Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe
Analysis ID:	1528524
MD5:	3e6101bd944eb0acda2b8ea1ada80afd
SHA1:	dfaa0ed4c74624298228c765d07eccee2b7b30b9
SHA256:	63ea83eadd460786f01cb7e24e9ffb24bd188f12e72087b8778b4a0867f5bedb
Tags:	exe
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file has nameless sections

Sample uses string decryption to hide its real strings

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe (PID: 4188 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe" MD5: 3E6101BD944EB0ACDA2B8EA1ADA80AFD)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["wickedneatr.sbs", "bemuzzeki.sbsv", "isoplethui.sbs", "ponintnykqwm.shop", "invinjurhey.sbs", "exemplarou.sbs", "exilepolsiy.sbs", "laddyirekyi.sbs", "frizzettei.sbs"], "Build id": "sEm--"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T00:40:28.916241+0200	2054653	1	A Network Trojan was detected	192.168.2.6	49711	172.67.206.204	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T00:40:28.916241+0200	2049836	1	A Network Trojan was detected	192.168.2.6	49711	172.67.206.204	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bemuzzeki .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T00:40:26.512172+0200	2056502	1	Domain Observed Used for C2 Detected	192.168.2.6	56812	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (exemplarou .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T00:40:26.498386+0200	2056510	1	Domain Observed Used for C2 Detected	192.168.2.6	52300	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (exilepolsiy .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T00:40:26.525238+0200	2056512	1	Domain Observed Used for C2 Detected	192.168.2.6	62016	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (frizzettei .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T00:40:26.471881+0200	2056514	1	Domain Observed Used for C2 Detected	192.168.2.6	57124	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (invinjurhey .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T00:40:26.553320+0200	2056516	1	Domain Observed Used for C2 Detected	192.168.2.6	54101	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (isoplethui .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T00:40:26.485375+0200	2056518	1	Domain Observed Used for C2 Detected	192.168.2.6	49299	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (laddyirekyi .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T00:40:26.539274+0200	2056520	1	Domain Observed Used for C2 Detected	192.168.2.6	55725	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (wickedneatr .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T00:40:26.567362+0200	2056524	1	Domain Observed Used for C2 Detected	192.168.2.6	49857	1.1.1.1	53	UDP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199724331900	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900/inventory/	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900/badges	URL Reputation: Label: malware

Found malware configuration

Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe.4188.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["wickedneatr.sbs", "bemuzzeki.sbsv", "isoplethui.sbs", "ponintnykqwm.shop", "invinjurhey.sbs", "exemplarou.sbs", "exilepolsiy.sbs", "laddyirekyi.sbs", "frizzettei.sbs"], "Build id": "sEm--"}

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe

ReversingLabs: Detection: 57%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: wickedneatr.sbs
Source: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: invinjurhey.sbs
Source: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: laddyirekyi.sbs
Source: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: exilepolsiy.sbs
Source: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: bemuzzeki.sbsv
Source: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: exemplarou.sbs
Source: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: isoplethui.sbs
Source: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: frizzettei.sbs
Source: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: ponintnykqwm.shop
Source: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: g392sM--

Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.6:49711 version: TLS 1.2

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe

Code function: 0_2_00290490 FindFirstFileW,

0_2_00290490

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_00244040
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 4x nop then mov ebp, eax	0_2_0020A300
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_002323E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_002323E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_002323E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_002323E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_002323E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 4x nop then mov eax, dword ptr [esi+14h]	0_2_002323E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi+25h]	0_2_00208590
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	0_2_002049A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	0_2_00206EA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 4x nop then jmp ecx	0_2_00208FD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 4x nop then mov ecx, dword ptr [edx]	0_2_00201000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 7789B0CBh	0_2_00247520
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	0_2_00247710
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	0_2_00205A50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+00h]	0_2_0020BEB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	0_2_00247FC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00247FC0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056514 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (frizzettei .sbs) : 192.168.2.6:57124 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056524 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (wickedneatr .sbs) : 192.168.2.6:49857 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056512 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (exilepolsiy .sbs) : 192.168.2.6:62016 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056518 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (isoplethui .sbs) : 192.168.2.6:49299 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056520 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (laddyirekyi .sbs) : 192.168.2.6:55725 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056516 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (invinjurhey .sbs) : 192.168.2.6:54101 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056502 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bemuzzeki .sbs) : 192.168.2.6:56812 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056510 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (exemplarou .sbs) : 192.168.2.6:52300 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49711 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49711 -> 172.67.206.204:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: wickedneatr.sbs
Source: Malware configuration extractor	URLs: bemuzzeki.sbsv
Source: Malware configuration extractor	URLs: isoplethui.sbs
Source: Malware configuration extractor	URLs: ponintnykqwm.shop
Source: Malware configuration extractor	URLs: invinjurhey.sbs
Source: Malware configuration extractor	URLs: exemplarou.sbs
Source: Malware configuration extractor	URLs: exilepolsiy.sbs
Source: Malware configuration extractor	URLs: laddyirekyi.sbs
Source: Malware configuration extractor	URLs: frizzettei.sbs

Source: Joe Sandbox View	IP Address: 104.102.49.254 104.102.49.254
Source: Joe Sandbox View	IP Address: 172.67.206.204 172.67.206.204

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sergei-esenin.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: global traffic	DNS traffic detected: DNS query: ponintnykqwm.shop
Source: global traffic	DNS traffic detected: DNS query: frizzettei.sbs
Source: global traffic	DNS traffic detected: DNS query: isoplethui.sbs
Source: global traffic	DNS traffic detected: DNS query: exemplarou.sbs
Source: global traffic	DNS traffic detected: DNS query: bemuzzeki.sbs
Source: global traffic	DNS traffic detected: DNS query: exilepolsiy.sbs
Source: global traffic	DNS traffic detected: DNS query: laddyirekyi.sbs
Source: global traffic	DNS traffic detected: DNS query: invinjurhey.sbs
Source: global traffic	DNS traffic detected: DNS query: wickedneatr.sbs
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: sergei-esenin.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sergei-esenin.com

Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171686687.0000000000CD9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171686687.0000000000CD9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171686687.0000000000CD9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.enigmaprotector.com/
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.enigmaprotector.com/openU
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171686687.0000000000CD9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=10oP_O2R
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=cdfm
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=qu55UpguGheU&l=e
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000C38000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000C38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://invinjurhey.sbs/
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000C38000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000C38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://invinjurhey.sbs:443/api
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://laddyirekyi.sbs/api
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/B
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/Sw
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000C73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/api
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000C73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apiM1
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/cw
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000C38000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000C38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com:443/api
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171686687.0000000000CD9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171686687.0000000000CD9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000C38000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000C38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171686687.0000000000CD9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000C38000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000C38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wickedneatr.sbs:443/api
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.6:49711 version: TLS 1.2

System Summary

PE file has nameless sections

Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Static PE information: section name:
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Static PE information: section name:
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Static PE information: section name:
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Static PE information: section name:
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002B8634 NtClose,	0_2_002B8634
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002B8650 NtSetInformationFile,	0_2_002B8650
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002B86B8 NtReadFile,	0_2_002B86B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002B8710 NtCreateFile,	0_2_002B8710
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002B87F0 NtProtectVirtualMemory,	0_2_002B87F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002B8028 NtCreateKey,	0_2_002B8028
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002B8070 NtEnumerateKey,	0_2_002B8070
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002B80B0 NtSetValueKey,	0_2_002B80B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002B8180 NtNotifyChangeKey,	0_2_002B8180
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002B81E0 NtQueryMultipleValueKey,	0_2_002B81E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002B827C NtSetInformationKey,	0_2_002B827C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002B82E0 NtWriteFile,	0_2_002B82E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002B82C4 NtTerminateProcess,	0_2_002B82C4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002B8338 NtQueryObject,	0_2_002B8338
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002B836C NtQueryDirectoryFile,	0_2_002B836C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002B83F4 NtDuplicateObject,	0_2_002B83F4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002B843C NtQueryVolumeInformationFile,	0_2_002B843C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002B848C NtLockFile,	0_2_002B848C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002B84EC NtUnlockFile,	0_2_002B84EC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002B853C NtUnmapViewOfSection,	0_2_002B853C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002B8558 NtQuerySection,	0_2_002B8558
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002B858C NtMapViewOfSection,	0_2_002B858C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002B85EC NtCreateSection,	0_2_002B85EC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002B8684 NtQueryInformationFile,	0_2_002B8684
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002B8778 NtOpenFile,	0_2_002B8778
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002B7B50 NtDeviceIoControlFile,	0_2_002B7B50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002B7BB0 NtQueryInformationProcess,	0_2_002B7BB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002B7BE4 NtCreateThread,	0_2_002B7BE4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002B7C50 NtCreateProcess,	0_2_002B7C50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002B7CA0 NtCreateProcessEx,	0_2_002B7CA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002B7CF8 NtCreateUserProcess,	0_2_002B7CF8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002B7D60 NtOpenKeyEx,	0_2_002B7D60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002B7D8C NtSetVolumeInformationFile,	0_2_002B7D8C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002B7DE0 NtQuerySecurityObject,	0_2_002B7DE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002B7E14 NtNotifyChangeDirectoryFile,	0_2_002B7E14
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002B7E6C NtFsControlFile,	0_2_002B7E6C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002B7F04 NtAccessCheck,	0_2_002B7F04
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002B7F74 NtEnumerateValueKey,	0_2_002B7F74
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002B7F54 NtOpenKey,	0_2_002B7F54
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002B7FB4 NtQueryKey,	0_2_002B7FB4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002B7FE8 NtQueryValueKey,	0_2_002B7FE8

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe

Code function: 0_2_00316CA4: CreateFileA,DeviceIoControl,

0_2_00316CA4

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_00244040	0_2_00244040
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_0020E1A0	0_2_0020E1A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_00316264	0_2_00316264
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002382D0	0_2_002382D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_0020A300	0_2_0020A300
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002323E0	0_2_002323E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_0035E434	0_2_0035E434
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002364F0	0_2_002364F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_00208590	0_2_00208590
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_00316600	0_2_00316600
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002E482C	0_2_002E482C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_0036480C	0_2_0036480C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_0020A850	0_2_0020A850
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_0023E8A0	0_2_0023E8A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_003688C4	0_2_003688C4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002489A0	0_2_002489A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_00336A04	0_2_00336A04
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_00316A40	0_2_00316A40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_00248A80	0_2_00248A80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002C8BB0	0_2_002C8BB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_00370C38	0_2_00370C38
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002D2C0C	0_2_002D2C0C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_0036AD68	0_2_0036AD68
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_0035CE4C	0_2_0035CE4C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_0020AF10	0_2_0020AF10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_0034AFF0	0_2_0034AFF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002A0FF0	0_2_002A0FF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_00208FD0	0_2_00208FD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_00201000	0_2_00201000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_0036B01C	0_2_0036B01C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_0036705C	0_2_0036705C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_0036F048	0_2_0036F048
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_0036513C	0_2_0036513C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_00205160	0_2_00205160
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002071F0	0_2_002071F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002012F7	0_2_002012F7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_0020B3A0	0_2_0020B3A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002013A3	0_2_002013A3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_00331498	0_2_00331498
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002035B0	0_2_002035B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_0020164F	0_2_0020164F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002AB97C	0_2_002AB97C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_00351958	0_2_00351958
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_00339A18	0_2_00339A18
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_00247AB0	0_2_00247AB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_00313AC8	0_2_00313AC8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_00335AC8	0_2_00335AC8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_00207BF0	0_2_00207BF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002F3C28	0_2_002F3C28
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_00313D94	0_2_00313D94
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_0033DEB0	0_2_0033DEB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_0020BEB0	0_2_0020BEB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_00351E80	0_2_00351E80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_00313F24	0_2_00313F24
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_00339F48	0_2_00339F48
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_003CBF40	0_2_003CBF40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_00247FC0	0_2_00247FC0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe

Code function: String function: 00269D9C appears 123 times

Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Static PE information: Section: ZLIB complexity 0.999778891509434
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Static PE information: Section: ZLIB complexity 0.9959435096153846
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Static PE information: Section: .data ZLIB complexity 0.9971848574740863

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@11/2

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe

ReversingLabs: Detection: 57%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Section loaded: dpapi.dll	Jump to behavior

Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe

Static file information: File size 1281024 > 1048576

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe

Unpacked PE file: 0.2.SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe.200000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:EW;.data:EW;

Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Static PE information: section name:
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Static PE information: section name:
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Static PE information: section name:
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Static PE information: section name:
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_003059C4 push 00305A51h; ret	0_2_00305A49
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_00274054 push 00274080h; ret	0_2_00274078
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002A80BC push 002A80E8h; ret	0_2_002A80E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_003100FC push 00310134h; ret	0_2_0031012C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002A80F4 push 002A8120h; ret	0_2_002A8118
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_0028A12C push 0028A1D7h; ret	0_2_0028A1CF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_00348124 push 00348150h; ret	0_2_00348148
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002EE160 push 002EE18Ch; ret	0_2_002EE184
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002E0194 push 002E01C0h; ret	0_2_002E01B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002AC194 push 002AC1CCh; ret	0_2_002AC1C4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_0028A1DC push 0028A26Ch; ret	0_2_0028A264
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002CC290 push 002CC2C3h; ret	0_2_002CC2BB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002CC2F0 push 002CC31Ch; ret	0_2_002CC314
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002CC33C push 002CC388h; ret	0_2_002CC380
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_0034A348 push 0034A394h; ret	0_2_0034A38C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_0027C3A0 push 0027C400h; ret	0_2_0027C3F8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_0034A3A0 push 0034A3CCh; ret	0_2_0034A3C4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_00314394 push 003143C0h; ret	0_2_003143B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002CC394 push 002CC3DFh; ret	0_2_002CC3D7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_00342388 push 0034243Ch; ret	0_2_00342434
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_0036441C push 0036445Ah; ret	0_2_00364452
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_0030E47C push 0030E4C8h; ret	0_2_0030E4C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002CA578 push ecx; mov dword ptr [esp], ecx	0_2_002CA57D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_0027C578 push 0027C5A4h; ret	0_2_0027C59C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_002EC55C push 002EC5B6h; ret	0_2_002EC5AE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_003D0548 push 003D057Bh; ret	0_2_003D0573
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_0028E5C4 push 0028E5F0h; ret	0_2_0028E5E8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_0027A62C push 0027A6A2h; ret	0_2_0027A69A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_0027C664 push ecx; mov dword ptr [esp], ecx	0_2_0027C667
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_0027A6A4 push 0027A74Ch; ret	0_2_0027A744
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Code function: 0_2_0027C684 push ecx; mov dword ptr [esp], ecx	0_2_0027C687

Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Static PE information: section name: entropy: 7.998539516041993
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Static PE information: section name: entropy: 7.715240043082984
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Static PE information: section name: entropy: 7.979386559598038
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Static PE information: section name: entropy: 7.834037673407767
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Static PE information: section name: .data entropy: 7.985314766441003

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe TID: 2936	Thread sleep count: 209 > 30			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe TID: 2616	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe

Code function: 0_2_00290490 FindFirstFileW,

0_2_00290490

Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VBoxService.exe
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: ~VirtualMachineTypes
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000C73000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWr
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: ]DLL_Loader_VirtualMachine
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000C73000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VMWare
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: DLL_Loader_Marker]DLL_Loader_VirtualMachineZDLL_Loader_Reloc_Unit
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: &VBoxService.exe

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe

Thread information set: HideFromDebugger

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe

Code function: 0_2_00245BB0 LdrInitializeThunk,

0_2_00245BB0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe

Code function: 0_2_02998B0C mov eax, dword ptr fs:[00000030h]

0_2_02998B0C

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	String found in binary or memory: wickedneatr.sbs
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	String found in binary or memory: invinjurhey.sbs
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	String found in binary or memory: laddyirekyi.sbs
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	String found in binary or memory: exilepolsiy.sbs
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	String found in binary or memory: bemuzzeki.sbsv
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	String found in binary or memory: exemplarou.sbs
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	String found in binary or memory: isoplethui.sbs
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	String found in binary or memory: frizzettei.sbs
Source: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	String found in binary or memory: ponintnykqwm.shop

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe

Code function: 0_2_00315268 cpuid

0_2_00315268

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe

Code function: RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,GetLocaleInfoA,

