzy Hash: 0CE17570A18300DFDB18CF18D884B6ABBE1BF88314F14892DF98997251E778EC45CB92

Function 00849CF8 Relevance: 1.6, APIs: 1, Instructions: 52nativeCOMMON

Download Yara Rule

APIs

NtCreateUserProcess.NTDLL(?,?,?,?,?,?,?,?,?,?,?), ref: 00849D50

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: f443d7a06a20c18c3b06d7af3f8d7422094a529293eeec764a38d788a561bfce
Instruction ID: efdc9b246bf1ea006772abb774783431084560e1116d14354b1500458b67bf61
Opcode Fuzzy Hash: f443d7a06a20c18c3b06d7af3f8d7422094a529293eeec764a38d788a561bfce
Instruction Fuzzy Hash: 460148B6604259BF9B10CE8ADCC4DDBBBACFB8D664B844415BB1897242C270AC51CBB0

Function 0084A58C Relevance: 1.5, APIs: 1, Instructions: 48nativeCOMMON

Download Yara Rule

APIs

NtMapViewOfSection.NTDLL(?,?,?,?,?,?,?,?,?,?), ref: 0084A5DC

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: SectionView
String ID:
API String ID: 1323581903-0
Opcode ID: 1d0bf77d148e5e99b67879033a2387986edf96b2128e3cf390a308142d82cb98
Instruction ID: ba4fc2eca9dbd9740898cc93ce847eb91c215d350c33c795f41a591266f5bbe7
Opcode Fuzzy Hash: 1d0bf77d148e5e99b67879033a2387986edf96b2128e3cf390a308142d82cb98
Instruction Fuzzy Hash: F1017DB660425DBF9B14CE8ADCC5DEBBB6CFB8D794B444005BB1997202C270AC50CBB1

Function 0084A2E0 Relevance: 1.5, APIs: 1, Instructions: 44filenativeCOMMON

Download Yara Rule

APIs

NtWriteFile.NTDLL(?,?,?,?,?,?,?,?,?), ref: 0084A328

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 73eb464776159fe33eebce360b03645534a2139363bb1525225538a538a71f67
Instruction ID: 9972310571abddb1e78b63c4f6962c9ebab0c5ce1bc23f97a94ddd44bf6650bb
Opcode Fuzzy Hash: 73eb464776159fe33eebce360b03645534a2139363bb1525225538a538a71f67
Instruction Fuzzy Hash: 13F09CB664424DBF9710CE8ADCC8DEB7B6CFB8D764B548409BA1897201C270AD50C7B1

Function 00849E14 Relevance: 1.5, APIs: 1, Instructions: 44filenativeCOMMON

Download Yara Rule

APIs

NtNotifyChangeDirectoryFile.NTDLL(?,?,?,?,?,?,?,?,?), ref: 00849E5C

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: ChangeDirectoryFileNotify
String ID:
API String ID: 1357473996-0
Opcode ID: 0b40ab1b0f4a0ce7d87ae61666b68c40969ca7b7ede04179a703dd0f90d0fc8a
Instruction ID: ba0ff413497ce0646d98f9b6293542ffda1e0e2d770947ee4f07969a487c66c4
Opcode Fuzzy Hash: 0b40ab1b0f4a0ce7d87ae61666b68c40969ca7b7ede04179a703dd0f90d0fc8a
Instruction Fuzzy Hash: 3EF0AFB660525D7F9710CE9ADCC4DEB7B6CFB9D6A4B448015FA5897202C270AD50C7B0

Function 0084A0B0 Relevance: 1.5, APIs: 1, Instructions: 32nativeCOMMON

Download Yara Rule

APIs

NtSetValueKey.NTDLL(?,?,?,?,?,?), ref: 0084A0E0

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 91bead0aa1ad51737e4bd1e2a7d6bc8b66871dc3998e76d10f943dbf44623bf9
Instruction ID: 0e5d0e9004a750f9391978c94b266ee28506f5889046f4eaebc783b9b6051602
Opcode Fuzzy Hash: 91bead0aa1ad51737e4bd1e2a7d6bc8b66871dc3998e76d10f943dbf44623bf9
Instruction Fuzzy Hash: 6EE012B664425CBFA7148B56DC48DF77F6DEBCA7A4F048019B50887150C1716C40D7B0

Function 0084A070 Relevance: 1.5, APIs: 1, Instructions: 32nativeCOMMON

Download Yara Rule

APIs

NtEnumerateKey.NTDLL(?,?,?,?,?,?), ref: 0084A0A0

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: Enumerate
String ID:
API String ID: 304946047-0
Opcode ID: 532923a7ec305fb397a912691510be7928e172de7d8dc56226e9eb3bec2ae29a
Instruction ID: e4d75d7fa7e68cc4b6fa76a84f6bdfaf87ce71b9bee4ee91c8fa5117babd4765
Opcode Fuzzy Hash: 532923a7ec305fb397a912691510be7928e172de7d8dc56226e9eb3bec2ae29a
Instruction Fuzzy Hash: 93E012B361425CBFA7258B56DC49DE77F6CEBC57A4B008019B50487191C1716C40C7B1

Function 0084A1E0 Relevance: 1.5, APIs: 1, Instructions: 32nativeCOMMON

Download Yara Rule

APIs

NtQueryMultipleValueKey.NTDLL(?,?,?,?,?,?), ref: 0084A210

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: MultipleQueryValue
String ID:
API String ID: 23559346-0
Opcode ID: 7b80b8664be8637144b6ddb9057eda554d130cad5d092f73b832bc6c8deb002b
Instruction ID: 8c5a4fe66d3a338d9aafd715953ce102a3badc58f85a7b61ef50f7b5c97301bc
Opcode Fuzzy Hash: 7b80b8664be8637144b6ddb9057eda554d130cad5d092f73b832bc6c8deb002b
Instruction Fuzzy Hash: 41E012B260515C7FA7148B96DC88DEB7F6DEBC97A4B408019F50487141D2716D40D7B0

Function 0084A778 Relevance: 1.5, APIs: 1, Instructions: 32filenativeCOMMON

Download Yara Rule

APIs

NtOpenFile.NTDLL(?,?,?,?,?,?), ref: 0084A7A8

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: FileOpen
String ID:
API String ID: 2669468079-0
Opcode ID: 0a8816444154f82ab67294dcb9c67d15fccb9e38f9cb0f0fc63beceb65ac61b6
Instruction ID: 4a9abe2562cc529c8c8bb606f0412fac14e55124cfb4bdb9bf328090a04077de
Opcode Fuzzy Hash: 0a8816444154f82ab67294dcb9c67d15fccb9e38f9cb0f0fc63beceb65ac61b6
Instruction Fuzzy Hash: 82E0EDA665925C7FA6249B86DC8CDF77F6CEBC67B4B008419B50587141C1706C40C6B0

Function 00849F74 Relevance: 1.5, APIs: 1, Instructions: 32nativeCOMMON

Download Yara Rule

APIs

NtEnumerateValueKey.NTDLL(?,?,?,?,?,?), ref: 00849FA4

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: EnumerateValue
String ID:
API String ID: 1749906896-0
Opcode ID: 565b4baa00c36f2046c0f61a0d31bb8dedba3f2bee4d4f3b15a785ff8cf955f6
Instruction ID: 386bff2a2e7a7f06fee054f7bf8a2fa5b8cc036b33a49df5169a7cdd1b354771
Opcode Fuzzy Hash: 565b4baa00c36f2046c0f61a0d31bb8dedba3f2bee4d4f3b15a785ff8cf955f6
Instruction Fuzzy Hash: EBE0EDA261425CBFA7209B56DC8CDE77F6CEBCA7A4B008019F515C7141C671AC45C6B0

Function 0084A558 Relevance: 1.5, APIs: 1, Instructions: 26nativeCOMMON

Download Yara Rule

APIs

NtQuerySection.NTDLL(?,?,?,?,?), ref: 0084A57F

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: QuerySection
String ID:
API String ID: 1985485932-0
Opcode ID: b6b128c01b80131f1ceaa4bfa7a56fcc822d3212494096e8a9fc08250a8829e4
Instruction ID: 25f385e0936595dacdce567c1a5a8d77d43f5c5971e7e4974b87278f878f3724
Opcode Fuzzy Hash: b6b128c01b80131f1ceaa4bfa7a56fcc822d3212494096e8a9fc08250a8829e4
Instruction Fuzzy Hash: D3E08CA1A082287E9624579A9D0CEEB7F7CEBC67B0B008019B418D2101C260AD04C2B0

Function 0084A684 Relevance: 1.5, APIs: 1, Instructions: 26filenativeCOMMON

Download Yara Rule

APIs

NtQueryInformationFile.NTDLL(?,?,?,?,?), ref: 0084A6AB

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: FileInformationQuery
String ID:
API String ID: 365787318-0
Opcode ID: d12b113aefd942643d1aa87980fdf01c886bfaf3c242b3d5b58d06f77b9b2362
Instruction ID: 471a8d51c4489a33748a6b4f489b798b91a7232282aa61666c67806436ceb000
Opcode Fuzzy Hash: d12b113aefd942643d1aa87980fdf01c886bfaf3c242b3d5b58d06f77b9b2362
Instruction Fuzzy Hash: 1EE08CA1A042287E9624564BDC0CEE77F6CEBDA7B0B058019F808D3100C260AC44C2B0

Function 00849BB0 Relevance: 1.5, APIs: 1, Instructions: 26nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL(?,?,?,?,?), ref: 00849BD7

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: InformationProcessQuery
String ID:
API String ID: 1778838933-0
Opcode ID: 87ce55d5e6cc9f5485f6415b073b5028157cc8bf5bd94878b391ada0d227d773
Instruction ID: 5a780d3d9a6e1c21776a1006b951fad465ba8a370165905ef9ad44617079a020
Opcode Fuzzy Hash: 87ce55d5e6cc9f5485f6415b073b5028157cc8bf5bd94878b391ada0d227d773
Instruction Fuzzy Hash: 39E012A261416C7EE7205B9AAC0CDE77FACDBC67B0B04C55DF488D3550C270AC50D6B0

Function 00849D8C Relevance: 1.5, APIs: 1, Instructions: 26filenativeCOMMON

Download Yara Rule

APIs

NtSetVolumeInformationFile.NTDLL(?,?,?,?,?), ref: 00849DB3

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: FileInformationVolume
String ID:
API String ID: 2893123674-0
Opcode ID: 09aba5b0084e626d14fb6af40300c8938f3beff52caa93f53da5cf8348618355
Instruction ID: 51b5f37880ce012c4b9cddac6cab9ba69e8e992e0d9d51322754741b553f0189
Opcode Fuzzy Hash: 09aba5b0084e626d14fb6af40300c8938f3beff52caa93f53da5cf8348618355
Instruction Fuzzy Hash: F8E08CA2A0835C7EE721564AAC0CEEB7F6CEBC27B4B048019F448D2140C260AC40C2B0