0_2_003C7208

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe

Code function: 0_2_002B6CC0 GetTimeZoneInformation,

0_2_002B6CC0

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 PowerShell	1 DLL Side-Loading	1 DLL Side-Loading	11 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	11 Deobfuscate/Decode Files or Information	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	4 Obfuscated Files or Information	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	21 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	58%	ReversingLabs	Win32.Trojan.LummaStealer
SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	100%	Avira	HEUR/AGEN.1314134
SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	0%	URL Reputation	safe
https://help.steampowered.com/en/	0%	URL Reputation	safe
https://store.steampowered.com/news/	0%	URL Reputation	safe
https://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
http://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en	0%	URL Reputation	safe
http://www.valvesoftware.com/legal.htm	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	0%	URL Reputation	safe
https://store.steampowered.com/stats/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	0%	URL Reputation	safe
https://store.steampowered.com/steam_refunds/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	0%	URL Reputation	safe
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	0%	URL Reputation	safe
https://store.steampowered.com/legal/	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900	100%	URL Reputation	malware
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl	0%	URL Reputation	safe
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://store.steampowered.com/points/shop/	0%	URL Reputation	safe
https://store.steampowered.com/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900/inventory/	100%	URL Reputation	malware
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	0%	URL Reputation	safe
https://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	0%	URL Reputation	safe
http://store.steampowered.com/account/cookiepreferences/	0%	URL Reputation	safe
https://store.steampowered.com/mobile	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl	0%	URL Reputation	safe
https://store.steampowered.com/about/	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900/badges	100%	URL Reputation	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	104.102.49.254	true	false	unknown
sergei-esenin.com	172.67.206.204	true	true	unknown
frizzettei.sbs	unknown	unknown	true	unknown
laddyirekyi.sbs	unknown	unknown	true	unknown
wickedneatr.sbs	unknown	unknown	true	unknown
ponintnykqwm.shop	unknown	unknown	true	unknown
bemuzzeki.sbs	unknown	unknown	true	unknown
invinjurhey.sbs	unknown	unknown	true	unknown
isoplethui.sbs	unknown	unknown	true	unknown
exilepolsiy.sbs	unknown	unknown	true	unknown
exemplarou.sbs	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
frizzettei.sbs	true		unknown
laddyirekyi.sbs	true		unknown
isoplethui.sbs	true		unknown
https://steamcommunity.com/profiles/76561199724331900	true	URL Reputation: malware	unknown
invinjurhey.sbs	true		unknown
exilepolsiy.sbs	true		unknown
ponintnykqwm.shop	true		unknown
exemplarou.sbs	true		unknown
bemuzzeki.sbsv	true		unknown
wickedneatr.sbs	true		unknown
https://sergei-esenin.com/api	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://steamcommunity.com/my/wishlist/	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=cdfm	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/?subsection=broadcasts	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://help.steampowered.com/en/	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/market/	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/news/	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.enigmaprotector.com/openU	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://sergei-esenin.com/	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com/B	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/subscriber_agreement/	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/subscriber_agreement/	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171686687.0000000000CD9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171686687.0000000000CD9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.valvesoftware.com/legal.htm	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://invinjurhey.sbs:443/api	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000C38000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000C38000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/discussions/	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/stats/	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171686687.0000000000CD9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/steam_refunds/	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/workshop/	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/legal/	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171686687.0000000000CD9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=qu55UpguGheU&l=e	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com/apiM1	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000C73000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/privacy_agreement/	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171686687.0000000000CD9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com:443/profiles/76561199724331900	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000C38000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000C38000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/points/shop/	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199724331900/inventory/	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171686687.0000000000CD9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/privacy_agreement/	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sergei-esenin.com:443/api	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000C38000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000C38000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=10oP_O2R	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://wickedneatr.sbs:443/api	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000C38000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000C38000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://invinjurhey.sbs/	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000C38000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000C38000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://laddyirekyi.sbs/api	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com/cw	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/account/cookiepreferences/	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171686687.0000000000CD9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/mobile	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://avatars.akamai.steamstatic	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.enigmaprotector.com/	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/about/	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sergei-esenin.com/Sw	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/profiles/76561199724331900/badges	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000002.2171547106.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165817669.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe, 00000000.00000003.2165786831.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.102.49.254	steamcommunity.com	United States		16625	AKAMAI-ASUS	false
172.67.206.204	sergei-esenin.com	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528524
Start date and time:	2024-10-08 00:39:33 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@11/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 64% Number of executed functions: 13 Number of non-executed functions: 106
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, otelrules.azureedge.net
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe

Simulations

Behavior and APIs

Time	Type	Description
18:40:25	API Interceptor	3x Sleep call for process: SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm
172.67.206.204	9Y6R8fs0wd.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	PFW1cgN8EK.exe	Get hash	malicious	LummaC	Browse
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse
	SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	CatalogApp.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	xwZfYpo16i.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse
	file.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
sergei-esenin.com	9Y6R8fs0wd.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	PFW1cgN8EK.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.53.8
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.206.204
	SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	CSY6k9gpVb.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
steamcommunity.com	9Y6R8fs0wd.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	PFW1cgN8EK.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	utmggBCMML.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Get hash	malicious	LummaC	Browse	92.122.104.90

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	9Y6R8fs0wd.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	RemittanceDetails(Rjackson)CQDM.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	PFW1cgN8EK.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	https://url.avanan.click/v2/r01/___https://www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.ht.zpdzwq?v=frudxdBjlfmjfqymhfwj.ht.pjd.kwjsy___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzpiNGZlZGFhNjcxOTBhYjU4MTE5MjBlZTRiYTAxZmUwMTo3OmIxYWM6MDg1ODNlNjljZDkwNThkM2ZiM2RjYTI4MzFjZGY4NGFmMTYyZTlhYmVjYWYxY2Q4MmNkZDhiNmFmOWVkOWUxOTpoOlQ6VA#Sm9hbi5LbmlwcGVuQEVsa2F5LkNvbQ==	Get hash	malicious	Unknown	Browse	188.114.96.3
	EUYIlr7uUX.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.65.255.143
	SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.53.8
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.206.204
AKAMAI-ASUS	9Y6R8fs0wd.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	PFW1cgN8EK.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	utmggBCMML.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	https://www.dropbox.com/scl/fi/qo6796ed7hlrt0v8k9nr6/Patagonia-Health-Barcode-Scanner-Setup-2024.exe?rlkey=5bmndvx8124ztopqewiogbnlt&st=yvxpokhf&dl=0	Get hash	malicious	Unknown	Browse	184.28.90.27
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	bCnarg2O62.exe	Get hash	malicious	SmokeLoader	Browse	104.102.49.254 172.67.206.204
	9Y6R8fs0wd.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	PFW1cgN8EK.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	utmggBCMML.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254 172.67.206.204
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.990843584052559
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe
File size:	1'281'024 bytes
MD5:	3e6101bd944eb0acda2b8ea1ada80afd
SHA1:	dfaa0ed4c74624298228c765d07eccee2b7b30b9
SHA256:	63ea83eadd460786f01cb7e24e9ffb24bd188f12e72087b8778b4a0867f5bedb
SHA512:	509ae62a07d7ac28bc85d7dd19199a87c4845fec7b078237479f8270e5f9972f08ab44e3afe40fbc39f9ee0d43d368c0a127bad3ff94bb42c8fd16f655308230
SSDEEP:	24576:jtZ0l1U2Ieb4D6AfNiAUeJB/ydJvj0TKPySsTiQt:jGPIeEDfNVU/dJvj0WjL
TLSH:	C855339856C7A4DFC0ACE27D483A07AD8D8199D0F622811EC4344698EB53DCFF9C77A6
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...J..f..........................................@...........................<...........@................................. .....

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4081d5
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66FFF14A [Fri Oct 4 13:44:42 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	71cc5af9daad65e58c6f29c42cdf9201

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 00401000h
call 00007F8B54FDBF96h
call far 5DE5h : 8B10C483h
jmp 00007F8B55399930h
aad 19h
loop 00007F8B54FDBF4Eh
rol byte ptr [edx+7297DACFh], FFFFFFF4h
inc eax
retf A40Eh
push F59C0E35h
sbb byte ptr [ebx-79D2A22Bh], FFFFFFBBh
jnl 00007F8B54FDBF73h
aas
mov dword ptr [ebp+66h], esp
out 7Bh, eax
int 5Ch
bound esp, dword ptr [edi+13h]
cmp dword ptr [edx], ecx
wait
cmc
sub edx, esi
inc edi
mov dword ptr [08ECB0B0h], eax
pop es
jc 00007F8B54FDBF9Bh
push ebp
mov dword ptr [9CD0A6B5h], eax
and ebx, dword ptr [esi]
mov bl, B0h
stc
pop esp
std
leave
loope 00007F8B54FDBF91h
pop es
push 3219638Ch
jno 00007F8B54FDBFC0h
shl ch, cl
pop esp
hlt
add edi, dword ptr [edx-7E04780Ch]
jne 00007F8B54FDBFB7h
pushad
popfd
dec esi
fisttp qword ptr [eax]
xor ch, byte ptr [eax+228089D5h]
sbb ch, byte ptr [eax-31h]
adc eax, 4A46289Ah

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e2020	0x214	.data
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2e2000	0xc	.data
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x4a000	0x21200	f2c1782ca9d218686419a85a1a6ab7ec	False	0.999778891509434	data	7.998539516041993	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x4b000	0x3000	0x1200	bc3beed8ec571d981c2a6e5d2a3a0e96	False	0.9348958333333334	OpenPGP Public Key	7.715240043082984	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x4e000	0x10000	0x3400	69bda957f323f3d7aeb46cedeeaead5c	False	0.9959435096153846	data	7.979386559598038	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x5e000	0x5000	0x2400	5e1066b96348efbbc9eaf9aae952a065	False	0.9521484375	data	7.834037673407767	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x63000	0x27f000	0x2ba00	1b26749daae6d17db8e5a2e685d6f293	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.data	0x2e2000	0xe6000	0xe5200	2cf0c551c78f9bfd2ac081bd77860681	False	0.9971848574740863	MacBinary, char. code 0x2e, Mon Feb 6 07:28:16 2040 INVALID date, modified Mon Feb 6 07:28:16 2040, creator ' .', type ' !.', 3678510 bytes "." , at 0x3821ae 15736878 bytes resource dBase III DBT, version number 0, next free block index 3023220, 1st item "\365\263\021\325Pr\330\241\372\017p\031&\240\332\370\331;"	7.985314766441003	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	GetModuleHandleA, GetProcAddress, ExitProcess, LoadLibraryA
user32.dll	MessageBoxA
advapi32.dll	RegCloseKey
oleaut32.dll	SysFreeString
gdi32.dll	CreateFontA
shell32.dll	ShellExecuteA
version.dll	GetFileVersionInfoA
ole32.dll	CoCreateInstance

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-08T00:40:26.471881+0200	2056514	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (frizzettei .sbs)	1	192.168.2.6	57124	1.1.1.1	53	UDP
2024-10-08T00:40:26.485375+0200	2056518	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (isoplethui .sbs)	1	192.168.2.6	49299	1.1.1.1	53	UDP
2024-10-08T00:40:26.498386+0200	2056510	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (exemplarou .sbs)	1	192.168.2.6	52300	1.1.1.1	53	UDP
2024-10-08T00:40:26.512172+0200	2056502	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bemuzzeki .sbs)	1	192.168.2.6	56812	1.1.1.1	53	UDP
2024-10-08T00:40:26.525238+0200	2056512	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (exilepolsiy .sbs)	1	192.168.2.6	62016	1.1.1.1	53	UDP
2024-10-08T00:40:26.539274+0200	2056520	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (laddyirekyi .sbs)	1	192.168.2.6	55725	1.1.1.1	53	UDP
2024-10-08T00:40:26.553320+0200	2056516	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (invinjurhey .sbs)	1	192.168.2.6	54101	1.1.1.1	53	UDP
2024-10-08T00:40:26.567362+0200	2056524	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (wickedneatr .sbs)	1	192.168.2.6	49857	1.1.1.1	53	UDP
2024-10-08T00:40:28.916241+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49711	172.67.206.204	443	TCP
2024-10-08T00:40:28.916241+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49711	172.67.206.204	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 00:40:26.595096111 CEST	49710	443	192.168.2.6	104.102.49.254
Oct 8, 2024 00:40:26.595148087 CEST	443	49710	104.102.49.254	192.168.2.6
Oct 8, 2024 00:40:26.595217943 CEST	49710	443	192.168.2.6	104.102.49.254
Oct 8, 2024 00:40:26.621205091 CEST	49710	443	192.168.2.6	104.102.49.254
Oct 8, 2024 00:40:26.621226072 CEST	443	49710	104.102.49.254	192.168.2.6
Oct 8, 2024 00:40:27.319910049 CEST	443	49710	104.102.49.254	192.168.2.6
Oct 8, 2024 00:40:27.320255041 CEST	49710	443	192.168.2.6	104.102.49.254
Oct 8, 2024 00:40:27.328519106 CEST	49710	443	192.168.2.6	104.102.49.254
Oct 8, 2024 00:40:27.328531981 CEST	443	49710	104.102.49.254	192.168.2.6
Oct 8, 2024 00:40:27.328820944 CEST	443	49710	104.102.49.254	192.168.2.6
Oct 8, 2024 00:40:27.371946096 CEST	49710	443	192.168.2.6	104.102.49.254
Oct 8, 2024 00:40:27.426907063 CEST	49710	443	192.168.2.6	104.102.49.254
Oct 8, 2024 00:40:27.467407942 CEST	443	49710	104.102.49.254	192.168.2.6
Oct 8, 2024 00:40:27.852827072 CEST	443	49710	104.102.49.254	192.168.2.6
Oct 8, 2024 00:40:27.852848053 CEST	443	49710	104.102.49.254	192.168.2.6
Oct 8, 2024 00:40:27.852889061 CEST	443	49710	104.102.49.254	192.168.2.6
Oct 8, 2024 00:40:27.852901936 CEST	443	49710	104.102.49.254	192.168.2.6
Oct 8, 2024 00:40:27.852947950 CEST	443	49710	104.102.49.254	192.168.2.6
Oct 8, 2024 00:40:27.853137016 CEST	49710	443	192.168.2.6	104.102.49.254
Oct 8, 2024 00:40:27.853137016 CEST	49710	443	192.168.2.6	104.102.49.254
Oct 8, 2024 00:40:27.853151083 CEST	443	49710	104.102.49.254	192.168.2.6
Oct 8, 2024 00:40:27.853265047 CEST	49710	443	192.168.2.6	104.102.49.254
Oct 8, 2024 00:40:27.940119028 CEST	443	49710	104.102.49.254	192.168.2.6
Oct 8, 2024 00:40:27.940129995 CEST	443	49710	104.102.49.254	192.168.2.6
Oct 8, 2024 00:40:27.940253973 CEST	49710	443	192.168.2.6	104.102.49.254
Oct 8, 2024 00:40:27.940268993 CEST	443	49710	104.102.49.254	192.168.2.6
Oct 8, 2024 00:40:27.940393925 CEST	49710	443	192.168.2.6	104.102.49.254
Oct 8, 2024 00:40:27.945563078 CEST	443	49710	104.102.49.254	192.168.2.6
Oct 8, 2024 00:40:27.945619106 CEST	49710	443	192.168.2.6	104.102.49.254
Oct 8, 2024 00:40:27.945625067 CEST	443	49710	104.102.49.254	192.168.2.6
Oct 8, 2024 00:40:27.945656061 CEST	49710	443	192.168.2.6	104.102.49.254
Oct 8, 2024 00:40:27.945671082 CEST	443	49710	104.102.49.254	192.168.2.6
Oct 8, 2024 00:40:27.945712090 CEST	49710	443	192.168.2.6	104.102.49.254
Oct 8, 2024 00:40:28.010595083 CEST	49710	443	192.168.2.6	104.102.49.254
Oct 8, 2024 00:40:28.010595083 CEST	49710	443	192.168.2.6	104.102.49.254
Oct 8, 2024 00:40:28.010622025 CEST	443	49710	104.102.49.254	192.168.2.6
Oct 8, 2024 00:40:28.010632992 CEST	443	49710	104.102.49.254	192.168.2.6
Oct 8, 2024 00:40:28.039040089 CEST	49711	443	192.168.2.6	172.67.206.204
Oct 8, 2024 00:40:28.039071083 CEST	443	49711	172.67.206.204	192.168.2.6
Oct 8, 2024 00:40:28.039155960 CEST	49711	443	192.168.2.6	172.67.206.204
Oct 8, 2024 00:40:28.039511919 CEST	49711	443	192.168.2.6	172.67.206.204
Oct 8, 2024 00:40:28.039525986 CEST	443	49711	172.67.206.204	192.168.2.6
Oct 8, 2024 00:40:28.489481926 CEST	443	49711	172.67.206.204	192.168.2.6
Oct 8, 2024 00:40:28.489612103 CEST	49711	443	192.168.2.6	172.67.206.204
Oct 8, 2024 00:40:28.492316961 CEST	49711	443	192.168.2.6	172.67.206.204
Oct 8, 2024 00:40:28.492325068 CEST	443	49711	172.67.206.204	192.168.2.6
Oct 8, 2024 00:40:28.492712021 CEST	443	49711	172.67.206.204	192.168.2.6
Oct 8, 2024 00:40:28.493983030 CEST	49711	443	192.168.2.6	172.67.206.204
Oct 8, 2024 00:40:28.494018078 CEST	49711	443	192.168.2.6	172.67.206.204
Oct 8, 2024 00:40:28.494057894 CEST	443	49711	172.67.206.204	192.168.2.6
Oct 8, 2024 00:40:28.916244984 CEST	443	49711	172.67.206.204	192.168.2.6
Oct 8, 2024 00:40:28.916341066 CEST	443	49711	172.67.206.204	192.168.2.6
Oct 8, 2024 00:40:28.916414976 CEST	49711	443	192.168.2.6	172.67.206.204
Oct 8, 2024 00:40:28.916709900 CEST	49711	443	192.168.2.6	172.67.206.204
Oct 8, 2024 00:40:28.916726112 CEST	443	49711	172.67.206.204	192.168.2.6
Oct 8, 2024 00:40:28.916739941 CEST	49711	443	192.168.2.6	172.67.206.204
Oct 8, 2024 00:40:28.916745901 CEST	443	49711	172.67.206.204	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 00:40:26.436850071 CEST	55273	53	192.168.2.6	1.1.1.1
Oct 8, 2024 00:40:26.448283911 CEST	53	55273	1.1.1.1	192.168.2.6
Oct 8, 2024 00:40:26.471880913 CEST	57124	53	192.168.2.6	1.1.1.1
Oct 8, 2024 00:40:26.482954979 CEST	53	57124	1.1.1.1	192.168.2.6
Oct 8, 2024 00:40:26.485374928 CEST	49299	53	192.168.2.6	1.1.1.1
Oct 8, 2024 00:40:26.496176004 CEST	53	49299	1.1.1.1	192.168.2.6
Oct 8, 2024 00:40:26.498385906 CEST	52300	53	192.168.2.6	1.1.1.1
Oct 8, 2024 00:40:26.509604931 CEST	53	52300	1.1.1.1	192.168.2.6
Oct 8, 2024 00:40:26.512171984 CEST	56812	53	192.168.2.6	1.1.1.1
Oct 8, 2024 00:40:26.522260904 CEST	53	56812	1.1.1.1	192.168.2.6
Oct 8, 2024 00:40:26.525238037 CEST	62016	53	192.168.2.6	1.1.1.1
Oct 8, 2024 00:40:26.536365032 CEST	53	62016	1.1.1.1	192.168.2.6
Oct 8, 2024 00:40:26.539273977 CEST	55725	53	192.168.2.6	1.1.1.1
Oct 8, 2024 00:40:26.550498009 CEST	53	55725	1.1.1.1	192.168.2.6
Oct 8, 2024 00:40:26.553319931 CEST	54101	53	192.168.2.6	1.1.1.1
Oct 8, 2024 00:40:26.564574957 CEST	53	54101	1.1.1.1	192.168.2.6
Oct 8, 2024 00:40:26.567362070 CEST	49857	53	192.168.2.6	1.1.1.1
Oct 8, 2024 00:40:26.577497005 CEST	53	49857	1.1.1.1	192.168.2.6
Oct 8, 2024 00:40:26.580473900 CEST	64432	53	192.168.2.6	1.1.1.1
Oct 8, 2024 00:40:26.590003014 CEST	53	64432	1.1.1.1	192.168.2.6
Oct 8, 2024 00:40:28.028000116 CEST	54545	53	192.168.2.6	1.1.1.1
Oct 8, 2024 00:40:28.038288116 CEST	53	54545	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 8, 2024 00:40:26.436850071 CEST	192.168.2.6	1.1.1.1	0xb58b	Standard query (0)	ponintnykqwm.shop	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:40:26.471880913 CEST	192.168.2.6	1.1.1.1	0x9794	Standard query (0)	frizzettei.sbs	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:40:26.485374928 CEST	192.168.2.6	1.1.1.1	0x8ff7	Standard query (0)	isoplethui.sbs	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:40:26.498385906 CEST	192.168.2.6	1.1.1.1	0xffb9	Standard query (0)	exemplarou.sbs	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:40:26.512171984 CEST	192.168.2.6	1.1.1.1	0xdcdf	Standard query (0)	bemuzzeki.sbs	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:40:26.525238037 CEST	192.168.2.6	1.1.1.1	0xffc7	Standard query (0)	exilepolsiy.sbs	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:40:26.539273977 CEST	192.168.2.6	1.1.1.1	0x165c	Standard query (0)	laddyirekyi.sbs	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:40:26.553319931 CEST	192.168.2.6	1.1.1.1	0x5c12	Standard query (0)	invinjurhey.sbs	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:40:26.567362070 CEST	192.168.2.6	1.1.1.1	0xa6de	Standard query (0)	wickedneatr.sbs	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:40:26.580473900 CEST	192.168.2.6	1.1.1.1	0x1e2b	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:40:28.028000116 CEST	192.168.2.6	1.1.1.1	0xf074	Standard query (0)	sergei-esenin.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 8, 2024 00:40:26.448283911 CEST	1.1.1.1	192.168.2.6	0xb58b	Name error (3)	ponintnykqwm.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:40:26.482954979 CEST	1.1.1.1	192.168.2.6	0x9794	Name error (3)	frizzettei.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:40:26.496176004 CEST	1.1.1.1	192.168.2.6	0x8ff7	Name error (3)	isoplethui.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:40:26.509604931 CEST	1.1.1.1	192.168.2.6	0xffb9	Name error (3)	exemplarou.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:40:26.522260904 CEST	1.1.1.1	192.168.2.6	0xdcdf	Name error (3)	bemuzzeki.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:40:26.536365032 CEST	1.1.1.1	192.168.2.6	0xffc7	Name error (3)	exilepolsiy.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:40:26.550498009 CEST	1.1.1.1	192.168.2.6	0x165c	Name error (3)	laddyirekyi.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:40:26.564574957 CEST	1.1.1.1	192.168.2.6	0x5c12	Name error (3)	invinjurhey.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:40:26.577497005 CEST	1.1.1.1	192.168.2.6	0xa6de	Name error (3)	wickedneatr.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:40:26.590003014 CEST	1.1.1.1	192.168.2.6	0x1e2b	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:40:28.038288116 CEST	1.1.1.1	192.168.2.6	0xf074	No error (0)	sergei-esenin.com		172.67.206.204	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:40:28.038288116 CEST	1.1.1.1	192.168.2.6	0xf074	No error (0)	sergei-esenin.com		104.21.53.8	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

sergei-esenin.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	104.102.49.254	443	4188	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 22:40:27 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-07 22:40:27 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Mon, 07 Oct 2024 22:40:27 GMT Content-Length: 34837 Connection: close Set-Cookie: sessionid=3c4c5ff58204e9464cb31a9b; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-10-07 22:40:27 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-07 22:40:27 UTC	16384	IN	Data Raw: 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 09 09 6a 51 75 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 24 29 20 7b 0d 0a 09 09 09 24 28 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 27 29 2e 76 5f 74 6f 6f 6c 74 69 70 28 7b 27 6c 6f 63 61 74 69 6f 6e 27 3a 27 62 6f 74 74 6f 6d 27 2c 20 27 64 65 73 74 72 6f 79 57 68 65 6e 44 6f 6e 65 27 3a 20 66 61 6c 73 65 2c 20 27 74 6f 6f 6c 74 69 70 43 6c 61 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f Data Ascii: <script type="text/javascript">jQuery(function($) {$('#global_header .supernav').v_tooltip({'location':'bottom', 'destroyWhenDone': false, 'tooltipClass': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#glo
2024-10-07 22:40:27 UTC	3768	IN	Data Raw: 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 73 75 6d 6d 61 72 79 5f 66 6f 6f 74 65 72 22 3e 0d 0a 09 09 09 09 09 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 66 6f 63 75 73 61 62 6c 65 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 3e 56 69 65 77 20 6d 6f 72 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 20 24 4a 28 20 66 75 6e 63 74 69 6f 6e 28 29 Data Ascii: <div class="profile_summary_footer"><span data-panel="{"focusable":true,"clickOnActivate":true}" class="whiteLink" class="whiteLink">View more info</span></div><script type="text/javascript"> $J( function()
2024-10-07 22:40:27 UTC	171	IN	Data Raw: 09 3c 73 70 61 6e 3e 56 69 65 77 20 6d 6f 62 69 6c 65 20 77 65 62 73 69 74 65 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 0d 0a 09 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 63 6f 6e 74 65 6e 74 20 2d 2d 3e 0d 0a 0d 0a 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 66 72 61 6d 65 20 2d 2d 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <span>View mobile website</span></div></div></div></div>... responsive_page_content --></div>... responsive_page_frame --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49711	172.67.206.204	443	4188	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 22:40:28 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: sergei-esenin.com
2024-10-07 22:40:28 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-07 22:40:28 UTC	797	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 22:40:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3lpp7sfepadn81mtdp71gg2a30; expires=Fri, 31 Jan 2025 16:27:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4Ri2tcw6Gn1cPXT%2BNfb4ZyAuOvKFSScTJmsGPduVOIEcOMuY%2BBFhon9n7fSIrFdV8CaHSSIdoVArQEIQ5QSrR%2BjDVmoepCgPNleOMsvfUYXneC7XnBgFW9SfmraqfU9JQKs62A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cf164a288e41a13-EWR
2024-10-07 22:40:28 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-07 22:40:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	18:40:25
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe"
Imagebase:	0x200000
File size:	1'281'024 bytes
MD5 hash:	3E6101BD944EB0ACDA2B8EA1ADA80AFD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.4%
Total number of Nodes:	23
Total number of Limit Nodes:	1

Executed Functions

Function 003C7208 Relevance: 3.9, Strings: 3, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Software\Borland\Delphi\Locales, xrefs: 003C7274
Software\Borland\Locales, xrefs: 003C7238, 003C7256
., xrefs: 003C7374

Memory Dump Source

Source File: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: .$Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 0-3917250287
Opcode ID: 774384e893e64e28c33eb8027d683b6c7e618886225bbb3c51e6fa257aa01d24
Instruction ID: 6e8a785b3cc9ede1ec241561b385bbdb7d86a970809fa63125301334325b154a
Opcode Fuzzy Hash: 774384e893e64e28c33eb8027d683b6c7e618886225bbb3c51e6fa257aa01d24
Instruction Fuzzy Hash: 1751C775A4425C7EEB26D6A4DC46FEFBBBC9B04340F4500A9BE40E6181DA749E448FA0

Function 002B8710 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateFile.NTDLL(?,?,?,?,?,?,?,?,?,?,?), ref: 002B8768

Strings

/8w, xrefs: 002B8768

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: CreateFile
String ID: /8w
API String ID: 823142352-3249559759
Opcode ID: a472dc7ba6c1751068eb954473cbf24dc077d6b77ae665b5291a7aa84848edf9
Instruction ID: a269075546463fafcb751178be3608556efd842f8e15bddb03dd84404f5cd7ce
Opcode Fuzzy Hash: a472dc7ba6c1751068eb954473cbf24dc077d6b77ae665b5291a7aa84848edf9
Instruction Fuzzy Hash: 320188B6210249BF9B10CE8ADCC9DDBBBACFB9D794F444004BB1893202D630AC51CBB0

Function 002B8634 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtClose.NTDLL(?), ref: 002B8647

Strings

`+8w, xrefs: 002B8647

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: Close
String ID: `+8w
API String ID: 3535843008-4152678778
Opcode ID: 700bdefb805130abc8784ffe2a6125d97aaf7d4b613acf23c640812080732a24
Instruction ID: 4c2b27697bee678c3832cae93d8a267228767537a90bb377da4f1f535b7bdf57
Opcode Fuzzy Hash: 700bdefb805130abc8784ffe2a6125d97aaf7d4b613acf23c640812080732a24
Instruction Fuzzy Hash: 25B092E0C143422EEF13EBA8AE0C79BAA4D5B80343F2800C87204D2864CA244544E320

Function 002B86B8 Relevance: 1.5, APIs: 1, Instructions: 44
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtReadFile.NTDLL(?,?,?,?,?,?,?,?,?), ref: 002B8700

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 45ea5405f9e491e146c1c0ca3374e63e0f1f3c5b6414cf15e43a899e045450ee
Instruction ID: 2be827cadf67ad74af93c5678d46765f5c80c5980fdf568ab76a3d1ac31f7b5b
Opcode Fuzzy Hash: 45ea5405f9e491e146c1c0ca3374e63e0f1f3c5b6414cf15e43a899e045450ee
Instruction Fuzzy Hash: 37F09CB6110259BF9B10DE9ADCC8DEBBB6CEB8D7A4B448005FB1997201C670AD50CBB0

Function 002B8650 Relevance: 1.5, APIs: 1, Instructions: 26
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSetInformationFile.NTDLL(?,?,?,?,?), ref: 002B8677

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: FileInformation
String ID:
API String ID: 4253254148-0
Opcode ID: 1d8cc0370f8af783992f85bd763e24e4fc083e9c6b5d1db771e0a1bca26a8180
Instruction ID: bb4e4d9ab5a3775a7b203f280723081dde3c19e898e7fa99e30d659cb79ed68c
Opcode Fuzzy Hash: 1d8cc0370f8af783992f85bd763e24e4fc083e9c6b5d1db771e0a1bca26a8180
Instruction Fuzzy Hash: 1EE0C2F50102157EE3119B5B9C0CEE7BF6CDBC27B0F108059BA4893100C660AC14C3F0

Function 00245BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(0024973D,005C003F,00000006,?,?,00000018,8C8D8A8B,?,?), ref: 00245BDE

Memory Dump Source

Source File: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 00316CA4 Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

\\.\, xrefs: 00316D72

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: \\.\
API String ID: 0-2900601889
Opcode ID: 4875d08428cd3ce6510c879b5e4a26287a2fec2195130b719a62da0fbf02d5c2
Instruction ID: eb52fbd226c6de6a371ddfae431a3324655b1970f4cfbb2e3d4f803b8ec35076
Opcode Fuzzy Hash: 4875d08428cd3ce6510c879b5e4a26287a2fec2195130b719a62da0fbf02d5c2
Instruction Fuzzy Hash: F2516234A106189BDB25EB64CC82BDEB7B9AF48704F5045E1F448A7291DB709FE1CF90

Function 002B6CC0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dbabf60b5e3105b81204478276134a213c02ca571a08b05bf5f67d7f9755667
Instruction ID: 8aa3937e92d059680caeec1fa5f1401b823e4f10807e084d8622d1435f9e6015
Opcode Fuzzy Hash: 5dbabf60b5e3105b81204478276134a213c02ca571a08b05bf5f67d7f9755667
Instruction Fuzzy Hash: 90111B75E1160DFBCF00AFD4C8899DDBBBAEF08320F2049D5B554A6251DB368FA19B11

Function 00290490 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71849f809035b26090f03bf161e612b8aac6690b2c248d2d467c26f8c0837399
Instruction ID: d5875c73da1f2e6921d908a4ee852843b0b03199540cc33649224f3c6498687e
Opcode Fuzzy Hash: 71849f809035b26090f03bf161e612b8aac6690b2c248d2d467c26f8c0837399
Instruction Fuzzy Hash: 5E01A7316282185FCB16EA389CD1ADE77ECEB49314F9105F5B50DD32A2EA705DA0CE50

Function 002B87F0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09b5d102a133842556b193053f5de286db46d1de97e982ea93665c7b990029db
Instruction ID: 14efd1a48f672e4d3704a7f1dcae8e29d4a622b6ea186c1dec4dd1b6727c55f6
Opcode Fuzzy Hash: 09b5d102a133842556b193053f5de286db46d1de97e982ea93665c7b990029db
Instruction Fuzzy Hash: 12D092B211420D6A8B01EEECDD41DDB33DCAA08650B04892ABE05C7142EA34E9649BB0

Function 003D060C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAddAtomA.KERNEL32(?), ref: 003D0698

Strings

Enigma, xrefs: 003D0683
ControlOfs, xrefs: 003D0649
WndProcPtr, xrefs: 003D065E
Delphi, xrefs: 003D0634

Memory Dump Source

Source File: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: AtomGlobal
String ID: ControlOfs$Delphi$Enigma$WndProcPtr
API String ID: 2189174293-1257653096
Opcode ID: e920c2a0fca468ffe573e357655504b0f49b91531319171f744d775ffd22a59a
Instruction ID: 817b57bdb543446f1ccfb024648bb27522fbbbf41e94bfaa18f4e82255672a55
Opcode Fuzzy Hash: e920c2a0fca468ffe573e357655504b0f49b91531319171f744d775ffd22a59a
Instruction Fuzzy Hash: 4911AD363043056BE70BEB70AC92F6A7B99DBC5B00F11843AB901DB782DA75DD108724