Function 00849FB4 Relevance: 1.5, APIs: 1, Instructions: 26nativeCOMMON

Download Yara Rule

APIs

NtQueryKey.NTDLL(?,?,?,?,?), ref: 00849FDB

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: Query
String ID:
API String ID: 3850148591-0
Opcode ID: 94870bc5fff28557254f0437f540c0b2d17a079c1e4812f6e3839a3a1afab894
Instruction ID: 7f6646ba29c150098ecabfffe9e79b9467609279e85c6f44dd0eb819cbb7df11
Opcode Fuzzy Hash: 94870bc5fff28557254f0437f540c0b2d17a079c1e4812f6e3839a3a1afab894
Instruction Fuzzy Hash: 60E0ECA1A182587ED7209B5BDC0CEE77F6CEBC6BB1B148119F499D2110D660AC45D2B0

Function 0084A27C Relevance: 1.5, APIs: 1, Instructions: 21nativeCOMMON

Download Yara Rule

APIs

NtSetInformationKey.NTDLL(?,?,?,?), ref: 0084A29D

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: Information
String ID:
API String ID: 2951059284-0
Opcode ID: 5469c80e380a915c23a14dba3123e6002057699f147714aef80df5086a1b8908
Instruction ID: 5fd75892882ee577e40f3824f62ebb2a86c632d4fb9b103fc472facc85ffabd3
Opcode Fuzzy Hash: 5469c80e380a915c23a14dba3123e6002057699f147714aef80df5086a1b8908
Instruction Fuzzy Hash: 20D05EE1A263387FE2145799EC0DEF77E5CDB857A0B008165B009D6010C2B16C40E2F1

Function 00849D60 Relevance: 1.5, APIs: 1, Instructions: 21nativeCOMMON

Download Yara Rule

APIs

NtOpenKeyEx.NTDLL(?,?,?,?), ref: 00849D81

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: df405365a547ce9530a7f2b5637da5b7fccfdfb7bb46d576adb47b3b6fc87459
Instruction ID: 7f99d5633a6bdc1e1f84ca04fecdf0d0b18f3407592418df1fa773940c23b60a
Opcode Fuzzy Hash: df405365a547ce9530a7f2b5637da5b7fccfdfb7bb46d576adb47b3b6fc87459
Instruction Fuzzy Hash: 24D05EA1D152687EF72053999D0CEF33E9CDB853A4F808019F045D2041D2A06C40D2B0

Function 00849F54 Relevance: 1.5, APIs: 1, Instructions: 13nativeCOMMON

Download Yara Rule

APIs

NtOpenKey.NTDLL(?,?,?), ref: 00849F6B

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 0c6ac3aff2a4808de79e57ebfcc7da7b8e1086426c5262e52c52c2c00e4613ba
Instruction ID: e42900d0cb9c546be17bf9d65ad559a639b1d5d3f8939c72abbb688c94c52bf3
Opcode Fuzzy Hash: 0c6ac3aff2a4808de79e57ebfcc7da7b8e1086426c5262e52c52c2c00e4613ba
Instruction Fuzzy Hash: 07C04CD0E283447DFE655368DC0DFF7155DD7C2706F04914CB064C1094DA646C46E630

Function 00832FF0 Relevance: 1.5, Strings: 1, Instructions: 259COMMON

Download Yara Rule

Strings

Rijndael: Invalid key size - %d, xrefs: 0083303F

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID: Rijndael: Invalid key size - %d
API String ID: 0-1845578026
Opcode ID: 021e181608670fe101d56d31629d7cbc62ce5b12c9e9d8b481d8df4e3b45e2f1
Instruction ID: 18bb41d563bcec06512cf5fdd5f303c2b7f57fa428d775512b9b684521eb36ba
Opcode Fuzzy Hash: 021e181608670fe101d56d31629d7cbc62ce5b12c9e9d8b481d8df4e3b45e2f1
Instruction Fuzzy Hash: 7BB17B30A0528A9FDF14CFA8C5906EEBBF1FF89300F6544A9D855EB306D631AB05CB91

Function 007DA050 Relevance: 1.5, Strings: 1, Instructions: 235COMMON

Download Yara Rule

Strings

CXNt, xrefs: 007DA090

Memory Dump Source

Source File: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID: CXNt
API String ID: 0-4091052137
Opcode ID: cd4134e412138f426eb5485ecf143fe34dbc784bc67334f5963611d364eb715d
Instruction ID: 07d3bafabd81b9fb07536efa545e205577556c51fc7a9fbfcd9b978df182aa5a
Opcode Fuzzy Hash: cd4134e412138f426eb5485ecf143fe34dbc784bc67334f5963611d364eb715d
Instruction Fuzzy Hash: 83610A76B153109BD314CE2AC8C156AF6F7BBC9724F19C62ED8A8873D5DA78DC0146C2

Function 008CBF48 Relevance: 1.5, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