Function 02998DC8 Relevance: 1.6, APIs: 1, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExitUserProcess.NTDLL(?,77E8F3B0,000000FF), ref: 02998DD5

Memory Dump Source

Source File: 00000000.00000002.2171945727.0000000002990000.00000040.00001000.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_SecuriteInfo.jbxd

Similarity

API ID: ExitProcessUser
String ID:
API String ID: 3902816426-0
Opcode ID: 6eb7cbba1cbdfdf0fd3a3df6123d04254f99585141ef0d78c50889ac9d494be5
Instruction ID: e8e8ebfc6a81059480712fca990e4888a962e60b22b66d3dd2555cb53817a352
Opcode Fuzzy Hash: 6eb7cbba1cbdfdf0fd3a3df6123d04254f99585141ef0d78c50889ac9d494be5
Instruction Fuzzy Hash: 7A310AB2D1060CAFDB01CFD5C949BDEBBB9FB14336F21461AE521A6190D7785A098F60

Function 00243220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 002432A6

Memory Dump Source

Source File: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 1a84cf4740a2ccb6b2455039be36d0dbcd5c50e10a10891ce229e8679cafd0cb
Instruction ID: 7f74dbb3d179005fcb6b4f9f2ed8d6bfcff38480b81e3da16c2b1b3b3272b4d8
Opcode Fuzzy Hash: 1a84cf4740a2ccb6b2455039be36d0dbcd5c50e10a10891ce229e8679cafd0cb
Instruction Fuzzy Hash: 16016D3450D350ABC705EF18E849A1ABBE8EF4AB01F054D5CE5C58B361D335DD60CB96

Non-executed Functions

Function 00331498 Relevance: 40.7, Strings: 32, Instructions: 740COMMON

Download Yara Rule

Strings

%AppVers%, xrefs: 00331540
%TrialDaysLeft%, xrefs: 0033194A
%DaysToKeyExp%, xrefs: 00331575
%CU_EXECPR%, xrefs: 0033175E
%TrialExecsTotal%, xrefs: 00331853
%TrialExecMinsTotal%, xrefs: 00331D7E
%TrialStartMonth%, xrefs: 00331B72
%AppName%, xrefs: 00331500
%TrialExecsLeft%, xrefs: 003318A5
%TrialExpMonth%, xrefs: 00331A2E
%CU_WINVER%, xrefs: 003317C8
%CU_INSTSERV%, xrefs: 00331793
=:, xrefs: 00331595
%CU_EXTFILES%, xrefs: 00331734
%TrialExpYear%, xrefs: 003319BC
%KeyExpYear%, xrefs: 00331613
%TrialEndYear%, xrefs: 00331C44
%TrialEndDay%, xrefs: 00331D28
%TrialStartYear%, xrefs: 00331B00
%TrialExpDay%, xrefs: 00331AA0
%RegKey%, xrefs: 003315C9
%TrialEndMonth%, xrefs: 00331CB6
=:, xrefs: 003315BF
%.2d, xrefs: 00331655, 003316B1, 00331A0B, 00331A7D, 00331B4F, 00331BC1, 00331C93, 00331D05
%RegName%, xrefs: 0033159F
%KeyExpMonth%, xrefs: 0033166F
%TrialExecMinsLeft%, xrefs: 00331DD3
%TrialStartDay%, xrefs: 00331BE4
%CU_VIRTTOOLS%, xrefs: 00331803
%TrialDaysTotal%, xrefs: 003318F8
%HardwareID%, xrefs: 003316FF
%KeyExpDay%, xrefs: 003316CB

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: %.2d$%AppName%$%AppVers%$%CU_EXECPR%$%CU_EXTFILES%$%CU_INSTSERV%$%CU_VIRTTOOLS%$%CU_WINVER%$%DaysToKeyExp%$%HardwareID%$%KeyExpDay%$%KeyExpMonth%$%KeyExpYear%$%RegKey%$%RegName%$%TrialDaysLeft%$%TrialDaysTotal%$%TrialEndDay%$%TrialEndMonth%$%TrialEndYear%$%TrialExecMinsLeft%$%TrialExecMinsTotal%$%TrialExecsLeft%$%TrialExecsTotal%$%TrialExpDay%$%TrialExpMonth%$%TrialExpYear%$%TrialStartDay%$%TrialStartMonth%$%TrialStartYear%$=:$=:
API String ID: 0-389529998
Opcode ID: 3a932c0a1f8512130f54627d052bcf6ad4a8429880ae684834682c5ec8f8a09f
Instruction ID: a152affd246116dc5f1c2a188362504a977615cb6efc743ddcc32891424d6e63
Opcode Fuzzy Hash: 3a932c0a1f8512130f54627d052bcf6ad4a8429880ae684834682c5ec8f8a09f
Instruction Fuzzy Hash: EF626F38A141588FDB11EB90DCC1FEEB7B9AF49304F1081A6F54897356DA309E9ACF61

Function 002323E0 Relevance: 20.8, Strings: 14, Instructions: 3298COMMON

Download Yara Rule

Strings

{l`~, xrefs: 0023268C
ggxz, xrefs: 00232685
:, xrefs: 002332DD
PJ2, xrefs: 0023344B, 00234861
aenQ, xrefs: 0023276A
%*+(, xrefs: 002340EF
mlc@, xrefs: 0023275C
`N2, xrefs: 002332BC, 00234531
fedc, xrefs: 00232782
`tii, xrefs: 00232693
|}&C, xrefs: 00232F21
3<, xrefs: 002332D6
f@~!, xrefs: 002325FF
Cx, xrefs: 0023453D

Memory Dump Source

Source File: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: %*+($3<$:$Cx$PJ2$`N2$`tii$aenQ$f@~!$fedc$ggxz$mlc@${l`~$|}&C
API String ID: 0-60221406
Opcode ID: 767fa02fd89f546a1c347dc3e2205cf8c28b72659f8c305b36f01b8f762d7d4b
Instruction ID: 759355384eb976016cb86176ecd8b47c862f1f5be6e55d989483d9c1dcfd22c2
Opcode Fuzzy Hash: 767fa02fd89f546a1c347dc3e2205cf8c28b72659f8c305b36f01b8f762d7d4b
Instruction Fuzzy Hash: C333BCB0524B81CBD725CF38C590762BBE1BF16304F58899DE4DA8BA82C735F916CB61

Function 00201000 Relevance: 10.5, Strings: 7, Instructions: 1785COMMON

Download Yara Rule

Strings

gfff, xrefs: 00202226
-, xrefs: 002021ED
0123456789ABCDEFXP, xrefs: 0020157D, 002015EB
gfff, xrefs: 002022E1
gfff, xrefs: 00202297
@, xrefs: 00202C40
0123456789abcdefxp, xrefs: 00201587, 002015F8

Memory Dump Source

Source File: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$@$gfff$gfff$gfff
API String ID: 0-2517803157
Opcode ID: 5a4da3936a569e6d73d25fec9adc7170fbe83d61f1da50d675c85d8734ada958
Instruction ID: ba520e4784a0c07ec5b4dc1a3d83b3f58a912fec113f63d8b8e32e5b0567e3a6
Opcode Fuzzy Hash: 5a4da3936a569e6d73d25fec9adc7170fbe83d61f1da50d675c85d8734ada958
Instruction Fuzzy Hash: F0D217716283428FD718CE28C49436ABBE2AFD9314F18862DE499C73D2D774DD59CB82

Function 002012F7 Relevance: 7.2, Strings: 5, Instructions: 922COMMON

Download Yara Rule

Strings

0, xrefs: 00201E88
0, xrefs: 00201DC1
0, xrefs: 0020243E
@, xrefs: 00203531
i, xrefs: 002028EA

Memory Dump Source

Source File: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 0$0$0$@$i
API String ID: 0-3124195287
Opcode ID: 262344579de7afd4cb369f824d1d197bdc371e56fa84aff6135294442306559a
Instruction ID: 13c1df113cd38917f75e7356b99f3b355a7f1beb0ec303c29b65122c06c75f94
Opcode Fuzzy Hash: 262344579de7afd4cb369f824d1d197bdc371e56fa84aff6135294442306559a
Instruction Fuzzy Hash: 4C62F47162C3828FD318CF28C49476ABBE1AFD5304F188A5EE8D9872D2D774D959CB42

Function 0036705C Relevance: 6.9, Strings: 5, Instructions: 623COMMON

Download Yara Rule

Strings

header crc mismatch, xrefs: 00367751
unknown compression method, xrefs: 00367261, 00367323
incorrect header check, xrefs: 00367240
invalid window size, xrefs: 00367295
unknown header flags set, xrefs: 0036733E

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: header crc mismatch$incorrect header check$invalid window size$unknown compression method$unknown header flags set
API String ID: 0-3633268661
Opcode ID: b0e6c11167cdcddadaeaa9ed797a24d1a42e43c613ef97ef37afbf903e2df8c4
Instruction ID: 1aa62e782bf04d1e34b3c3ab6230e8c11f2f925938b14f8a875f0042dccd4434
Opcode Fuzzy Hash: b0e6c11167cdcddadaeaa9ed797a24d1a42e43c613ef97ef37afbf903e2df8c4
Instruction Fuzzy Hash: 29425E74508341CFD71ACF18C48475ABBE2FF89308F558A9DE8958B39AD770D885CB92

Function 0020164F Relevance: 6.7, Strings: 5, Instructions: 472COMMON

Download Yara Rule

Strings

gfff, xrefs: 00201F3C
gfff, xrefs: 00201F57
+, xrefs: 00201573
0123456789ABCDEFXP, xrefs: 0020164F
0123456789abcdefxp, xrefs: 00201659

Memory Dump Source

Source File: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: +$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff
API String ID: 0-1123320326
Opcode ID: 21256765553dd25f863ef2ce76bc4f7e49faa139bd9ffdf8d5b7656f9a81aad4
Instruction ID: e1876aa40f1005e39980495c0a3aa258850be4484c96807017fc4bffdb7d7ecd
Opcode Fuzzy Hash: 21256765553dd25f863ef2ce76bc4f7e49faa139bd9ffdf8d5b7656f9a81aad4
Instruction Fuzzy Hash: FDF1943161C3928FC715CF28C48435AFBE2ABD9304F188A6EE4D987392D774D959CB92

Function 002013A3 Relevance: 6.6, Strings: 5, Instructions: 390COMMON

Download Yara Rule

Strings

gfff, xrefs: 00201F3C
gfff, xrefs: 00201F57
-, xrefs: 00201F23
0123456789ABCDEFXP, xrefs: 002013A3
0123456789abcdefxp, xrefs: 002013AD

Memory Dump Source

Source File: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff
API String ID: 0-3620105454
Opcode ID: 816d197bb003b24ce1a65ed9501cdd731b91b6293fab6bc71638cad81caa11e3
Instruction ID: 92b15fe6d2d407b0cbd6b178da6272a8d208362c71d370c1ad95086bc33d6910
Opcode Fuzzy Hash: 816d197bb003b24ce1a65ed9501cdd731b91b6293fab6bc71638cad81caa11e3
Instruction Fuzzy Hash: D7D1A33161C7828FC715CE29C48426AFFE2AFD9304F18CA6EE4D987392D634D959CB52

Function 0035CE4C Relevance: 6.4, Strings: 5, Instructions: 179COMMON

Download Yara Rule

Strings

J, xrefs: 0035CFDC
X, xrefs: 0035CFF9
J, xrefs: 0035CE6A
F, xrefs: 0035CFE5
X, xrefs: 0035CFEF

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: F$J$J$X$X
API String ID: 0-2166313073
Opcode ID: 12fdb1c193f4f78136981c133ba371dc7561109d75048bcbb9abb70116e7edbf
Instruction ID: c72d9498fbcc3790b5afc1682752f175ebf1e5ef5c0dc742eb392dd19a3aee8f
Opcode Fuzzy Hash: 12fdb1c193f4f78136981c133ba371dc7561109d75048bcbb9abb70116e7edbf
Instruction Fuzzy Hash: 7B7153705042808FD729CF29C494B96BFE29F5A305F1AC0DDD8898F3A7C676D94ACB91

Function 00208590 Relevance: 4.1, Strings: 3, Instructions: 387COMMON

Download Yara Rule

Strings

IEND, xrefs: 002089F0
), xrefs: 0020860C
), xrefs: 00208616

Memory Dump Source

Source File: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: )$)$IEND
API String ID: 0-588110143
Opcode ID: 0201524d60d4471d62d4fe488dcc8e1fd803c62a257eb1a256cec39eeff9e64a
Instruction ID: 9012d509c3dc40d0a5a7fcde3d8ca3fbaeceeb0714378db77c3ac4042195cd19
Opcode Fuzzy Hash: 0201524d60d4471d62d4fe488dcc8e1fd803c62a257eb1a256cec39eeff9e64a
Instruction Fuzzy Hash: 6DE1BFB1A187069FE310DF28C88572BBBE4BB94314F144A2DE595973C2DB75E924CBC2

Function 002B836C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52filenativeCOMMON

Download Yara Rule

APIs

NtQueryDirectoryFile.NTDLL(?,?,?,?,?,?,?,?,?,?,?), ref: 002B83C4

Strings

-8w, xrefs: 002B83C4

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: DirectoryFileQuery
String ID: -8w
API String ID: 3295332484-3258223777
Opcode ID: df3986e8afafb2831e1c651e2ec206d2622ed28c34581a0b71b45472e2b4233d
Instruction ID: 1c0dc6b262dd4601e43ba6526b66446ac5ce250d32e0a3940ac9cc3f179bb38b
Opcode Fuzzy Hash: df3986e8afafb2831e1c651e2ec206d2622ed28c34581a0b71b45472e2b4233d
Instruction Fuzzy Hash: 65018CB62152897FDB01CE9ADCC4DEBBBACFB9E754B444444BA5893202C230AC51C770

Function 002B8180 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48nativeCOMMON

Download Yara Rule

APIs

NtNotifyChangeKey.NTDLL(?,?,?,?,?,?,?,?,?,?), ref: 002B81D0

Strings

<8w, xrefs: 002B81D0

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: ChangeNotify
String ID: <8w
API String ID: 3893256919-1979266226
Opcode ID: 0be3826213b224a0ddbcc3b3b0ab0b6226879a0da86d9eec2355fed9157382e1
Instruction ID: b9efc09ab016e420519b46798a39ed5ffc93fd19b0a13ec81f9114f6574df167
Opcode Fuzzy Hash: 0be3826213b224a0ddbcc3b3b0ab0b6226879a0da86d9eec2355fed9157382e1
Instruction Fuzzy Hash: 3101BBF62152897F9B118E9ADCC5DEBBF6CEA9E394B484045BA4897201C160AD51C7B0

Function 002B848C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48filenativeCOMMON

Download Yara Rule

APIs

NtLockFile.NTDLL(?,?,?,?,?,?,?,?,?,?), ref: 002B84DC

Strings

0;8w, xrefs: 002B84DC

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: FileLock
String ID: 0;8w
API String ID: 3169042693-548369832
Opcode ID: 223a16ed4bfd54e845441e574489cb4248e5147d7cb2cde6d27f265c50a8ff2f
Instruction ID: 7f299fc3556718461d4a0906e71ee09b0db55bb52619d7d73cbfa062e7832637
Opcode Fuzzy Hash: 223a16ed4bfd54e845441e574489cb4248e5147d7cb2cde6d27f265c50a8ff2f
Instruction Fuzzy Hash: 1C01C2B610529A7F97118EAADCC5DEBBF6CFB5E395B444045BA4C83201C1709C10C7B0

Function 002B7B50 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48filenativeCOMMON

Download Yara Rule

APIs

NtDeviceIoControlFile.NTDLL(?,?,?,?,?,?,?,?,?,?), ref: 002B7BA0

Strings

*8w, xrefs: 002B7BA0

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: ControlDeviceFile
String ID: *8w
API String ID: 3512290074-3346766372
Opcode ID: bd59cdac5d154601cda847dc16537787d4812452950e644c63d0636629707ad7
Instruction ID: 1af8ca5989ad5289d8f4e34e7b39671a0f60c0dd7a696bd08d2c4c68f1d4a5e2
Opcode Fuzzy Hash: bd59cdac5d154601cda847dc16537787d4812452950e644c63d0636629707ad7
Instruction Fuzzy Hash: D8017DB6214249BF9B10DE8ADCC4DEBBBACFB9D7A4B444005BB1997201C271AC50CBB0

Function 002B7E6C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48filenativeCOMMON

Download Yara Rule

APIs

NtFsControlFile.NTDLL(?,?,?,?,?,?,?,?,?,?), ref: 002B7EBC

Strings

.8w, xrefs: 002B7EBC

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: ControlFile
String ID: .8w
API String ID: 1795486800-1784365996
Opcode ID: fe2677ed3ac1e3fdf8999481ce412151bd36067d1f1d3092316a8cdb62aee1f7
Instruction ID: aeaeed052cedaf1df230e729b5ee4040f4530de139023623304cd2209a5084ce
Opcode Fuzzy Hash: fe2677ed3ac1e3fdf8999481ce412151bd36067d1f1d3092316a8cdb62aee1f7
Instruction Fuzzy Hash: 950191B6214259BF9B11CE8ADCC4DEBBBACFB8D794F444455BB1897201D270AD50CBB0

Function 002B7CA0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44nativeCOMMON

Download Yara Rule

APIs

NtCreateProcessEx.NTDLL(?,?,?,?,?,?,?,?,?), ref: 002B7CE8

Strings

`/8w, xrefs: 002B7CE8

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: CreateProcess
String ID: `/8w
API String ID: 963392458-4035801510
Opcode ID: 5ec7473acb32153efd2fb699e9ec9f858385b4eb35d9fb9ecf676020411c8b41
Instruction ID: 3a0c4b9c1e698014b7a8986e833d3a767906c6ab0e3a00483578d7665e85afef
Opcode Fuzzy Hash: 5ec7473acb32153efd2fb699e9ec9f858385b4eb35d9fb9ecf676020411c8b41
Instruction Fuzzy Hash: 47F0AFB6104359BF9710DE8ADCC4DEB7B6CFB8D7A4B548055BA1887201C270AD10C7B0

Function 002B7BE4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40nativethreadCOMMON

Download Yara Rule

APIs

NtCreateThread.NTDLL(?,?,?,?,?,?,?,?), ref: 002B7C24

Strings

p/8w, xrefs: 002B7C24

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: CreateThread
String ID: p/8w
API String ID: 2422867632-2694063673
Opcode ID: 2695e4a2bb0521c37f32ca769b855fe1e928f864f1de8f7e86b0f12d08dfe5b3
Instruction ID: 3fb5a4a01352de6e934c74ce96f7373a044855db9c658bc610af8cc94536ddc0
Opcode Fuzzy Hash: 2695e4a2bb0521c37f32ca769b855fe1e928f864f1de8f7e86b0f12d08dfe5b3
Instruction Fuzzy Hash: CEF054B61042897F97119E96DC88DEB7FACEBDE7A4F048459FA0883101C270AC50C7B0

Function 002B7C50 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40nativeCOMMON

Download Yara Rule

APIs

NtCreateProcess.NTDLL(?,?,?,?,?,?,?,?), ref: 002B7C90

Strings

68w, xrefs: 002B7C90

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: CreateProcess
String ID: 68w
API String ID: 963392458-2020520292
Opcode ID: cf972af493e8c30fc3f6846efb4e7e6f3d52f08c8f78ae45d454ed5c4c533640
Instruction ID: bfdf34f7ffe6dd0cb812420cdbf30aa20238af60ad133dfb589d9f3bb4324c9f
Opcode Fuzzy Hash: cf972af493e8c30fc3f6846efb4e7e6f3d52f08c8f78ae45d454ed5c4c533640
Instruction Fuzzy Hash: DEF0D0B61042497F9711DE86DCC8DE77B6CEB8D7A4B444009BA1887111C270AC50C7B0

Function 002B7F04 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40nativeCOMMON

Download Yara Rule

APIs

NtAccessCheck.NTDLL(?,?,?,?,?,?,?,?), ref: 002B7F44

Strings

p*8w, xrefs: 002B7F44

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: AccessCheck
String ID: p*8w
API String ID: 3492747997-2791302354
Opcode ID: 573cc8a902f896b9b345be566ba73c332f9fd6e9b9e35e1c479ad686d1af3670
Instruction ID: 559c3d054d70214861b1f1fcd6f14af0ee816a534a23fd46200b5da6fc119a48
Opcode Fuzzy Hash: 573cc8a902f896b9b345be566ba73c332f9fd6e9b9e35e1c479ad686d1af3670
Instruction Fuzzy Hash: 49F0DAB6114249BFDB10CE8ADCC8DEB7B6CEB8E7A4B448055FA0887601D270AD10C7B0

Function 002B8028 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36nativeCOMMON

Download Yara Rule

APIs

NtCreateKey.NTDLL(?,?,?,?,?,?,?), ref: 002B8060

Strings

`,8w, xrefs: 002B8060

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: Create
String ID: `,8w
API String ID: 2289755597-4073443327
Opcode ID: 5f8adc1490a3a4ba55fa7ae83a3d9046d537bf6de22073a8e95bb14eac47b831
Instruction ID: 33875dcea4d6c40c7a7b4b183dc907b7a963fd412cd465bf01c65c2cb1651107
Opcode Fuzzy Hash: 5f8adc1490a3a4ba55fa7ae83a3d9046d537bf6de22073a8e95bb14eac47b831
Instruction Fuzzy Hash: BEF01CB6200219BFA7109E96DC88EEB7B6CEB8A7A5F008405BA1897101C270AD10C7B0

Function 002B83F4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36nativeCOMMON

Download Yara Rule

APIs

NtDuplicateObject.NTDLL(?,?,?,?,?,?,?), ref: 002B842C

Strings

P.8w, xrefs: 002B842C

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: DuplicateObject
String ID: P.8w
API String ID: 3677547684-23388976
Opcode ID: 2bdb46cf3e99c73a0e9af979705089c1f5c92281622a5789feee5a90e702dd45
Instruction ID: f508cb609b7ae71663886e26d8a3c79b751957c26ea3cf14809256e6dd3b7cf8
Opcode Fuzzy Hash: 2bdb46cf3e99c73a0e9af979705089c1f5c92281622a5789feee5a90e702dd45
Instruction Fuzzy Hash: 4BF01CB611421A7FE710DF86EC88DEB7B6CEB897A0F408415FA0897501C670AD10C7B0

Function 002B85EC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36nativeCOMMON

Download Yara Rule

APIs

NtCreateSection.NTDLL(?,?,?,?,?,?,?), ref: 002B8624

Strings

0/8w, xrefs: 002B8624

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: CreateSection
String ID: 0/8w
API String ID: 2449625523-998276612
Opcode ID: 1a03518dfaba8cf9d8d1fee796b5d12b31f240e360dfb9ef4cacafede62f06ca
Instruction ID: ac56a7d08d7c79a080e79d21ff70cfe651b6ecd0ce093f081f1bf0c900e596b7
Opcode Fuzzy Hash: 1a03518dfaba8cf9d8d1fee796b5d12b31f240e360dfb9ef4cacafede62f06ca
Instruction Fuzzy Hash: DBF01CB6110259BFA7109E96DC88DE77B6CEB897A4F408045F60887101D670AC50C7B0

Function 002B7FE8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32nativeCOMMON

Download Yara Rule

APIs

NtQueryValueKey.NTDLL(?,?,?,?,?,?), ref: 002B8018

Strings

+8w, xrefs: 002B8018

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: QueryValue
String ID: +8w
API String ID: 3660427363-3334074387
Opcode ID: 1a661208afb7fb2f591f21a18b722c13a39c643b97bfed7dee328d1df70de638
Instruction ID: 9449a980f9c9c7e1f82f799f345d9f5448e36013e30a12d618a8f932d2321490
Opcode Fuzzy Hash: 1a661208afb7fb2f591f21a18b722c13a39c643b97bfed7dee328d1df70de638
Instruction Fuzzy Hash: 10E0E5B6110259BFA611AA96DC88EEBBF6CEBCA7E4B048459F90987141C671AC50C7B0

Function 002B8338 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 26nativeCOMMON

Download Yara Rule

APIs

NtQueryObject.NTDLL(?,?,?,?,?), ref: 002B835F

Strings

p+8w, xrefs: 002B835F

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: ObjectQuery
String ID: p+8w
API String ID: 2748340528-2812120805
Opcode ID: 471298bd9428b295b63db89481f9df571125ac370a2bb2c6cedcdf300832b57a
Instruction ID: 4740c8d0f125ad4691d76639f7383b109af2edd1fef1a58384f6fb7fea0df0c2
Opcode Fuzzy Hash: 471298bd9428b295b63db89481f9df571125ac370a2bb2c6cedcdf300832b57a
Instruction Fuzzy Hash: E7E0C2B20182557ED711579A9C0CEE77FACDBD2BB0F054499B40C93100C660AC00C3B0

Function 002B843C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 26filenativeCOMMON

Download Yara Rule

APIs

NtQueryVolumeInformationFile.NTDLL(?,?,?,?,?), ref: 002B8463

Strings

/8w, xrefs: 002B8463

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: FileInformationQueryVolume
String ID: /8w
API String ID: 634242254-1805199771
Opcode ID: 7d7b9c1a12bd560c57f0965872db4c03407b903b9725261e3671cdc0eedc487f
Instruction ID: a2b16df1c61d07c053515d57d48d24d135701ec427af4eae1d3b25e80b7bcfd0
Opcode Fuzzy Hash: 7d7b9c1a12bd560c57f0965872db4c03407b903b9725261e3671cdc0eedc487f
Instruction Fuzzy Hash: A4E08CA90142167ED611968A9C0CEE77F6CDBC67B0F008459B40892501C6A0AC10C3B0

Function 002B84EC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 26filenativeCOMMON

Download Yara Rule

APIs

NtUnlockFile.NTDLL(?,?,?,?,?), ref: 002B8513

Strings

0G8w, xrefs: 002B8513

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: FileUnlock
String ID: 0G8w
API String ID: 45017762-2101666972
Opcode ID: b4c4d7f154e90cf0ad80f65ff7a0e6b55c0028b91ee45380ff5ca4d26671a39c
Instruction ID: 1900210cefd28c69b781fa482cd511de1a3d6f4272e6ab4cb32b86473f50e233
Opcode Fuzzy Hash: b4c4d7f154e90cf0ad80f65ff7a0e6b55c0028b91ee45380ff5ca4d26671a39c
Instruction Fuzzy Hash: 9BE08CB91102557AE7226B5AAC0CEF77F2CEBC27B0F494069B40892500C6A0AD60C7B0

Function 002B7DE0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 26nativeCOMMON

Download Yara Rule

APIs

NtQuerySecurityObject.NTDLL(?,?,?,?,?), ref: 002B7E07

Strings

@@8w, xrefs: 002B7E07

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: ObjectQuerySecurity
String ID: @@8w
API String ID: 718582247-322196101
Opcode ID: d997fe418ffde46fa8678131f5087bc0cdec16d3b408c8cfdc16c8ba6e745968
Instruction ID: 4789a07e7e9b923ddf62ad5354561448117fc5d7067578e15eda177e58fe7863
Opcode Fuzzy Hash: d997fe418ffde46fa8678131f5087bc0cdec16d3b408c8cfdc16c8ba6e745968
Instruction Fuzzy Hash: CAE08CA11143157FE2125B4AAC0DDE77F6CCBC37B0F008099F8589210092A0AD50C3F0

Function 002B82C4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 11nativeCOMMON

Download Yara Rule

APIs

NtTerminateProcess.NTDLL(?,00000000), ref: 002B82D9

Strings

P-8w, xrefs: 002B82D9

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: ProcessTerminate
String ID: P-8w
API String ID: 560597551-52583785
Opcode ID: 14bd4e3b72dbeedec85873e45d892b5b872e97470d955ca19d420a0ef22170a6
Instruction ID: e9b150e5da4323add270ef4577fd3963def3058ad7d6aa233500c6b2ac0a4341
Opcode Fuzzy Hash: 14bd4e3b72dbeedec85873e45d892b5b872e97470d955ca19d420a0ef22170a6
Instruction Fuzzy Hash: AEC04CE89142827EEE0697685E0CB77195C87C1711F0480D87098C1851CB944920D720

Function 002B853C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 11nativeCOMMON

Download Yara Rule

APIs

NtUnmapViewOfSection.NTDLL(00000000), ref: 002B8551

Strings

0-8w, xrefs: 002B8551

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: SectionUnmapView
String ID: 0-8w
API String ID: 498011366-939829866
Opcode ID: 8dfea5226a3d6c6b23e4e7f52a8234e73e76400aacb244d3d9cca99393580c22
Instruction ID: e539c704e6652260f03711a3b705ef87024460157d89ab0319e3362cfc4b9b3a
Opcode Fuzzy Hash: 8dfea5226a3d6c6b23e4e7f52a8234e73e76400aacb244d3d9cca99393580c22
Instruction Fuzzy Hash: 29C04CE891434229EF1297A85C0CB76259D87D0745F0944C47014D1464CB144A90D320

Function 00244040 Relevance: 3.1, Strings: 2, Instructions: 577COMMON

Download Yara Rule

Strings

f, xrefs: 0024420C
%*+(, xrefs: 002440A4, 002440AD

Memory Dump Source

Source File: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: %*+($f
API String ID: 0-2038831151
Opcode ID: 5c75b011afaff02c3912125351913cb838557077956ebc884eba07af47555a09
Instruction ID: 08feb3c33401faae2ddd52f65e7303973aa2f226cb19ced7cda3479cbe10b927
Opcode Fuzzy Hash: 5c75b011afaff02c3912125351913cb838557077956ebc884eba07af47555a09
Instruction Fuzzy Hash: C812CE716183418FC718DF18C890B2EBBE5FBC9314F588A2CF4988B291D771E965CB92

Function 002035B0 Relevance: 2.9, Strings: 2, Instructions: 411COMMON

Download Yara Rule

Strings

NaN, xrefs: 0020360E
Inf, xrefs: 00203607

Memory Dump Source

Source File: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Inf$NaN
API String ID: 0-3500518849
Opcode ID: 4b9059cdffae6fb4ae43ce9d2123b204f0057a24b5408103a5dc95864ad25a57
Instruction ID: d268e7b387c3626193b3421cfbe3570d796bd3bb98777b3cd75a695844c18bb2
Opcode Fuzzy Hash: 4b9059cdffae6fb4ae43ce9d2123b204f0057a24b5408103a5dc95864ad25a57
Instruction Fuzzy Hash: 2DD1E771B283129BC704CF28C88061EB7E9FBC8750F248A2DF999973D1E671DD148B82

Function 00336A04 Relevance: 2.9, Strings: 2, Instructions: 390COMMON

Download Yara Rule

Strings

ZwQuerySection, Unsupported class %d, xrefs: 00336EDF
0, xrefs: 00336B7B

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 0$ZwQuerySection, Unsupported class %d
API String ID: 0-2380292483
Opcode ID: 2fff871beeb3cbaae7f6a572fe115eccab9059c891c959a40605c85bf66f3686
Instruction ID: e4459c1279584e9b8ce23392fd38cc509bac151950c17b889ef1b260833cec8c
Opcode Fuzzy Hash: 2fff871beeb3cbaae7f6a572fe115eccab9059c891c959a40605c85bf66f3686
Instruction Fuzzy Hash: 99F10474A00209EFDB06DF68C982AAEB7F5FF49304F25C5A9E814AB351D734AD45CB60

Function 00339A18 Relevance: 2.8, Strings: 2, Instructions: 304COMMON

Download Yara Rule

Strings

ZwQueryValueKey, unsupported class %d, xrefs: 00339D68
#, xrefs: 00339C96

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: #$ZwQueryValueKey, unsupported class %d
API String ID: 0-453009116
Opcode ID: eff76826a3c7704921f48de33f80538b20af6cff9b13ded81b15e0467d0c5765
Instruction ID: 5cea85f1c635197e79932073086dd873c8e1f0c51c53c04f3af5a02cef8477bd
Opcode Fuzzy Hash: eff76826a3c7704921f48de33f80538b20af6cff9b13ded81b15e0467d0c5765
Instruction Fuzzy Hash: 8EB1D870A14109EFDB41EF68C881AAEF7F5EF84300F25C1A6A814EB315DB709E518F90

Function 002D2C0C Relevance: 2.2, Strings: 1, Instructions: 905COMMON

Download Yara Rule

Strings

, xrefs: 002D3617

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 67dc765eb79743809bb83ae1a8bbdf1dcd7a17a8a249684e9ec4808cc16bb2cc
Instruction ID: 2c1ff2aa91d73809157c5522acc3c5b2cad9b0855a9feb62381d8133b5a72b61
Opcode Fuzzy Hash: 67dc765eb79743809bb83ae1a8bbdf1dcd7a17a8a249684e9ec4808cc16bb2cc
Instruction Fuzzy Hash: 3A822634A20205DFCB04DFA8C589A9DB7F1EF48310F2485A6E845AB366C770EEA5DF51