ZwQueryKey, unsupported class %d, xrefs: 008CC727

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID: ZwQueryKey, unsupported class %d
API String ID: 0-3838701109
Opcode ID: 1c83d8cfa5c9ef1640783bc8131d7b21d223f33ea8f4d6863c4c6b601bc0fc67
Instruction ID: f50202c6a51ae6a68730f5b51b8d72f17fd46655e38ec0612af08579fb98433f
Opcode Fuzzy Hash: 1c83d8cfa5c9ef1640783bc8131d7b21d223f33ea8f4d6863c4c6b601bc0fc67
Instruction Fuzzy Hash: D081D3B0A002099FDB40EF69D985BAAB7F5FB88310F658468E918DB356DB34DD008F61

Function 008A8264 Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

f, xrefs: 008A8338

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID: f
API String ID: 0-1993550816
Opcode ID: 236594d7cf771ad4728e792b6cdb8e7332326219e54438e1430718fed0e71a4d
Instruction ID: db489c489093f699385718e1df04010a0a432c23632049a3c4cb9bad217584c8
Opcode Fuzzy Hash: 236594d7cf771ad4728e792b6cdb8e7332326219e54438e1430718fed0e71a4d
Instruction Fuzzy Hash: EF61D120D492EADBFF239EA84480BAEBFA6FF47704F1941F48C9893742D9650E058774

Function 008A8600 Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

f, xrefs: 008A86D4

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID: f
API String ID: 0-1993550816
Opcode ID: 4c9fb3fc55cab9bff30b15f814d518bece0712888deebcd08c9f4481e5fdb401
Instruction ID: 09d6787b724d2a0d7f5ffd2faf11389920622da661874cb67ee65401b65c4fe2
Opcode Fuzzy Hash: 4c9fb3fc55cab9bff30b15f814d518bece0712888deebcd08c9f4481e5fdb401
Instruction Fuzzy Hash: 9061B124D442EADAFB139EA84444BAEBFA6FF57304F2941F48C9893A42D9654E05CB70

Function 008A8A40 Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

f, xrefs: 008A8B14

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID: f
API String ID: 0-1993550816
Opcode ID: 093a12a4e8147ca19d99fe54dc26c841064e5195f0f145e6545058b3510afefe
Instruction ID: 7e6917642f7769c182a108f2f666f61469fc537e31b3d5abc2c88c876f312c93
Opcode Fuzzy Hash: 093a12a4e8147ca19d99fe54dc26c841064e5195f0f145e6545058b3510afefe
Instruction Fuzzy Hash: 8061D360D442EADEEB139EA84450BAEBFB6FF13314F1901F48C9893A42D9654E46CB71

Function 007B3B00 Relevance: 1.4, Strings: 1, Instructions: 174COMMON

Download Yara Rule

Strings

?@, xrefs: 007B3C86

Memory Dump Source

Source File: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID: ?@
API String ID: 0-550213541
Opcode ID: 3192283f2a69f34ab1c03ff42c25631d3c22c684292b6a91f31d9fbea9b7ed68
Instruction ID: ff34ec9633f9bcdccdd85f0f28dcd30bde5c5345740c33a3a4eaa6f6ee7a3723
Opcode Fuzzy Hash: 3192283f2a69f34ab1c03ff42c25631d3c22c684292b6a91f31d9fbea9b7ed68
Instruction Fuzzy Hash: 535143759083618BC724CF59C8616ABB7F1EFC6318F048A1CE8D69F790E3789901CB96

Function 007D76D0 Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

T, xrefs: 007D779F

Memory Dump Source

Source File: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID: T
API String ID: 0-3187964512
Opcode ID: 84575df33d780a879f86819306e5745679cd8990a08dcf010a94352041c3732b
Instruction ID: 6c77d0009e881b56896dc05dce11b97dcb3a990b8d845ab3c8f7c61818e9ee82
Opcode Fuzzy Hash: 84575df33d780a879f86819306e5745679cd8990a08dcf010a94352041c3732b
Instruction Fuzzy Hash: FB41E972B0D7514BC3158E79888025EBBE25BC5224F19CA3EE8F987382D678C945D792

Function 008A7268 Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

AuthenticAMD, xrefs: 008A732C

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID: AuthenticAMD
API String ID: 0-1824591176
Opcode ID: b8d81cf411ef0b648b14e1905530b407bd95ee0eab54fbd126a253c43aeded5f
Instruction ID: 1d04003e3008eeb2d7c041268a69a6d91d0299e084b651a4bb0684f9188cb22d
Opcode Fuzzy Hash: b8d81cf411ef0b648b14e1905530b407bd95ee0eab54fbd126a253c43aeded5f
Instruction Fuzzy Hash: 934191B1608A06ABE704DF58C841398F7A1FF89300F55C629E918C7B42D778E911EB81

Function 007B7C30 Relevance: .7, Instructions: 717COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c09111de50a095d1ec12d6c5143f52d37e81d3701cf87b2987d49250879b985
Instruction ID: 3585f27532ecaa8fe0f66d163f1307988d3bd7ad2a4c65b93ce041c097e7cf58
Opcode Fuzzy Hash: 1c09111de50a095d1ec12d6c5143f52d37e81d3701cf87b2987d49250879b985
Instruction Fuzzy Hash: B5725AB0609B818ED365CF3C8845797BFE5AB5A324F144A6DE0EE873D2C7756001CB66

Function 00792B30 Relevance: .7, Instructions: 692COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7f53491d8d61118d73d195215c756c99126e7ecee935eb747da5753871f91b3
Instruction ID: 161ffcfbe4f3a1e394abf08295c4160452b728f79d1952f6ac4e3132fcdc9a65
Opcode Fuzzy Hash: d7f53491d8d61118d73d195215c756c99126e7ecee935eb747da5753871f91b3
Instruction Fuzzy Hash: 2E52D3715087519FCF14CF28D0D06AAB7E2FF88314F1986ADE8899B24BD738E945CB81

Function 007CDDF0 Relevance: .7, Instructions: 667COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16599b7a5a8889f8c609bfb049c2cd2ea9b9c1b4d0a12d5e129e83fdc7f9c997
Instruction ID: 515d5e56213f427b0a7984f1a5a7d91870725e9ea240ee799e352b427331765e
Opcode Fuzzy Hash: 16599b7a5a8889f8c609bfb049c2cd2ea9b9c1b4d0a12d5e129e83fdc7f9c997
Instruction Fuzzy Hash: CF6216B0615B819FC369CF39C8417A3BFE9AB9A300F14896EE0EAC7752C735A541CB51

Function 007994E0 Relevance: .7, Instructions: 665COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e71b22472ef023d2421b63056abee6f70116adade2d08409bfad1020a919d524
Instruction ID: 19a8783434af410d361c66188de107c0c0b109e02f8e1a58ab6c20ff959f5089
Opcode Fuzzy Hash: e71b22472ef023d2421b63056abee6f70116adade2d08409bfad1020a919d524
Instruction Fuzzy Hash: D352D3B0A08B849FFF35DB28D4847A7BBE1EB91314F14482DC6EB06686D37DA985C711

Function 0079A2B0 Relevance: .6, Instructions: 625COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11d80690fdf4259830faab5a39099e092580fc7f4cabb8d45c9c9d2413e05e55
Instruction ID: 8eb2576f6b3c40b826259129ced308e043b0d73749c0dd8eb0d6f6cfec804509
Opcode Fuzzy Hash: 11d80690fdf4259830faab5a39099e092580fc7f4cabb8d45c9c9d2413e05e55
Instruction Fuzzy Hash: 7522E635A093119BCB25DF18E9816BBB3E1FFD4315F19892DD9C687281E738A851CB83

Function 00793560 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73c66f0b5b8dd4a64d91c8de594cef1c4e7ad240ed3c470437466cbf8add6c77
Instruction ID: ce334fd8d1ea9d00c41d27f1b644022443c511d0bc86e8dd38a06872f3826499
Opcode Fuzzy Hash: 73c66f0b5b8dd4a64d91c8de594cef1c4e7ad240ed3c470437466cbf8add6c77
Instruction Fuzzy Hash: 113201B0514B108FCB68CF29D69052ABBF2FF45710B604A2ED6A787B91D73AF944CB10

Function 007D6F50 Relevance: .5, Instructions: 530COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01faea197d265599e55a7e061e6792f5d8b7687ec804ff1040c3321f783e5ba3
Instruction ID: 6c77ce14c3ad0a2e95093c7b5cfc3c8348652a03334d755918208c87bd360713
Opcode Fuzzy Hash: 01faea197d265599e55a7e061e6792f5d8b7687ec804ff1040c3321f783e5ba3
Instruction Fuzzy Hash: BFE149766087108BD318DB298C8056BF7B2ABC5334F19872EE9A9573D1EA79EC01C7D1

Function 007DD8C0 Relevance: .5, Instructions: 526COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88f41d0fb63670bc0ee43073e6411494e60f3f6230ab523996cd7770f3b2b1d6
Instruction ID: ec55c8a59ec72b622ad5d414296dadbe2c7a5e9dba61730957506e5e694b90b9
Opcode Fuzzy Hash: 88f41d0fb63670bc0ee43073e6411494e60f3f6230ab523996cd7770f3b2b1d6
Instruction Fuzzy Hash: CCF1F3366493508FC318CF38D4D066ABBF2ABCA304F19C9ADE4998B355DA38DD05CB56

Function 008C7AC8 Relevance: .5, Instructions: 521COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8aebe3345a2fca42dbd08b3227348af352de68b85bae5146a1254b775f697bd
Instruction ID: df52db5107c4e558ebf5a63ba7f5f777c803092028499b724ad1144f7d4147e7
Opcode Fuzzy Hash: d8aebe3345a2fca42dbd08b3227348af352de68b85bae5146a1254b775f697bd
Instruction Fuzzy Hash: 34221775A44209AFEB04DF68C985FAEB7B6FF88700F148069F904EB281D674ED51CB61

Function 007DD840 Relevance: .5, Instructions: 515COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20a0791e41e3cb29a59acca13eb35bd5dbe159e4174624b06575f29e4f34ca28
Instruction ID: 63e67197f510d1b8e7208cb49bbf9241e2d138d905165349d2c775197114f750
Opcode Fuzzy Hash: 20a0791e41e3cb29a59acca13eb35bd5dbe159e4174624b06575f29e4f34ca28
Instruction Fuzzy Hash: D1F1E236649250CFC318CF38D8D066AB7F2EBCA314F19C9AED4898B365DA38D805CB55

Function 007A3D00 Relevance: .5, Instructions: 462COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8271c2c771bbdee8b9bb0fb383d57ff12b25db07a300e67c9f54e12140ada8c
Instruction ID: 86f52f1dd23254a217d579480ce98c3c109873eedd29620e852dd7c4daf65ff5
Opcode Fuzzy Hash: c8271c2c771bbdee8b9bb0fb383d57ff12b25db07a300e67c9f54e12140ada8c
Instruction Fuzzy Hash: 2012C0F1905B40AFD3A0CF3AC842797BEE9EB4A360F14491EF5AEC3241D63564458BA6

Function 00885C28 Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bc248819c19de741cd7e0f3a37a8d5ec16496fa13b0612be93dde39cb6a8752
Instruction ID: 64da2f3a6096be0d76df7f5d3d732f52508f563bf84152e18944465358a1e79f
Opcode Fuzzy Hash: 6bc248819c19de741cd7e0f3a37a8d5ec16496fa13b0612be93dde39cb6a8752
Instruction Fuzzy Hash: 0EE15B74A04609DFCB10EFA8C98599EF7F6FF48300B2186A5E915E7362DA34ED41CB51

Function 00798AF0 Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9904ee772999ff48cd9e0b982b1bd68593656c01807115957e37071e01b2c2e4
Instruction ID: 1438bf6a803ef1fad0e271f467d67655444865d5125625eaa62bbc32f2b5c7f7
Opcode Fuzzy Hash: 9904ee772999ff48cd9e0b982b1bd68593656c01807115957e37071e01b2c2e4
Instruction Fuzzy Hash: C8E18A712083458FCB25DF29D880A6BBBE2EFA9300F444C2DF5D987752E635E944CB92

Function 007B5800 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 852bc59903f7cd43c23497ad2c8cb782c34d8365f25f5a6d2ff17146634dd37f
Instruction ID: d8fbc46422edbf0d6c0eedb827977ab0304e44e3e399f2215b8b3400bc17b02f
Opcode Fuzzy Hash: 852bc59903f7cd43c23497ad2c8cb782c34d8365f25f5a6d2ff17146634dd37f
Instruction Fuzzy Hash: 90A13D726086514FC716CE28C8903AEBBD2AB85314F1DC67DE8E99B382D638D906D7D1

Function 02F138E8 Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1306676816.0000000002F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f10000_nogtpjadthaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5fe37659a099806082af087c6a2e7a793a8889fe07e524303ba76adf2d46b13
Instruction ID: 3345e3341918b4229adde383054d5a903235ea861276e414b58b248bc68d5589
Opcode Fuzzy Hash: f5fe37659a099806082af087c6a2e7a793a8889fe07e524303ba76adf2d46b13
Instruction Fuzzy Hash: F4A11B6644E3C58FC7138B744DA11A17FB5AE0326836E41DBC5C2CF8B3D21A595ECB62

Function 0087682C Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dce3a567dcb808c6166066a128f362f76289d549f70b881eafd995fbb7b818e
Instruction ID: 1576aa34fc85d9fca8a159ee47416ad5723416c44935f2b7368c451f85419008
Opcode Fuzzy Hash: 5dce3a567dcb808c6166066a128f362f76289d549f70b881eafd995fbb7b818e
Instruction Fuzzy Hash: E7B16E30A00604DFCB16DB68C995AADB7F1FF59300F6580A1E448EB365EB34EE50DB51

Function 007CFFF0 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac1e9278cb93e7961da154a96406555c9874feea06dfedde45e316b0cec1005d
Instruction ID: 6f5ae8ddcd95a7424f1b31a988a4f4a5e0415a4e253155f7d0289b10f17dbf74
Opcode Fuzzy Hash: ac1e9278cb93e7961da154a96406555c9874feea06dfedde45e316b0cec1005d
Instruction Fuzzy Hash: F2910937B066904BC7188D7C4C913A9AA636BDA330B3DD36AD9759B3D5C97A5C0283A0

Function 0083D97C Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6926797d3e96c6c922e2ab4f6ab8c73af69913f527a63999245fe98107180ef0
Instruction ID: 53068f7b41c39d9ed7f93a19abd3c518a3ad82337a9b5795760481a6fa09c8fd
Opcode Fuzzy Hash: 6926797d3e96c6c922e2ab4f6ab8c73af69913f527a63999245fe98107180ef0
Instruction Fuzzy Hash: EB916B71E043198FDB00DF98E981AAEBBB5FB88320F114529E815F7391C674AD46CBE1

Function 0085ABB0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50188f200807cdaeb30c96c175b92de42c02f6e560b356d8f857f8bba49f3a39
Instruction ID: fb9c4662c8801eef26698d8acdc2687f26e4ec3ab3956c3bb7b68c06f54d2ce7
Opcode Fuzzy Hash: 50188f200807cdaeb30c96c175b92de42c02f6e560b356d8f857f8bba49f3a39
Instruction Fuzzy Hash: EE81E731A00108AFDB08DFADD9C1E9EB3FAFF44301F2081A5E904DB266DA71EE459B55

Function 007D5270 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 227f60fc927f7177e3bc2fb7a67050f42556147566bd878097e3398af3844dcf
Instruction ID: f4357240ebcca7bc8e3b8b678cce17940c0292c695a62de39823f8d5e0f2039b
Opcode Fuzzy Hash: 227f60fc927f7177e3bc2fb7a67050f42556147566bd878097e3398af3844dcf
Instruction Fuzzy Hash: 42515DB15087548FE314DF29D89435BBBE1BBC8358F444A2EE4E987351E379DA088B82

Function 008A5AC8 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: facd014c2e33ab1fc63555eefe9942f80009d27f05babb70f28f1008a15450a3
Instruction ID: e05530ecef14c07ea31449148a8466725942d09140c0631c39a1c106ac65c8ec
Opcode Fuzzy Hash: facd014c2e33ab1fc63555eefe9942f80009d27f05babb70f28f1008a15450a3
Instruction Fuzzy Hash: 8161921921417682DB24AFADD18426177A1FFA8B00B1056E6DC6ADF63FF370C8D1C7A9

Function 008A5D94 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7660f5dda2f10b892d2d747a254a3f2e5269969d0f4098e580ff3e5d3b618b7e
Instruction ID: dc3f0798b16218823f5bf773ba24459683ffbb0ce2681211e68bf19699fb572c
Opcode Fuzzy Hash: 7660f5dda2f10b892d2d747a254a3f2e5269969d0f4098e580ff3e5d3b618b7e
Instruction Fuzzy Hash: 2541EC6C101A47DAC310AF64C4415E6F7B1FFA9710740C625E9A9D7B24F334E8A6CBA5

Function 008A5F24 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99592dd2673f2bfa13e198a76fea079bbb98715a8f887e9f9cedd6e93f9b3fb4
Instruction ID: 3f882fcc120a788a2917d38c573f943ad275a17f0c241c455ce8bd67c9085d43
Opcode Fuzzy Hash: 99592dd2673f2bfa13e198a76fea079bbb98715a8f887e9f9cedd6e93f9b3fb4
Instruction Fuzzy Hash: 7841FC6C100A47DAC310AF64C4416E6F7B1FFA9710B40C625E8BDD7B24F334A8A5CBA5

Function 02F17F4A Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1306676816.0000000002F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f10000_nogtpjadthaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3529338aa80b900f968e71c7e1394a8ed7b3d2dbaaefa95220502ed2180fc2ab
Instruction ID: 42c76929eb2372f4740efe68096f20800242f022f681c90c03776fe3a98e1518
Opcode Fuzzy Hash: 3529338aa80b900f968e71c7e1394a8ed7b3d2dbaaefa95220502ed2180fc2ab
Instruction Fuzzy Hash: 9411D072742100FFEB05AB89CC98FAA77B9EB957D1F1541A5FD0ADB281D33198009FA0

Function 02F17C78 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1306676816.0000000002F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f10000_nogtpjadthaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1278102fc57a74dddaa697d13edb9c1f088bbd92efa61ff6b7009e3050cd82b
Instruction ID: 2718f15b9b30dd261cb9b25553a7b1ccd1fa25c856f4e646eecebe0171a6896c
Opcode Fuzzy Hash: f1278102fc57a74dddaa697d13edb9c1f088bbd92efa61ff6b7009e3050cd82b
Instruction Fuzzy Hash: 3F11C272742210EFE7146B1ADC18F6B7BB8DB95BD1F054069F90ADB392C67198009EA0

Function 02F14FD7 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1306676816.0000000002F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f10000_nogtpjadthaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 293d3667edd61fd6912bc231452145773eea827c6fd9419a239f29444615286a
Instruction ID: 35f97b407097fb37f271ffc21fb4f24e3e1de37aa821cf2407e4f7af73121b8f
Opcode Fuzzy Hash: 293d3667edd61fd6912bc231452145773eea827c6fd9419a239f29444615286a
Instruction Fuzzy Hash: 3C115A3649C2D19FCB97CF7484A5183BFB6AE4B2083AB60DEC4C14F423C2639446CB41

Function 00792800 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a669614b251a71a3be99bad3ff6ad9f3dc4009420f19a32a7b34a5be78e14eb6
Instruction ID: 7eae22ed57b87ff5fac4edf88ca71b1cd44a447b0066df3513aef253dbe48b6f
Opcode Fuzzy Hash: a669614b251a71a3be99bad3ff6ad9f3dc4009420f19a32a7b34a5be78e14eb6
Instruction Fuzzy Hash: 56F02E3672625A1BAB10EDAAFCC0D7BB395D7CD754B14413DE585D3202D479E80392D4

Function 007AB3A0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 699039870cb33442d1a4fa21481bbe1e7a2f0d085c6e2806cd73b173b10ae215
Instruction ID: b4a20614a495ea931ef139da42631149ceb63729361491b80045f5ee7a58e2ad
Opcode Fuzzy Hash: 699039870cb33442d1a4fa21481bbe1e7a2f0d085c6e2806cd73b173b10ae215
Instruction Fuzzy Hash: D9E0C266B056610BAB18CD7548A01B7B7E59AC7222B1CA56DD492D3209D22CC8055294

Function 0084D278 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

GetMonitorInfoA.USER32(?,?), ref: 0084D2A9
GetSystemMetrics.USER32(00000000), ref: 0084D2E5
GetSystemMetrics.USER32(00000001), ref: 0084D2F0

Strings

DISPLAY, xrefs: 0084D311
GetMonitorInfo, xrefs: 0084D290

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: MetricsSystem$InfoMonitor
String ID: DISPLAY$GetMonitorInfo
API String ID: 4250584380-1633989206
Opcode ID: fa7ee41123c21f653eb1805be1494b9d45bad7e3e6a1edef8c2edd0550ad16f7
Instruction ID: 4cb3be00cf291fb1594f008078c15d220787b23226c09328001a6104d061d366
Opcode Fuzzy Hash: fa7ee41123c21f653eb1805be1494b9d45bad7e3e6a1edef8c2edd0550ad16f7
Instruction Fuzzy Hash: 5C11D035A157099FD720CFA58C44BB7B7E9FB49310F40452AFD4AD7351E6B0A8448FA2