Function 0036513C Relevance: 1.9, Strings: 1, Instructions: 681COMMON

Download Yara Rule

Strings

tG6, xrefs: 00365186

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: tG6
API String ID: 0-3694876101
Opcode ID: 7f1d795e45d632f1296f2d2d0f843da3e140901ca20fa4ee7d0345e2ec76af10
Instruction ID: a5f745b07ca801ac3c2192e61d527945a306da766cd6988c9d03dbd9e4683309
Opcode Fuzzy Hash: 7f1d795e45d632f1296f2d2d0f843da3e140901ca20fa4ee7d0345e2ec76af10
Instruction Fuzzy Hash: 5E521774204A40CFCB6ACF18C5C4A267BA2EB55311F15C6A9DC568F78FC734E856CB62

Function 00205160 Relevance: 1.8, Strings: 1, Instructions: 577COMMON

Download Yara Rule

Strings

%1.17g, xrefs: 002054C8

Memory Dump Source

Source File: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: %1.17g
API String ID: 0-1551345525
Opcode ID: 15b54b34a64a0a32a6337a54b09cfe87be00b98da9e8eb54b456b72c304132cb
Instruction ID: 90c2e445585c8d2631d6574fbf25523f4ffb4657afd8f4c8ed75dfd62ae8d68c
Opcode Fuzzy Hash: 15b54b34a64a0a32a6337a54b09cfe87be00b98da9e8eb54b456b72c304132cb
Instruction Fuzzy Hash: 2822C4B6928B628BE7158E18D840327FBA2AFE0304F19856DD8594B3D3E7B1DC64DF41

Function 0033DEB0 Relevance: 1.8, Strings: 1, Instructions: 518COMMON

Download Yara Rule

Strings

MZP, xrefs: 0033DF79

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: MZP
API String ID: 0-2889622443
Opcode ID: 5a769fd6beb461ba4e499d8f2384738f5fa042e6d7edf3e91c8f421f14253902
Instruction ID: 00ac52985aaec12465e5886ef722470638567d38958c6d42290a5d66ef78cf91
Opcode Fuzzy Hash: 5a769fd6beb461ba4e499d8f2384738f5fa042e6d7edf3e91c8f421f14253902
Instruction Fuzzy Hash: 5F12F774A10209DFDB15DFA9C886FAEB7B9BF48700F118165F504EB396DA70AD41CBA0

Function 00247FC0 Relevance: 1.6, Strings: 1, Instructions: 387COMMON

Download Yara Rule

Strings

P, xrefs: 00248167

Memory Dump Source

Source File: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: 4269f5259f13486a2d55bf66143e7ff2d2965e68b7e264e5c2e2bedec6a26b2b
Instruction ID: d7a5d7c3983bc3bd1fe08d520619079199f2e2d72b5541651b0cfbaed30f7a08
Opcode Fuzzy Hash: 4269f5259f13486a2d55bf66143e7ff2d2965e68b7e264e5c2e2bedec6a26b2b
Instruction Fuzzy Hash: 61D1D5729282758FC729CE18D89071EB7E1EB85718F15862CE8B5AB380CB71DC56C7C1

Function 003688C4 Relevance: 1.6, Strings: 1, Instructions: 368COMMON

Download Yara Rule

Strings

@, xrefs: 00368C9F

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 062306c93bcb8a667f5e13e563685a1a970ba7cab6bc5c83bee9804b57632834
Instruction ID: 5190e20ba9767fb04c154a08be421d615c126aac729ee861d2f9dea5cca9cf9d
Opcode Fuzzy Hash: 062306c93bcb8a667f5e13e563685a1a970ba7cab6bc5c83bee9804b57632834
Instruction Fuzzy Hash: 06F14470E00219CBCF15CF98C4946EEBBB2FF88314F24C259D851A7398DB755A46CB64

Function 0034AFF0 Relevance: 1.6, Strings: 1, Instructions: 320COMMON

Download Yara Rule

Strings

MZx, xrefs: 0034B100

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: MZx
API String ID: 0-2575928145
Opcode ID: ab8d72a91c5b28bc5e7715513cf443cb76c99ae149240d55a8f55a3d4aba0d2f
Instruction ID: 721cc65f34f3bb96017062b56298b020efe56a2bfd2146505edb3f3fb3d066fe
Opcode Fuzzy Hash: ab8d72a91c5b28bc5e7715513cf443cb76c99ae149240d55a8f55a3d4aba0d2f
Instruction Fuzzy Hash: 48A1CC5930864956EB136E2889553EFA3E6AF81740F1A8424FC804F796C77DED8BC386

Function 003CBF40 Relevance: 1.6, Strings: 1, Instructions: 320COMMON

Download Yara Rule

Strings

MZx, xrefs: 003CC050

Memory Dump Source

Source File: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: MZx
API String ID: 0-2575928145
Opcode ID: ab8d72a91c5b28bc5e7715513cf443cb76c99ae149240d55a8f55a3d4aba0d2f
Instruction ID: 1f30c6103386877185fa681cd6e5c391d1cd3c9d2568e3254145efde1fcacc62
Opcode Fuzzy Hash: ab8d72a91c5b28bc5e7715513cf443cb76c99ae149240d55a8f55a3d4aba0d2f
Instruction Fuzzy Hash: BDA18B3532428982EF13AE649902BEB5316AB41744F1AA41CED98CFB96C73DCD83C395

Function 002B7CF8 Relevance: 1.6, APIs: 1, Instructions: 52nativeCOMMON

Download Yara Rule

APIs

NtCreateUserProcess.NTDLL(?,?,?,?,?,?,?,?,?,?,?), ref: 002B7D50

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: 17ecda6b907a2a46577a294282b5463fbc0617ef694b8ce9f3cec7fd0c64e64d
Instruction ID: 9927a49719e38be09198ed7ec3d55667af43ecc00e95a3dde0ff1ec0dc2e673d
Opcode Fuzzy Hash: 17ecda6b907a2a46577a294282b5463fbc0617ef694b8ce9f3cec7fd0c64e64d
Instruction Fuzzy Hash: 650142B6114349BF9710CE8ADCC4DDB776CFB8D794F444045BB1897601C274AC518BB0

Function 002B858C Relevance: 1.5, APIs: 1, Instructions: 48nativeCOMMON

Download Yara Rule

APIs

NtMapViewOfSection.NTDLL(?,?,?,?,?,?,?,?,?,?), ref: 002B85DC

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: SectionView
String ID:
API String ID: 1323581903-0
Opcode ID: 82594dbaa059b5e4c97e67d27050750a57b7684c90c21192e40be3b2e3e28f2a
Instruction ID: f34bfcdf5dfa31eb6ea578b54f4ad0136606d3399213beeecbd5996d0ddf5ba2
Opcode Fuzzy Hash: 82594dbaa059b5e4c97e67d27050750a57b7684c90c21192e40be3b2e3e28f2a
Instruction Fuzzy Hash: 77017DB6204249BFDB10CE8ADCC9DEBBB6CFB9D794B544005BB1997201C270AC50CBB0

Function 002B82E0 Relevance: 1.5, APIs: 1, Instructions: 44filenativeCOMMON

Download Yara Rule

APIs

NtWriteFile.NTDLL(?,?,?,?,?,?,?,?,?), ref: 002B8328

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 1421068542bb50e02bc64c42aead325001b3f9faf0555c36c0248016634690d1
Instruction ID: bcdc6ab4f8c6cb5889059247615a232b03cea7f548c2b908903e9139f8a18ccf
Opcode Fuzzy Hash: 1421068542bb50e02bc64c42aead325001b3f9faf0555c36c0248016634690d1
Instruction Fuzzy Hash: DDF09CB6104249BFD710DE8ADCC8DEB7B6CFB8D7A0B444445BA1897211D270AD50C7B0

Function 002B7E14 Relevance: 1.5, APIs: 1, Instructions: 44filenativeCOMMON

Download Yara Rule

APIs

NtNotifyChangeDirectoryFile.NTDLL(?,?,?,?,?,?,?,?,?), ref: 002B7E5C

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: ChangeDirectoryFileNotify
String ID:
API String ID: 1357473996-0
Opcode ID: 652967b425f6c889f190a7cfac4d8c3da01bcbeb36055590bab273e663ad7288
Instruction ID: 2231114083e44c42117d7f8877638079408ecbb6996efedf60ddf83d1f346d70
Opcode Fuzzy Hash: 652967b425f6c889f190a7cfac4d8c3da01bcbeb36055590bab273e663ad7288
Instruction Fuzzy Hash: 93F0FFB61052497F9701CE9ADCC4DEB7B6CFB9E7A4F444044BA4893601C230AD10C7B0

Function 002B8070 Relevance: 1.5, APIs: 1, Instructions: 32nativeCOMMON

Download Yara Rule

APIs

NtEnumerateKey.NTDLL(?,?,?,?,?,?), ref: 002B80A0

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: Enumerate
String ID:
API String ID: 304946047-0
Opcode ID: 86b581718a984c8a5ed5bcf25596e2069f7895ec2912e55ad568eb945e2ddc67
Instruction ID: 91ccef5e1955a139daf3de9275f44e0944d44b8ffe80ab60be68203d56d031c4
Opcode Fuzzy Hash: 86b581718a984c8a5ed5bcf25596e2069f7895ec2912e55ad568eb945e2ddc67
Instruction Fuzzy Hash: 81E092B2111259BFA7109B96EC48EE77F2CDBC57E4F008449B60883540C171AD00C3B0

Function 002B80B0 Relevance: 1.5, APIs: 1, Instructions: 32nativeCOMMON

Download Yara Rule

APIs

NtSetValueKey.NTDLL(?,?,?,?,?,?), ref: 002B80E0

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: b95c0a2cfa2e471ada501193907d18a3d90ea6141719bae1e7b091022264280a
Instruction ID: e8a2e220c3eebbbbcdd15347428ebadf62b6bf3c6f8a9654fc906d899f054dfb
Opcode Fuzzy Hash: b95c0a2cfa2e471ada501193907d18a3d90ea6141719bae1e7b091022264280a
Instruction Fuzzy Hash: D4E092B611425DBFA7109B47EC48EE77F2CEBC57E4F004049BA0883500D271AC10C3B0

Function 002B81E0 Relevance: 1.5, APIs: 1, Instructions: 32nativeCOMMON

Download Yara Rule

APIs

NtQueryMultipleValueKey.NTDLL(?,?,?,?,?,?), ref: 002B8210

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: MultipleQueryValue
String ID:
API String ID: 23559346-0
Opcode ID: fbb6b3a1bff0db5e406102b75115a42a8e34963d28d2c3c8d1a1690ae1834616
Instruction ID: 025cea15865524a5dde3186afd9cdaf234ea16e045a80b3d1fdadfb2c2f875f0
Opcode Fuzzy Hash: fbb6b3a1bff0db5e406102b75115a42a8e34963d28d2c3c8d1a1690ae1834616
Instruction Fuzzy Hash: 78E0E5B6515299BFAA119A96DC88DEBBF2CDBCA7A8B008059F90887541C670AD50C7B0

Function 002B8778 Relevance: 1.5, APIs: 1, Instructions: 32filenativeCOMMON

Download Yara Rule

APIs

NtOpenFile.NTDLL(?,?,?,?,?,?), ref: 002B87A8

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: FileOpen
String ID:
API String ID: 2669468079-0
Opcode ID: e3bc7ce4a5437f863cec46a69e2df24eec23e474afd25c6f7ff36b002d9ed670
Instruction ID: 6f21eac76e90c166325c66c3283684b53a852108c395c624e7bfe8067db3e5a6
Opcode Fuzzy Hash: e3bc7ce4a5437f863cec46a69e2df24eec23e474afd25c6f7ff36b002d9ed670
Instruction Fuzzy Hash: 42E0EDBA1102597FA6219A86DC8CDF7BF6CEBD97A4F104059B61887240D6746C50C7B0

Function 002B7F74 Relevance: 1.5, APIs: 1, Instructions: 32nativeCOMMON

Download Yara Rule

APIs

NtEnumerateValueKey.NTDLL(?,?,?,?,?,?), ref: 002B7FA4

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: EnumerateValue
String ID:
API String ID: 1749906896-0
Opcode ID: e34982105692d38043ed79d8dd2aef6ab54ac8f4752c47ac3d013a9f25c1d706
Instruction ID: 92b3f60ee8f16f4693610fe7e8ebbda269b9f5f73f820e1ec996d1b77332ec49
Opcode Fuzzy Hash: e34982105692d38043ed79d8dd2aef6ab54ac8f4752c47ac3d013a9f25c1d706
Instruction Fuzzy Hash: DCE0EDB6114259BFA7119A96DC8DEF77F6CDBC97E4B008059F50587551C2B0AC20C7B0

Function 002B8558 Relevance: 1.5, APIs: 1, Instructions: 26nativeCOMMON

Download Yara Rule

APIs

NtQuerySection.NTDLL(?,?,?,?,?), ref: 002B857F

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: QuerySection
String ID:
API String ID: 1985485932-0
Opcode ID: b341051d87e8cb53350ccdd1a3cc919cd0283d34f7f6eb9d2d72d416538ca534
Instruction ID: 8f9580b78e0ee3b2f5de5426583eff96da2666a47d61f7b99375011b9b48ce11
Opcode Fuzzy Hash: b341051d87e8cb53350ccdd1a3cc919cd0283d34f7f6eb9d2d72d416538ca534
Instruction Fuzzy Hash: DAE08CB50102257AD622675A9C0DEE77F6CDBE27B0F04815AF408921009660AD40C3B0

Function 002B8684 Relevance: 1.5, APIs: 1, Instructions: 26filenativeCOMMON

Download Yara Rule

APIs

NtQueryInformationFile.NTDLL(?,?,?,?,?), ref: 002B86AB

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: FileInformationQuery
String ID:
API String ID: 365787318-0
Opcode ID: 312163d94ab57e8c896023c3602f72aaf879d24308b7dab1142f7d2d298c88fb
Instruction ID: 834b526c4965e1d706c59e45d07c7b51db314ba2d428bdc6a7e270e6e589a22c
Opcode Fuzzy Hash: 312163d94ab57e8c896023c3602f72aaf879d24308b7dab1142f7d2d298c88fb
Instruction Fuzzy Hash: 73E08CB2110215BE96216A8ADC0CEE7BF2CDBC27B0F008159B50893100C670AC60C3B0

Function 002B7BB0 Relevance: 1.5, APIs: 1, Instructions: 26nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL(?,?,?,?,?), ref: 002B7BD7

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: InformationProcessQuery
String ID:
API String ID: 1778838933-0
Opcode ID: 2dc3e975774e4bdd7936682e1147bdf9474fe7210bdd42880e6e45f32acc0d19
Instruction ID: 9e1452131c6711863bcc0f50867230d0d6701022e6f73c33ab6dd59113c087ed
Opcode Fuzzy Hash: 2dc3e975774e4bdd7936682e1147bdf9474fe7210bdd42880e6e45f32acc0d19
Instruction Fuzzy Hash: 00E012B11142A57FD7115B9A9C0CDF77FACDBC67B4F048459B44893550D271AD10CBB0

Function 002B7D8C Relevance: 1.5, APIs: 1, Instructions: 26filenativeCOMMON

Download Yara Rule

APIs

NtSetVolumeInformationFile.NTDLL(?,?,?,?,?), ref: 002B7DB3

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: FileInformationVolume
String ID:
API String ID: 2893123674-0
Opcode ID: 58bed0b707619ac41e4167df77edcc343ef022ad53b27c874c34be2cdb13e0d6
Instruction ID: 5bbe089fa7dac385ad01d3840f74d5adecc56f4657c1dc6a818dadb331050a75
Opcode Fuzzy Hash: 58bed0b707619ac41e4167df77edcc343ef022ad53b27c874c34be2cdb13e0d6
Instruction Fuzzy Hash: EBE08CB501825A7ED321A64AAC0DEF77F2CEBC37F0F144059B558935008360AD10C3B0

Function 002B7FB4 Relevance: 1.5, APIs: 1, Instructions: 26nativeCOMMON

Download Yara Rule

APIs

NtQueryKey.NTDLL(?,?,?,?,?), ref: 002B7FDB

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: Query
String ID:
API String ID: 3850148591-0
Opcode ID: 8663032d0d30cfe27ca8a80795052d4c4f610fe7403493a83ac3194f9cdbb976
Instruction ID: f75551b3a05dbccd3448a2e1ee4bf0c75b779c5f21ebf4e231d3d82ec75536d3
Opcode Fuzzy Hash: 8663032d0d30cfe27ca8a80795052d4c4f610fe7403493a83ac3194f9cdbb976
Instruction Fuzzy Hash: BAE0ECB95192557ADB619A9BAC0CEF77F6CDBC67F0F144059B50993D10D2A0AC20C3B0

Function 002B827C Relevance: 1.5, APIs: 1, Instructions: 21nativeCOMMON

Download Yara Rule

APIs

NtSetInformationKey.NTDLL(?,?,?,?), ref: 002B829D

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: Information
String ID:
API String ID: 2951059284-0
Opcode ID: dd9223908d0615dbb6d3b2f3fc871e263809419947d6a5061b141ac4d8c5eab5
Instruction ID: 1d844bf5146c726e538aa5b4f9e1c661f8d70af5200f4b85b0e1c5fa136b3a9c
Opcode Fuzzy Hash: dd9223908d0615dbb6d3b2f3fc871e263809419947d6a5061b141ac4d8c5eab5
Instruction Fuzzy Hash: 01D05EF14223667FE2015799EC0DEFB7F5CCB863A0F008055B50992400D6B06D50C3F5

Function 0020A850 Relevance: 1.5, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

,, xrefs: 0020A9C3

Memory Dump Source

Source File: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 811a65cf3409202dbdc2a136d6b0f29975a2b342d84690debadf229062294712
Instruction ID: 6620bdec9e4f2c45d125b78c74c2a0257b782bd597ef5ca2a1bd1a9948a089ed
Opcode Fuzzy Hash: 811a65cf3409202dbdc2a136d6b0f29975a2b342d84690debadf229062294712
Instruction Fuzzy Hash: 97B128712083859FD324CF18C88061BBBE1AFA9704F448A2DF5D997382D671EA18CB57

Function 002B7D60 Relevance: 1.5, APIs: 1, Instructions: 21nativeCOMMON

Download Yara Rule

APIs

NtOpenKeyEx.NTDLL(?,?,?,?), ref: 002B7D81

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 89824d143dc8a71acff0df26d8d97181053b869b5d2e51979b97ad14170327c8
Instruction ID: 0b55a7211bbea9ab00553efb9cd5523fb6386e408afc33acabcca8fb2584d284
Opcode Fuzzy Hash: 89824d143dc8a71acff0df26d8d97181053b869b5d2e51979b97ad14170327c8
Instruction Fuzzy Hash: B4D052B14292A67EE602A7A9AC0CEF37E9CCBC67E0F404099B01992900E3A06C10D3B0

Function 002B7F54 Relevance: 1.5, APIs: 1, Instructions: 13nativeCOMMON

Download Yara Rule

APIs

NtOpenKey.NTDLL(?,?,?), ref: 002B7F6B

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 59bab2cf1e81905b22ad288adeaea5762cc739de1bc425f16bce7d06b8d6f0fc
Instruction ID: 0ef954d00489edda2d76b485116e2b0885c4546d308b1b73f9945b279a345afa
Opcode Fuzzy Hash: 59bab2cf1e81905b22ad288adeaea5762cc739de1bc425f16bce7d06b8d6f0fc
Instruction Fuzzy Hash: 63C04CE85143427DFE5B67689C0DF77195DC7C2706F0441CC7004D1954D6E49C60D334

Function 002A0FF0 Relevance: 1.5, Strings: 1, Instructions: 259COMMON

Download Yara Rule

Strings

Rijndael: Invalid key size - %d, xrefs: 002A103F

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Rijndael: Invalid key size - %d
API String ID: 0-1845578026
Opcode ID: c4ab7cdbb270ce3fbb39ded3cdffc5e7f7bd7fd6c9f52f8cc6e1b6bf2bc56c9d
Instruction ID: c5fb2614a76d1b5b1d7363cdfd0d658afc6530290d67c65959393804c3966093
Opcode Fuzzy Hash: c4ab7cdbb270ce3fbb39ded3cdffc5e7f7bd7fd6c9f52f8cc6e1b6bf2bc56c9d
Instruction Fuzzy Hash: 78B1BE30A1128A9FDF15CFA8C5916EDBBF1FF4A310F2544A9D854EB202D731AE26CB50

Function 00351958 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

d', xrefs: 003519FD

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: d'
API String ID: 0-519023437
Opcode ID: d5dc828ef5153c39792fdb8867743474a4f9bb226519da55c419fd5989a8a5d9
Instruction ID: c6149225b5b45fb01649c29988eff93e7effe1ccbc91c129f09e73f271f37a44
Opcode Fuzzy Hash: d5dc828ef5153c39792fdb8867743474a4f9bb226519da55c419fd5989a8a5d9
Instruction Fuzzy Hash: C2A1E474A002189FDB16DF64C985F9DB7F5FB49310F1182E5E808AB2A1DB71AE89CF41

Function 00339F48 Relevance: 1.5, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

ZwQueryKey, unsupported class %d, xrefs: 0033A727

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: ZwQueryKey, unsupported class %d
API String ID: 0-3838701109
Opcode ID: 0159eabfc2ea3a61da5e495eeb6114a4437cce9aa683815d0337948d180b2419
Instruction ID: 8eeb1613df2fbf8c35a8120d17e30b1c1f5149d838ee79344e6fb25a715c1e96
Opcode Fuzzy Hash: 0159eabfc2ea3a61da5e495eeb6114a4437cce9aa683815d0337948d180b2419
Instruction Fuzzy Hash: 0F8119B0A10609DFDB55DF68C8C1AAEB7F5AB88314F258468F848EB346DB34DD508F61

Function 00316264 Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

f, xrefs: 00316338

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: f
API String ID: 0-1993550816
Opcode ID: 7ed3cde6a1e0d1db7050a6d93dc7bb2f8ece258cdc8e3b58d0edfc3a0f81f8a3
Instruction ID: 39d929d9c647c001d31ceb500ef938efce43eec3fab910f2bf42513127f741f7
Opcode Fuzzy Hash: 7ed3cde6a1e0d1db7050a6d93dc7bb2f8ece258cdc8e3b58d0edfc3a0f81f8a3
Instruction Fuzzy Hash: B761F724D482E68BDF278EE944827EEBF7A9F49300F1A05F48CA857253D6710E86C760

Function 00316600 Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

f, xrefs: 003166D4

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: f
API String ID: 0-1993550816
Opcode ID: f1944d23ed887f095d842e2116f442fa834479f12379717db238954b15531ae6
Instruction ID: f9285812edc79408971a083bd6b85e7daeeec938ccffaf9151bed6b53a0af998
Opcode Fuzzy Hash: f1944d23ed887f095d842e2116f442fa834479f12379717db238954b15531ae6
Instruction Fuzzy Hash: C8610824D042E68BDB179EF84452BEEBFBA9F19308F1941F8CC9857283D5614E89CB60

Function 00316A40 Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

f, xrefs: 00316B14

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: f
API String ID: 0-1993550816
Opcode ID: 1c37bc4fe67e4db8937e8e0c6a0f00bcb0bc902fa3ecc7a074c3becc3025cbf0
Instruction ID: 14c943488bbb27132c3371f37d007dcfe18c2d185f0d399cc3da41900b9245e0
Opcode Fuzzy Hash: 1c37bc4fe67e4db8937e8e0c6a0f00bcb0bc902fa3ecc7a074c3becc3025cbf0
Instruction Fuzzy Hash: 8761F620D482EA8BDF179EE94452BEEBFBA9F59304F1681F4CCD897243D5610E85C7A0

Function 0020E1A0 Relevance: 1.4, Strings: 1, Instructions: 175COMMON

Download Yara Rule

Strings

000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081, xrefs: 0020E333

Memory Dump Source

Source File: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081
API String ID: 0-2471034898
Opcode ID: e63720651a896a22c37e8d7b77db7e7eee3ffc728a34b5ac8d3b0d9a3d059bf1
Instruction ID: e3dd4a286f443b742d7610d325fd8f1d40d9771eead16486e53894d2ea7960ac
Opcode Fuzzy Hash: e63720651a896a22c37e8d7b77db7e7eee3ffc728a34b5ac8d3b0d9a3d059bf1
Instruction Fuzzy Hash: 65515837B3A7904BD7288A3C5C55369AE870B93334B3FCBAAE9F18B3E6D55548514380

Function 00315268 Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

AuthenticAMD, xrefs: 0031532C

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: AuthenticAMD
API String ID: 0-1824591176
Opcode ID: de997db61ea80fe7a14500123ba2e61875c58b89a88baba415c5c5a4377af953
Instruction ID: b43e5c15ef7c7895b09659ccffe0cd58395a6c5c22f66209f39fd1665ffdbfb5
Opcode Fuzzy Hash: de997db61ea80fe7a14500123ba2e61875c58b89a88baba415c5c5a4377af953
Instruction Fuzzy Hash: E34171B6A04A06DFD709DF59C441388F7A1FF88304F61CA29E818DB742D778E9A1CB90

Function 0020BEB0 Relevance: .9, Instructions: 895COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8a87ec0cab429b3e572fb08238670188fe59ec5fe505e73d924cfabe70e9b20
Instruction ID: 0640e629f5efc22f12abbd9757d6031f33bf0f3a57a406f1dbf319a54ec2ddc2
Opcode Fuzzy Hash: f8a87ec0cab429b3e572fb08238670188fe59ec5fe505e73d924cfabe70e9b20
Instruction Fuzzy Hash: F652E6719287128BC7259F18D8402BAF3E1FFD4319F358B2DD986932D2D774A861CB86

Function 0020B3A0 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b97dfd2a4c92833f22288f9906f5f0bc260326c6a14724e578f66438d2a4d3ab
Instruction ID: c28fef065e3284c5ad43a0db4412676e43f2d690384412fa709875c04675b678
Opcode Fuzzy Hash: b97dfd2a4c92833f22288f9906f5f0bc260326c6a14724e578f66438d2a4d3ab
Instruction Fuzzy Hash: E452C270918B898FE736CF24C4847A7BBE2AB95314F144C6EC5E606BC3C779A894CB41

Function 002071F0 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c9957a88077510d1eb82311e24f59dc57eb2bd9c8cf059e7f32b69042f2acf5
Instruction ID: 8c9c8e9040a26458ecf38fe280b64eee68d93ad6f4fc38b46ce5235ec0897f02
Opcode Fuzzy Hash: 2c9957a88077510d1eb82311e24f59dc57eb2bd9c8cf059e7f32b69042f2acf5
Instruction Fuzzy Hash: E552C43191C3468FCB15CF28C0906AABBE1FF88314F198A6DF89957392D774E959CB81

Function 00370C38 Relevance: .6, Instructions: 620COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c649bda24f90d2619071bc706a82ccf0d66b03d47a7857b287191d6d8f98c5bc
Instruction ID: c632b6c93e91bc972a0561c9b8ca1e7b9a374767bd948c4e692f49f0b0929f7f
Opcode Fuzzy Hash: c649bda24f90d2619071bc706a82ccf0d66b03d47a7857b287191d6d8f98c5bc
Instruction Fuzzy Hash: F4425A35E042598FDB25CFA8C891BEDBBB5FF49300F1581A9E858EB356C638A945CF10

Function 00208FD0 Relevance: .6, Instructions: 620COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b4d601d4dcfc4819f4cebc317fb170d19b78d4d06f06623ba3166dc9d06dd77
Instruction ID: d809349834224d7fc666f04684c3a5781894ee579e14199f5d67578f325a85de
Opcode Fuzzy Hash: 6b4d601d4dcfc4819f4cebc317fb170d19b78d4d06f06623ba3166dc9d06dd77
Instruction Fuzzy Hash: 92428B79618301DFEB04CF28E85476ABBE1BF89315F09886CE486873A2D375D995CF42

Function 00207BF0 Relevance: .6, Instructions: 557COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2a7ed5b622adda4e4a0f1ac8225422fa115a8f038f8d21ab26a3781b49e1722
Instruction ID: bd8eee39a8b7076154af4331583493867b5810a7e26d24736cbdb334e225e6e7
Opcode Fuzzy Hash: b2a7ed5b622adda4e4a0f1ac8225422fa115a8f038f8d21ab26a3781b49e1722
Instruction Fuzzy Hash: DC324370928B118FC328CF29C590626BBF2BF45700BA04A2ED69787F92D776F855CB00

Function 002489A0 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3abc182aed2873737d46838e2a8fc0433d9fea16fea7ef518410c5f4c20e5b7
Instruction ID: d6deb5d262c4f7d93114c1110fee74d63907d629e4f742672e61d683ea14ff3a
Opcode Fuzzy Hash: a3abc182aed2873737d46838e2a8fc0433d9fea16fea7ef518410c5f4c20e5b7
Instruction Fuzzy Hash: C202BC30618341DFC704EF68E88461AFBE5EB8930AF09896DE58987361C335D9A0CB96

Function 00248A80 Relevance: .5, Instructions: 524COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5fbe9cf2505f95b79e6da7324fcefc5d3231727fd08a7d4c708b937bdabdefa
Instruction ID: 918084891f0afc5368b0779d7042dc9c7ab43573e563e884a1d804cb7aff937f
Opcode Fuzzy Hash: e5fbe9cf2505f95b79e6da7324fcefc5d3231727fd08a7d4c708b937bdabdefa
Instruction Fuzzy Hash: 48F19B3061C341DFC704EF28E88461EFBE5EB8A309F19896DE4C987261D336D960CB96

Function 00335AC8 Relevance: .5, Instructions: 521COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f728ebcd8bc4d618ec287718d544424e72194f13ca411184af99306e4db494a0
Instruction ID: ce7a2a98108af26db07d4bed46eae4080684125096098d413338ba6a2291300a
Opcode Fuzzy Hash: f728ebcd8bc4d618ec287718d544424e72194f13ca411184af99306e4db494a0
Instruction Fuzzy Hash: A3221974A00209EFEB15DF68C982FEEB7B6EF88700F248165F904AB291D770AD51CB51

Function 0020A300 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1c29873b19be694e667d8552001f09f0840e23b11e071a2e1309f3a6f85049e
Instruction ID: 0c8b15098665de161b25f6b5f8a93612e21f49449e82d5f8e46d68ac8ef6426e
Opcode Fuzzy Hash: c1c29873b19be694e667d8552001f09f0840e23b11e071a2e1309f3a6f85049e
Instruction Fuzzy Hash: 6EF1AB766083418FC724CF29C88176BFBE6AFD8300F48892DE4D587792E639E955CB52

Function 002F3C28 Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3904bb08535f649f28c049a873ea6b89340e0d1edf4cef96e5acbeca4aea15f4
Instruction ID: a81ad1727d1d6509ff4807bbc5bf62f64ad45ebe3c2df6432681194cda295896
Opcode Fuzzy Hash: 3904bb08535f649f28c049a873ea6b89340e0d1edf4cef96e5acbeca4aea15f4
Instruction Fuzzy Hash: A6E16A34A20609DFCB10EF69C9819AEF3F5FF58340B218665EA05A7361CA74EE61CF50

Function 00247AB0 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce1daf3ae00b8475e0ccbe22a97fa33de2d0b4c33b001e69cc32393f0533d81a
Instruction ID: e5148b6aef0d4ff46b55341715a43736738f81fc68418cc67b3c99f5651da4bb
Opcode Fuzzy Hash: ce1daf3ae00b8475e0ccbe22a97fa33de2d0b4c33b001e69cc32393f0533d81a
Instruction Fuzzy Hash: 09B10972A2C3514BE328DF28CC4576BB7E9EBC4314F444A2DE9A597382E735DC148B92

Function 0020AF10 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a830bb90a10fd2c62e4550d14816ec8950e1a867f5d60e10bde19dd08112dad5
Instruction ID: f8dfc2f016a2405f91435e76872acb807c79d610fb5de09ad98101655978e677
Opcode Fuzzy Hash: a830bb90a10fd2c62e4550d14816ec8950e1a867f5d60e10bde19dd08112dad5
Instruction Fuzzy Hash: 48C17AB2A187418FC370CF68DC96BABB7E1BF85318F08492DD1D9C6242E778A155CB46

Function 00247710 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b1fd25086cc1f3b4fdec89fa51ecb686aa336f0f30892544f0d1ba8cb537b595
Instruction ID: 0cfdc3654aed32edb9a6ffd9d1ed152296e041468c8eca22a0862b54bf99bbf9
Opcode Fuzzy Hash: b1fd25086cc1f3b4fdec89fa51ecb686aa336f0f30892544f0d1ba8cb537b595
Instruction Fuzzy Hash: 7B918B71628311ABE728DF14D840B6BBBE5EB89354F544C1CF8A587392E730E960CB92

Function 002E482C Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1442a8440cf6b4f6e30bbffa07d237cc28e428c17a712cba19e45096f7c00ba8
Instruction ID: 7be24af491e28c110770462e174e0e7dbb1edc163d36b33b49ec64192ee97ec4
Opcode Fuzzy Hash: 1442a8440cf6b4f6e30bbffa07d237cc28e428c17a712cba19e45096f7c00ba8
Instruction Fuzzy Hash: D0B18134A60185DFCB15EFA9C995AAEB3F5EB49300FA644A5F404AB361C734EE60DF10