Function 0084D4F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

EnumDisplayMonitors.USER32(?,?,?,?), ref: 0084D52D
GetSystemMetrics.USER32(00000000), ref: 0084D552
GetSystemMetrics.USER32(00000001), ref: 0084D55D

Strings

EnumDisplayMonitors, xrefs: 0084D50C

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: MetricsSystem$DisplayEnumMonitors
String ID: EnumDisplayMonitors
API String ID: 1389147845-2491903729
Opcode ID: 3154c301c5219cc70e632d7c7179e39e5933588a238003d6f77212bd8ec39a96
Instruction ID: eaf73d10178b0142a8a681a21a5b53815a2cd0e864938342dae1b50cdbc5bdbe
Opcode Fuzzy Hash: 3154c301c5219cc70e632d7c7179e39e5933588a238003d6f77212bd8ec39a96
Instruction Fuzzy Hash: 2B311972A0420DAFDB11DFA89985AFFB7BCEB49304F014126F915E3251EB34D9058FA1

Function 0084D34C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000000), ref: 0084D3B9
GetSystemMetrics.USER32(00000001), ref: 0084D3C4

Strings

GetMonitorInfoA, xrefs: 0084D364
DISPLAY, xrefs: 0084D3E5

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID: DISPLAY$GetMonitorInfoA
API String ID: 4116985748-1370492664
Opcode ID: 39c68652978fbd33d3f6f59641e49487cbba169874882eb3c2f3e66c28df0813
Instruction ID: a410eb81c7ddfda0a5feb6fc2a82cc96822e3396e898f37499c07ca69a1beaa9
Opcode Fuzzy Hash: 39c68652978fbd33d3f6f59641e49487cbba169874882eb3c2f3e66c28df0813
Instruction Fuzzy Hash: A411AC7261430C9FD7208F64DC48BABB7E9FB45310F00452EF946D7350E7B1A8048BA6

Function 0084D420 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000000), ref: 0084D48D
GetSystemMetrics.USER32(00000001), ref: 0084D498

Strings

DISPLAY, xrefs: 0084D4B9
GetMonitorInfoW, xrefs: 0084D438

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID: DISPLAY$GetMonitorInfoW
API String ID: 4116985748-2774842281
Opcode ID: c961d9cbbaa8695e74a52fc67a05d32f0d9d604cac334da895316e2eacbc63ae
Instruction ID: d93a0f8a9673fc3d83f047751eaae9e11e3d5592d7364aa7c84518ab14265ac8
Opcode Fuzzy Hash: c961d9cbbaa8695e74a52fc67a05d32f0d9d604cac334da895316e2eacbc63ae
Instruction Fuzzy Hash: 7611D031611708AFD720CFA49C447A7B7E8FF46B11F01452AFD4ADB290D7B0B8458BA9

Function 0084D1E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000000), ref: 0084D22E
GetSystemMetrics.USER32(00000001), ref: 0084D240

Strings

MonitorFromPoint, xrefs: 0084D1F2

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID: MonitorFromPoint
API String ID: 4116985748-1072306578
Opcode ID: 03eea1606ec52550b119d3545b93cc80d9943352b443b20b4e7641867d1eed92
Instruction ID: 056219343f973261b168174c6bc1824c508d61660bcd1720adda4a3c74bd6247
Opcode Fuzzy Hash: 03eea1606ec52550b119d3545b93cc80d9943352b443b20b4e7641867d1eed92
Instruction Fuzzy Hash: 53014F3130831CABDB004F94DD44B99BB55FB95764F508025F919DB261C2B1EC45DB61

Function 0084D0B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000000), ref: 0084D109
GetSystemMetrics.USER32(00000001), ref: 0084D115

Strings

MonitorFromRect, xrefs: 0084D0CD

Memory Dump Source

Source File: 00000000.00000002.1305208044.00000000007F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.1305188626.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.00000000007E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000936000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1305208044.0000000000956000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_nogtpjadthaw.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID: MonitorFromRect
API String ID: 4116985748-4033241945
Opcode ID: d50a202ddf05938f3b6f65ad9930afdbdae681ec03df2f11b8ae90226e818fe9
Instruction ID: 5a62d81a3de63a1ac5a25fa3f19955ab42f654119f0a088989f81787d40c2f02
Opcode Fuzzy Hash: d50a202ddf05938f3b6f65ad9930afdbdae681ec03df2f11b8ae90226e818fe9
Instruction Fuzzy Hash: F601AD3260820C9FEB108B18D989BA6F7A9F784315F548056FD06EB212D275DC409FA1

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report nogtpjadthaw.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

Windows Analysis Report
nogtpjadthaw.exe

Function 0079ED50 Relevance: 14.2, Strings: 11, Instructions: 483
COMMON

Function 0084A710 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52
filenativeCOMMON

Function 0084A634 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9
nativeCOMMON

Function 0084A6B8 Relevance: 1.5, APIs: 1, Instructions: 44
filenativeCOMMON

Function 0084A650 Relevance: 1.5, APIs: 1, Instructions: 26
filenativeCOMMON