Function 00351E80 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66549a65eb9f831ec68fa70483855397720d5449cbf2b02046a75a1c8926e365
Instruction ID: 7c1a33617e51ed504d6f82a8660069b5466769275287f6c7604ece99d6f9fc8f
Opcode Fuzzy Hash: 66549a65eb9f831ec68fa70483855397720d5449cbf2b02046a75a1c8926e365
Instruction Fuzzy Hash: BBC11534A00258DFDB56DB68C985F9EB7F5AB4A301F5181E5E809AB261CB309F89CF40

Function 002AB97C Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 288f0e1c7655e4041bdcdb933e1e5ed6a123c6ba8997216cb040ecb64f16d792
Instruction ID: 00b0d202d6c508a59bcd1996038c698e7ff7abce7b54edc8506d2e54a42b492d
Opcode Fuzzy Hash: 288f0e1c7655e4041bdcdb933e1e5ed6a123c6ba8997216cb040ecb64f16d792
Instruction Fuzzy Hash: E8916D31E2020A8FCB12CF98C585AAEBBB5EB4A310F114129D815B7353CF749D61CFA0

Function 002364F0 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93bc0a3f3d2af39d1341d27ba6f7afa36a276b63b566b8ccefdbed4c58a390dc
Instruction ID: 7038e4a89fde9d2dee741a7a46cf3ab05bb69d7f42c3852e03564b7de4f1acf9
Opcode Fuzzy Hash: 93bc0a3f3d2af39d1341d27ba6f7afa36a276b63b566b8ccefdbed4c58a390dc
Instruction Fuzzy Hash: 0771E677B39A904BC3149D3C9C8A3A5AA8B4BD7334F3DC379A9B48B3E5D6694C164340

Function 0035E434 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64600482ab28c7abcc7786838033ea48ccfd873a7eca853b98dcd6e61472bf98
Instruction ID: 73b2e69aaf208102a47870daf64eefc19edd6c0eaae6feae420e4f08dcf7a7c1
Opcode Fuzzy Hash: 64600482ab28c7abcc7786838033ea48ccfd873a7eca853b98dcd6e61472bf98
Instruction Fuzzy Hash: 8CB13FB16042008FE74CCF19D489B457BE1BF49318F1680A9D9098F3A7D7BAD989CF95

Function 0036480C Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a46a25728c0e4dbe5aa0a1433bd48846487817f0c63754d6310f19dcd07371b1
Instruction ID: 639fe6064de44534984cfd44a96725e0587ef9eaf6c55a96ead7e09619f54c19
Opcode Fuzzy Hash: a46a25728c0e4dbe5aa0a1433bd48846487817f0c63754d6310f19dcd07371b1
Instruction Fuzzy Hash: 9161512278DB8103E73D8E7D9CE02B7EAD35FC631862ED57D94DAC3F46E85AA4164108

Function 0036B01C Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f1d6593563d9cb26f33217e48ccb4b20074c95c2ae91fc9771355c49cee48f6
Instruction ID: dce7409307681c68dce0e8f8ae3eb46ba46f74f4c5610b58d8bc3960a7e8298e
Opcode Fuzzy Hash: 0f1d6593563d9cb26f33217e48ccb4b20074c95c2ae91fc9771355c49cee48f6
Instruction Fuzzy Hash: BC815C73D104374BEB628EA89C443A16392AFCC39EF5B46B0ED05AB64AD634BD5186C0

Function 002C8BB0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62c00abdb2f5c762d8da5c63a2fb2e0ec32f1b7029c033c41f38c7b5d06a9f17
Instruction ID: 81b468fcd8509a99416f1d64e29bcc08ada663c916a4f97bdddb99bca3f75d7a
Opcode Fuzzy Hash: 62c00abdb2f5c762d8da5c63a2fb2e0ec32f1b7029c033c41f38c7b5d06a9f17
Instruction Fuzzy Hash: CB811B71A20108AFDB04DFA9C881EDEB7F9AF48300F20C1A9F505DB366DA71EE519B54

Function 002382D0 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b804aeade8876ab032fe0309d9355f3cbf5387573f07a93e53f3794f1dfaca75
Instruction ID: 74ccdbfb51f00552b139bd932fe9f034351598c15e06b8ce404726a1bce177cf
Opcode Fuzzy Hash: b804aeade8876ab032fe0309d9355f3cbf5387573f07a93e53f3794f1dfaca75
Instruction Fuzzy Hash: 20613867B7AB914BC315453C6C553A6AA831BD2730F3EC3A6F9B18F3E5CDA948124341

Function 0036AD68 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d81fdb3a78610bfe5f18f61983f17282b1cfead07b95f58b2a0204bfcd9bc72
Instruction ID: 20f0a66ae87088f19ebb8a8c578cd2dba9f1b57b3b8bd13bdcf90de9801a8dd7
Opcode Fuzzy Hash: 4d81fdb3a78610bfe5f18f61983f17282b1cfead07b95f58b2a0204bfcd9bc72
Instruction Fuzzy Hash: 9B712973D204775BEB619EA8C8443617392EFC921CF5F46B0CE05BB64AC634BC529AC1

Function 0023E8A0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53adb1b22930f8a695f789fdc3f4b943ccd6ac5fb5c634955e3c1cdf4e3fec6a
Instruction ID: 731921d7b46c2a07086207d2420bb087978b92491a081d8abb1ff3b66157cdf5
Opcode Fuzzy Hash: 53adb1b22930f8a695f789fdc3f4b943ccd6ac5fb5c634955e3c1cdf4e3fec6a
Instruction Fuzzy Hash: 1B516BB16087548FE714DF69D49435BBBE1BB89318F054E2DE4E987390E379DA088F82

Function 00247520 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e99ea9dda558ed79ca841901c0cb32558930eb0a85ce35c8f6765ccdd9545e25
Instruction ID: 0ece9dac6e9fd267e564b71145d937379af30c3fb003f2c50fd54ee3acbeb22c
Opcode Fuzzy Hash: e99ea9dda558ed79ca841901c0cb32558930eb0a85ce35c8f6765ccdd9545e25
Instruction Fuzzy Hash: 4751373162C3109BC7189E18DC90B2EF7E6FB89354F688A2CE8E557391C731EC208B91

Function 00313AC8 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3a722e6e52a32604324a0cc1149192fde9630d4685bd3f2842df714e87ca5c3
Instruction ID: 32a3d1ab350f564b62666c4b252f238e1260de9d76fb162975652ccbd4610ab4
Opcode Fuzzy Hash: e3a722e6e52a32604324a0cc1149192fde9630d4685bd3f2842df714e87ca5c3
Instruction Fuzzy Hash: 0561A35911417682CB28AFEDD1842A177A1EFA8B00B1055E6DC6ADF63FF330C8D1C7A9

Function 00205A50 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1ca5c9f5ce55a5c01badc0cca6a23b43dd0f5244a8c499de451ee3f724abe2e
Instruction ID: e673a5de5e5de2ef016dccc4290a1968ec4b869c802f2f326a90ae5e63483a65
Opcode Fuzzy Hash: e1ca5c9f5ce55a5c01badc0cca6a23b43dd0f5244a8c499de451ee3f724abe2e
Instruction Fuzzy Hash: 4351E2B1A147159FD714EF14C880927B7A0FF85328F15466CE8958B393D630EC62CF92

Function 0036F048 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f739a0ceb33e9ce06ab3a36252a1776b2d497435828433a6edbaaf3f4ccbe2d
Instruction ID: 03b121f09877bbdfadfa9de1dd3c884307ab01691f0b5a13ddaf94aff1745888
Opcode Fuzzy Hash: 8f739a0ceb33e9ce06ab3a36252a1776b2d497435828433a6edbaaf3f4ccbe2d
Instruction Fuzzy Hash: BC5161252086904FCB278F6CA4D05613FA2AF9A355B2A82E9CDD48F34FD522ED52D790

Function 00313D94 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7660f5dda2f10b892d2d747a254a3f2e5269969d0f4098e580ff3e5d3b618b7e
Instruction ID: f62aea300cb1ca13fc92cdb338f60c8d8a104e7993e1792dfbd1dd2be65632a4
Opcode Fuzzy Hash: 7660f5dda2f10b892d2d747a254a3f2e5269969d0f4098e580ff3e5d3b618b7e
Instruction Fuzzy Hash: F441EC6C100A47DAC314AF64C4415E6F7B1FFA8710740C625E9A9D7B24F334E9A6CBA5

Function 00313F24 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99592dd2673f2bfa13e198a76fea079bbb98715a8f887e9f9cedd6e93f9b3fb4
Instruction ID: 6d167adbb778cab364c36763c86db8361980bf35be76dd990f45b1528e9dbc5f
Opcode Fuzzy Hash: 99592dd2673f2bfa13e198a76fea079bbb98715a8f887e9f9cedd6e93f9b3fb4
Instruction Fuzzy Hash: B241FC6C100A47DAC314AF64C4416E6F3B1FFA8710B40C615E8BDD7B24F334A9A5CBA5

Function 002049A0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbe2eee255ce80e2df90ed4850d7395439c2c852be5922ee4a7cea5853ec6c97
Instruction ID: 496f64f42b5e5a5f4c8313a548d7f95e6a2189d5fdd449249df45df462714afa
Opcode Fuzzy Hash: cbe2eee255ce80e2df90ed4850d7395439c2c852be5922ee4a7cea5853ec6c97
Instruction Fuzzy Hash: 1E31DBB17683019BD710AF58D89052BB7E1EF88358F18C53CE99A872C3D231EC62CB46

Function 02998B0C Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171945727.0000000002990000.00000040.00001000.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2990000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a60221922100a1662983ae068bf9c58fe2571c02e977a47696ac82e3c1b0daeb
Instruction ID: a1492f75e4e731eba17a1277d04c2073d887b07ffad28fe192294674f967acd8
Opcode Fuzzy Hash: a60221922100a1662983ae068bf9c58fe2571c02e977a47696ac82e3c1b0daeb
Instruction Fuzzy Hash: CC110E7A6822246FF2206B1ACC09F627BBCDBD4B51F064129F8499B392C67198008FE5

Function 00206EA0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8706f6d31cb388ad3a88795671e6153de3a0eb7c2fea29f25fc03bedc6967975
Instruction ID: 80f7e2fcf8a7fe3e31e2288f823751c4705d0a885f823efb21d9c901ee617b3e
Opcode Fuzzy Hash: 8706f6d31cb388ad3a88795671e6153de3a0eb7c2fea29f25fc03bedc6967975
Instruction Fuzzy Hash: F5F0243E72831B0FF311CDAAE8CC83BB396D7DA364B041539EA41C3642CD72E8228190

Function 002BB278 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

GetMonitorInfoA.USER32(?,?), ref: 002BB2A9
GetSystemMetrics.USER32(00000000), ref: 002BB2E5
GetSystemMetrics.USER32(00000001), ref: 002BB2F0

Strings

DISPLAY, xrefs: 002BB311
GetMonitorInfo, xrefs: 002BB290

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: MetricsSystem$InfoMonitor
String ID: DISPLAY$GetMonitorInfo
API String ID: 4250584380-1633989206
Opcode ID: ab7af8fd114a487b24345b2d4e2f5977e1d5f3ca9aa960b5e7a6e0c71e29e584
Instruction ID: edf50751d14d981a1b95384fb748eb33a3f775331120c7143d93bd93fecfdf86
Opcode Fuzzy Hash: ab7af8fd114a487b24345b2d4e2f5977e1d5f3ca9aa960b5e7a6e0c71e29e584
Instruction Fuzzy Hash: A011BE31A217069FD722CFA18C48BF7B7E8EB0A350F41456AED49D7241D7B1A8548FA1

Function 002BB4F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

EnumDisplayMonitors.USER32(?,?,?,?), ref: 002BB52D
GetSystemMetrics.USER32(00000000), ref: 002BB552
GetSystemMetrics.USER32(00000001), ref: 002BB55D

Strings

EnumDisplayMonitors, xrefs: 002BB50C

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: MetricsSystem$DisplayEnumMonitors
String ID: EnumDisplayMonitors
API String ID: 1389147845-2491903729
Opcode ID: 94b99103e6181ef51d1ddfc1d270c689578419ab0ae4371790de9d874ebe4913
Instruction ID: 0692d2cc49422f9ad9b44b2f154a4d119e8f62803e4cf49463b5ccceec7446a4
Opcode Fuzzy Hash: 94b99103e6181ef51d1ddfc1d270c689578419ab0ae4371790de9d874ebe4913
Instruction Fuzzy Hash: AE31327691020AAFDB12DFA5DC44AEFB7BCEB09340F404126F915E3141E7B4D9648FA2

Function 002BB34C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000000), ref: 002BB3B9
GetSystemMetrics.USER32(00000001), ref: 002BB3C4

Strings

GetMonitorInfoA, xrefs: 002BB364
DISPLAY, xrefs: 002BB3E5

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: MetricsSystem
String ID: DISPLAY$GetMonitorInfoA
API String ID: 4116985748-1370492664
Opcode ID: cca41fd69c3ed27aa704457a8399c3b4743eb00970642be06f25f8e5806a555c
Instruction ID: 820c8494a6b89e75e5ca79fd27028cadc72436c79eb67413ee0b6b38f16ac4ed
Opcode Fuzzy Hash: cca41fd69c3ed27aa704457a8399c3b4743eb00970642be06f25f8e5806a555c
Instruction Fuzzy Hash: 4B11B1716203059FD7228F65DC487E7B7E9FB0A350F01452AED49D7240E7B1A854CBA1

Function 002BB420 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000000), ref: 002BB48D
GetSystemMetrics.USER32(00000001), ref: 002BB498

Strings

GetMonitorInfoW, xrefs: 002BB438
DISPLAY, xrefs: 002BB4B9

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: MetricsSystem
String ID: DISPLAY$GetMonitorInfoW
API String ID: 4116985748-2774842281
Opcode ID: d0318e9795ea4ad2c2b3f977b897bb710bf84f4c2be339bab082353ec5127d6d
Instruction ID: bf77a51d1b216f1fc2ac42e55f2a765f8ffa42f9bf6903b6984309b48cd21d7b
Opcode Fuzzy Hash: d0318e9795ea4ad2c2b3f977b897bb710bf84f4c2be339bab082353ec5127d6d
Instruction Fuzzy Hash: 6011EE31621705AFD3228F609C447E7B7F8FF06B51F01452AED49DB292D3F1A8208BA1

Function 002BB1E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000000), ref: 002BB22E
GetSystemMetrics.USER32(00000001), ref: 002BB240

Strings

MonitorFromPoint, xrefs: 002BB1F2

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: MetricsSystem
String ID: MonitorFromPoint
API String ID: 4116985748-1072306578
Opcode ID: 5ddb4e01f17dd73a7cf8cc4e811417ca54b091c74fbc5277d4bb2622f0b666b0
Instruction ID: 3d3b98e3929003d56fed3d736f5c0be24e1298137d878a45ac207c8e5bb39123
Opcode Fuzzy Hash: 5ddb4e01f17dd73a7cf8cc4e811417ca54b091c74fbc5277d4bb2622f0b666b0
Instruction Fuzzy Hash: F601F93121020CAFDB064F50DC44BDE7B58EB863A5F418036FD18DB252C3B29CA18FA0

Function 002BB0B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000000), ref: 002BB109
GetSystemMetrics.USER32(00000001), ref: 002BB115

Strings

MonitorFromRect, xrefs: 002BB0CD

Memory Dump Source

Source File: 00000000.00000002.2170997884.000000000025E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2170982585.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170997884.00000000003C4000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_SecuriteInfo.jbxd

Similarity

API ID: MetricsSystem
String ID: MonitorFromRect
API String ID: 4116985748-4033241945
Opcode ID: 0d00974bf14d13b3ade799f07d86657a0e8e98a83e910269eb15b50e299480a4
Instruction ID: 88bbd2617461291512c066913d57957a2d1231e25261bab334626ce6f5f6891d
Opcode Fuzzy Hash: 0d00974bf14d13b3ade799f07d86657a0e8e98a83e910269eb15b50e299480a4
Instruction Fuzzy Hash: BF01D631A201099FD7128F18DC897B6B7ACE74A395F558066E848CB202C3B1DC508FB0

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Windows Analysis Report
SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe

Function 003C7208 Relevance: 3.9, Strings: 3, Instructions: 184
COMMON

Function 002B8710 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52
filenativeCOMMON

Function 002B8634 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9
nativeCOMMON

Function 002B86B8 Relevance: 1.5, APIs: 1, Instructions: 44
filenativeCOMMON

Function 002B8650 Relevance: 1.5, APIs: 1, Instructions: 26
filenativeCOMMON

Function 00245BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Function 003D060C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 57
COMMON

Function 02998DC8 Relevance: 1.6, APIs: 1, Instructions: 90
COMMON

Function 00243220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON